It doesn't seem to work with GCP

[olegkorol]

It doesn't seem to work with GCP

[olegkorol]

Update

I ran the vpn.sh script as usual, then made a backup of the "original" IPSec config file:

mv /etc/ipsec.conf{,.original}

...and replaced it with another configuration, as suggested here (replacing xxx with the right addresses):

config setup
    protostack=netkey

conn mysubnet
     also=mytunnel
     leftsubnet=xxx # (in my case 10.0.0.0/24)
     rightsubnet=xxx # (in my case 10.108.0.0/20)
     auto=start

conn mytunnel
    left=xxx # the external IP of *this* server
    right=xxx # the external IP of GCP's Cloud VPN Gateway
    authby=secret

Then I restarted the IPSec VPN:

sudo ipsec restart

Ping: GCP -> local network

✅ This time I was able to ping from a VM in GCP to the "local network" (simulating it with a VM on DigitalOcean for now):

ping 10.108.0.2 # this being the internal IP of the DO VM

Ping: local network -> GCP

❌ No luck yet pinging in the opposite way – but that's not crucial for now, since the communication in my use-case is intended to be one-way only.

Call API on local network from GCP

I tried to run a test-API with a Node.js server on the "local network" (on port 3000) and calling it from GCP – but it did not work straightaway:

curl 10.108.0.2:3000
curl: (7) Failed to connect to 10.108.0.2 port 3000 after 83 ms: Couldn't connect to server

⚠️ This is because I was running the Node.js server with hostname 127.0.0.1 (aka. localhost). In order to be able to access it from other devices in the same network, the hostname has to be set to 0.0.0.0.

So, everything seems to be working as expected now (aside from Ping: local network -> GCP).

FYI @hwdsl2

[hwdsl2]

@olegkorol Hello! Thank you for providing the details of your use case. Unfortunately, this is not currently supported in this project. The Cloud VPN Gateway in GCP uses IKEv2 with pre-shared keys, while this project requires certificate-based authentication for IKEv2, or pre-shared keys with username/password for IKEv1.

If you would like to explore the use case further yourself, you may refer to these configuration examples and/or ask on the Libreswan users mailing list.

[olegkorol]

Thanks for the swift reply, @hwdsl2!
I'll check those resources and see if I can get this up and running :)