Creating a VPN server

Creating a VPN server in the UI

To create a client-to-site VPN server in the UI:

1. Complete all prerequisites in the "Before you begin" section.

2. From your browser, open the IBM Cloud console and log in to your account.

3. Select the Navigation Menu , then click Infrastructure > Network > VPNs.

4. Click Create in the upper right of the page.

5. In the VPN type section, click Client-to-site servers.

   

   The Locations section shows the region where the VPC is located and where the VPN server will be provisioned.

6. In the Details section, specify the following information:

   • VPN server name - Enter a name for the VPN server, such as my-vpn-server.

   • Resource group - Select a resource group for the VPN server.

   • Tags - Optionally, add tags to organize, track usage costs, or manage access to your resources.

   • Access management tags - Optionally, add access management tags to resources to help organize access control relationships. The only supported format for access management tags is key:value. For more information, see Controlling access to resources by using tags.

   • Virtual private cloud - Select the VPC for the VPN server.

   • Client IPv4 address pool - Enter a CIDR range. The client is assigned an IP address for its session from this address pool.

     

7. In the Subnets section, specify the following information:

   • Select a VPN server mode:

     • High-availability mode - Deploys the VPN server across two subnets in different zones. Best for multi-zone deployments and solutions where client VPN access is critical.
     • Stand-alone mode - Deploys the VPN server in a single subnet and zone. Best for single-zone deployments where multi-zone resiliency is not required.

   • Specify the subnet (stand-alone mode) or subnets (HA mode) for your VPC.

     

8. In the Authentication section, specify the following information:

   • VPN server authentication - Select the server SSL certificate from Secrets Manager. Complete all required fields.

     

   • Client authentication modes - Select to configure user authentication through the use of a client certificate, user ID and passcode, or both.

     • Client certificate - You can select a client certificate and configure a user ID and passcode for optimal security. A user ID and passcode provides an added layer of security that requires additional login credentials for account access.

       Optionally, you can upload a Certificate Revocation List (CRL) in PEM format. After you upload a CRL, the PEM file shows as the name of the VPN server.

     • User ID and passcode - Configure added authentication for VPN client users. This authentication method offers an added layer of security that integrates with IBM Cloud IAM to complete the client authentication. When authentication is completed, the system passes the code to the openVPN client for authentication.

     

9. In the Security groups section, select at least one security group.

   To configure one or more security groups and their rules or, to optionally configure access control lists (ACLs) on the subnet where you plan to deploy the VPN server and other VPC subnets that communicate over the VPN tunnel, see Configuring ACLs and security groups for use with a VPN server.

   

   You can attach security groups after provisioning from the VPN server's details page (Security Groups tab).

10. In the Additional configuration section, specify the following information:

    • DNS server IP address - Optionally, specify one or two DNS server IP addresses for domain name resolution.

    • Idle timeout session (seconds) - If the VPN server has no traffic before this interval lapses, it is automatically disconnected. This value can range between 0 to 28800 seconds. The default value is 600 seconds.

    • Transport protocol - Select one of the following protocols and enter a valid VPN port (1 - 65535).

      • UDP is a connectionless protocol that performs error checking but discards erroneous packets. Faster than TCP.
      • TCP is a connection-oriented protocol with error checking and error recovery. More reliable than UDP.

    • Tunnel mode - Specify one of the following:

      • Full tunnel - All traffic flows through the VPN interface to the VPN tunnel.

      • Split tunnel - Private traffic flows through the VPN interface to the VPN tunnel, and public traffic flows through the existing LAN interface.

        

Creating a VPN server from the CLI

Before you begin, set up your CLI environment.

To create a VPN server from the CLI, enter the following command:

ibmcloud is vpn-server-create --subnets SUBNETS --client-ip-pool CLIENT_IP_POOL --cert CERT (--client-auth-methods certificate | username | certificate,username | username,certificate) [--client-ca CLIENT_CA] [--client-crl CLIENT_CRL] [--client-dns CLIENT_DNS] [--client-idle-timeout CLIENT_IDLE_TIMEOUT] [--enable-split-tunnel false | true] [--port PORT] [--protocol udp | tcp] [--security-group SECURITY_GROUP1 --security-group SECURITY_GROUP2 ...] [--name NAME] [--resource-group-id RESOURCE_GROUP_ID | --resource-group-name RESOURCE_GROUP_NAME] [--output JSON] [-q, --quiet]

Creating a VPN server with the API

To create a client-to-site VPN server with the API, follow these steps:

1. Set up your API environment with the right variables.

2. Store any additional variables to be used in the API commands; for example:

   • ResourceGroupId - Find the resource group ID by using the get resource groups command and then populate the variable:

     export ResourceGroupId=<your_resourcegroup_id>
     

   • SubnetId - Find the subnet ID by using the get subnet command and then populate the variable:

     export SubnetId=<your_subnet_id>
     

3. When all variables are initiated, create the VPN server:

      curl -X POST "$vpc_api_endpoint/v1/vpn_servers?version=$api_version&generation=2" \
        -H "Authorization: $iam_token" \
        -d '{
           "certificate": {
               "crn": "crn:v1:bluemix:public:cloudcerts:us-south:a/aa5a471f75bc456fac416bf02c4ba6de:1862b0b4-c1f8-4eef-a6b5-e9c00c9f593d:certificate:6c801ef768c139d986b4c6f91175e8cc"
            },
           "client_ip_pool": "192.168.50.0/22",
           "name": "my-new-vpn-server",
           "subnets": [
               {
                     "id": "0716-046c3fd3-1cc5-40f6-b0ad-bbc305308f6d"
               },
               {
                     "id": "0717-30ff71ff-3e90-42a9-aa93-96a062081f18"
               }
            ],
           "client_authentication": [
               {
                     "method": "certificate",
                     "client_ca": {
                        "crn": "crn:v1:bluemix:public:cloudcerts:us-south:a/aa5a471f75bc456fac416bf02c4ba6de:1862b0b4-c1f8-4eef-a6b5-e9c00c9f593d:certificate:6c801ef768c139d986b4c6f91175e8cc"
                     }
               },
               {
                     "method": "username",
                     "identity_provider": {
                        "provider_type": "iam"
                     }
               }
            ]
           "resource_group": {
             "id": "'$ResourceGroupId'"
           }
         }'