The gateway instance must be launched from a public subnet.
- CoPilot UI
- Terraform
To create a default VPN Gateway instance in AWS, Azure, or GCP in an account
with no existing VPN gateways:
- In Aviatrix CoPilot, go to Cloud Fabric > UserVPN. Make sure the Default VPN tab is selected.
-
Click + VPN Gateway.
For more information on these gateway settings, see
UserVPN Gateway Settings
.
Setting Description Name Enter a name for the gateway. Cloud Select the cloud in which to launch the gateway instance. Note that for AWS and Azure, you can click the dropdown menu to select the standard, gov, or China clouds. Account Select the cloud account in which to launch the gateway. These accounts are onboarded through CoPilot > Cloud Resources > Cloud Accounts. Region Select the cloud region in which to launch the gateway. VPC/VNet Select the VPC or VNet in which to launch the gateway. Edit Gateway Name This field only appears if you are adding a default VPN gateway in an account where a default VPN gateway already exists. If you are adding a new gateway and there is an existing gateway, the other fields listed, including Instance Size and High Performance Encryption, are not available. You can edit the existing VPN gateway for this VPN Gateway to add more instances as needed. To do so, click Edit <Gateway Name>. Instance Size Select the size of the gateway instance. High Performance Encryption For more information, see the About High Performance Encryption document. Turn this setting on to use High Performance Encryption if this VPN Gateway will be used for encrypted peering with another gateway. Instances To add a gateway instance, click + Instance. Attach to Subnet Public IP VPN CIDR Split Tunnel Turn Split Tunnel on to ensure only the specified CIDR ranges go through the VPN tunnel. When you turn this setting on, new fields appear below. Load Balancer (available for AWS, Azure, and GCP) To turn on load balancing to help support larger VPN gateways, click the dropdown menu and select an option. You can select the Do not use Load Balancer option. If you decide you want to use a Load Balancer, depending on the cloud type you selected, you can select: ELB (available for AWS, Azure, and GCP) — Use the Cloud Service Provider’s load balancing solution. When this option is enabled, the domain name of the ELB will be the connection IP address when a VPN user connects to the VPN gateway. This connection IP address is part of the .ovpn cert file the Controller sends to the VPN client. Existing UDP Load Balancer (available in standard AWS cloud) — Select an existing AWS load balancer that uses the UDP protocol. New UDP Load Balancer (available in standard AWS cloud) — Create a new AWS load balancer that uses the UDP protocol. If you select this option, new fields appear (see below). No Load Balancer — Select this option if you have a smaller deployment with limited traffic and do not need a load balancer. VPN gateways are grouped by load balancer. See the UserVPN Gateway Guide document for more information on gateway groupings.Policy-Based Routing optionsSetting Description ELB Name (when you select ELB Load Balancer) Enter the (optional) ELB name. Select the VPN Protocol (TCP or UDP). New UDP Load Balancer options (when you select New UDP Load Balancer) Account — Select the Aviatrix cloud account for the new UDP load balancer. Hosted Zone Name — Enter the name of the AWS hosted zone for this load balancer. VPN Service Name — Enter the name of the VPN service you are using. UDP Load Balancer (when you select Existing UDP Load Balancer) Select the name of the existing UDP Load Balancer. Max Connections (Per Gateway Instance) Set the maximum number of active VPN users allowed to be connected to this gateway. The default is 100. When you change this number, make sure the number is smaller than the VPN CIDR block. The UserVPN CIDR Block allocates 4 IP addresses for each connected VPN user; when the VPN CIDR Block is a /24 network, it supports about 60 users. Authentication Click this dropdown menu and select an authentication option: None (Certificate-Only) Duo: When you select this option, a new section, Authentication: Duo appears below. See the “UserVPN Duo Authentication” document to find the Integration key, Secret key, and API hostname needed for this authentication method. LDAP: When you select this option, a new section, Authentication: LDAP appears below. See the “UserVPN LDAP Authentication” document to find the LDAP Server, Blind DN, Password, and other values needed for this authentication method. LDAP + Duo: When you select this option, Authentication: Duo and Authentication: LDAP sections appear below. See the “UserVPN Duo Authentication” and “UserVPN LDAP Authentication” documents to find the Integration key, LDAP Server, or other information to enter in these sections. Okta: When you select this option, a new section, Authentication: Okta appears below. See the “UserVPN Okta Authentication” document to find the URL, Token, and Username Suffix needed to enter in these fields. SAML Client Certificate Sharing Turn this setting on to allow VPN users to share .ovpn files. You must have MFA (such as SAML, LDAP + Duo) configured to make VPN access secure. Duplicate Connections Turn this setting on to enable users sharing the same common name to connect at the same time to the VPN Gateway. Turn this setting off to make sure a user cannot make a new connection through a different device until they disconnect their existing session. Users can still land on different VPN Gateways under a load balancer when Duplicate Connections is turned on. Policy-Based Routing Policy-Based Routing (PBR) enables you to route VPN traffic to a different subnet with its default gateway. By default, all VPN traffic is NATed and sent to VPN gateway’s eth0 interface. If you want to force the VPN traffic to go out on a different subnet other than VPN gateway eth0 subnet, you can specify a PBR Subnet in the VPC and the PBR Default gateway. If you turn this setting on, new fields appear below. Setting Description Subnet (Optional) Select a specific subnet to route traffic to. Default Gateway (Optional) Select a default gateway to route traffic to. Split Tunnel optionsSetting Description NAT Translation Logging Turn this setting on to enable logging for the NAT translations at the VPN gateway for each connection of the VPN traffic flowing through the gateway. Setting Description Additional CIDR(s) (Optional) The VPC/VNet CIDR where the VPN gateway is deployed is the default CIDR that VPN gateway pushes to the VPN client. Leave it blank if you do not need it. When Split Tunnel Mode is enabled, the Additional CIDRs specifies a list of destination CIDR ranges that will also go through the VPN tunnel. This is a useful field when you have multiple VPC/VNets that the VPN user needs to access. Nameserver(s) (Optional) When Split Tunnel Mode is enabled, you can instruct the VPN gateway to push down a list of DNS servers to your desktop, so that a VPN user is connected, it will use these DNS servers to resolve domain names. Search Domain(s) (Optional) When Split Tunnel Mode is enabled, a Search Domains lets you specify a list of domain names that will use the Nameserver when a specific name is not in the destination. Windows VPN clients support a maximum of 10 search-domain entries (the OpenVPN service supports only up to 10 on the Windows OS). Resource Tags (AWS and Azure only) If you tagged your cloud resources, the resource tags display here after the UserVPN gateway is created. A resource tag is a key-value pair. You can also add custom tags after the gateway is created. - Click Create. Your default VPN gateway has been created. To view the task’s progress, go to Monitoring > Notifications > and select the Tasks tab.
Create a VPN-enabled gateway with the
aviatrix_gateway
resource. There is no separate resource for a VPN gateway — set
vpn_access to
true on a standard gateway resource, along with vpn_cidr and max_vpn_conn.1
Create the VPN-enabled gateway
Add the following
aviatrix_gateway resource block to your Terraform configuration file:resource "aviatrix_gateway" "vpn_gateway" {
cloud_type = 1
account_name = "devops"
gw_name = "vpn-gw-01"
vpc_id = "vpc-abcdef"
vpc_reg = "us-east-1"
gw_size = "t3.small"
subnet = "10.0.0.0/24"
vpn_access = true
vpn_cidr = "192.168.43.0/24"
max_vpn_conn = "100"
}
cloud_type selects the cloud provider (AWS: 1, GCP: 4, Azure:
8). vpc_id, vpc_reg, and subnet must reference an existing
VPC/VNet public subnet. Make sure max_vpn_conn is smaller than the
number of addresses in vpn_cidr.2
Verify and Apply the Configuration
Run
terraform plan, review the planned changes, and run terraform apply.