VPN Gateway:Get started with a Standard VPN Gateway

Resource plan

Cloud resources

On-premises resources

Encryption configuration: The default console settings — AES-128 / SHA-1 / DH Group 2 (modp1024 in strongSwan notation). The encryption algorithm, authentication algorithm, and DH group must be identical on both ends.

Routing: Destination-based routing. The system uses the VPC and IDC CIDR blocks as traffic selectors and automatically routes matching traffic through the VPN tunnel.

1. Configure firewall rules

On the strongSwan server, allow inbound traffic from the two Alibaba Cloud IPsec addresses on:

• ESP protocol (IP protocol number 50)

• UDP port 500

• UDP port 4500

The following uses iptables as an example. Adjust the commands for your firewall tool:

iptables -I INPUT -s XX.XX.1.1,XX.XX.2.2 -p esp -j ACCEPT
iptables -I INPUT -s XX.XX.1.1,XX.XX.2.2 -p udp --dport 500 -j ACCEPT
iptables -I INPUT -s XX.XX.1.1,XX.XX.2.2 -p udp --dport 4500 -j ACCEPT

2. Enable IP forwarding

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
sudo sysctl -p

3. Install strongSwan

dnf install epel-release -y
dnf install strongswan -y

4. Create the strongSwan configuration

1. Back up the original configuration file:

   mv /etc/strongswan/swanctl/swanctl.conf /etc/strongswan/swanctl/swanctl.conf.bak

2. Create a new configuration file:

   vi /etc/strongswan/swanctl/swanctl.conf

3. Add the following configuration. Replace all values marked (Modify) with your actual values:

   # strongSwan dual-tunnel IPsec-VPN configuration for:
   #   - Alibaba Cloud Traditional VPN Gateway
   #   - On-premises single public egress IP
   #   - Destination-based routing (traffic selector)
   #
   # You only need to modify parameters marked with "(Modify)".
   # Algorithm note: aes128-sha1-modp1024 corresponds to AES-128 / SHA-1 / DH Group 2 (console default).
   # High-availability logic: vco1 (priority=1) is the active tunnel, and vco2 (priority=2) is the standby tunnel. Failover is automatic.
   
   connections {
   
      # === Tunnel 1 (Active) ===
      vco1 {
         version = 2
         dpd_delay = 10
         rekey_time = 84600
         over_time = 1800
         proposals = aes128-sha1-modp1024
         encap = yes
   
         local_addrs  = 172.16.0.1                # (Modify) Private IP of the strongSwan NIC. In a NAT environment, use the private IP. If the NIC is bound to the public IP, use the public IP.
         local {
            auth = psk
            id = XX.XX.3.3                        # (Modify) On-premises public egress IP.
         }
   
         remote_addrs = XX.XX.1.1                 # (Modify) Public IP of Tunnel 1 on Alibaba Cloud.
         remote {
            auth = psk
            id = XX.XX.1.1                        # (Modify) Public IP of Tunnel 1 on Alibaba Cloud. Must match remote_addrs.
         }
   
         children {
            vco_child1 {
               local_ts  = 172.16.0.0/16          # (Modify) On-premises traffic selector CIDR block.
               remote_ts = 10.0.0.0/16            # (Modify) Alibaba Cloud traffic selector CIDR block.
               mode = tunnel
               rekey_time = 85500
               life_time = 86400
               dpd_action = restart
               start_action = start
               close_action = start
               esp_proposals = aes128-sha1-modp1024
               priority = 1                       # Specifies the active tunnel. Do not modify.
            }
         }
      }
   
      # === Tunnel 2 (Standby) ===
      vco2 {
         version = 2
         dpd_delay = 10
         rekey_time = 84600
         over_time = 1800
         proposals = aes128-sha1-modp1024
         encap = yes
   
         local_addrs  = 172.16.0.1                # (Modify) Private IP of the strongSwan NIC. Same as Tunnel 1.
         local {
            auth = psk
            id = XX.XX.3.3                        # (Modify) On-premises public egress IP. Same as Tunnel 1.
         }
   
         remote_addrs = XX.XX.2.2                 # (Modify) Public IP of Tunnel 2 on Alibaba Cloud.
         remote {
            auth = psk
            id = XX.XX.2.2                        # (Modify) Public IP of Tunnel 2 on Alibaba Cloud. Must match remote_addrs.
         }
   
         children {
            vco_child2 {
               local_ts  = 172.16.0.0/16          # (Modify) On-premises traffic selector CIDR block. Same as Tunnel 1.
               remote_ts = 10.0.0.0/16            # (Modify) Alibaba Cloud traffic selector CIDR block. Same as Tunnel 1.
               mode = tunnel
               rekey_time = 85500
               life_time = 86400
               dpd_action = restart
               start_action = start
               close_action = start
               esp_proposals = aes128-sha1-modp1024
               priority = 2                       # Specifies the standby tunnel. Do not modify.
            }
         }
      }
   }
   
   secrets {
      ike-vco1 {
         id = XX.XX.1.1                           # (Modify) Public IP of Tunnel 1 on Alibaba Cloud.
         secret = your-psk-here                   # (Modify) Pre-shared key for Tunnel 1. Must match the key configured on Alibaba Cloud.
      }
      ike-vco2 {
         id = XX.XX.2.2                           # (Modify) Public IP of Tunnel 2 on Alibaba Cloud.
         secret = your-psk-here                   # (Modify) Pre-shared key for Tunnel 2. Must match the key configured on Alibaba Cloud.
      }
   }

5. Start strongSwan and verify the tunnel status

sudo systemctl restart strongswan
swanctl --load-all
watch swanctl --list-sas

Both tunnels should show ESTABLISHED status with CHILD_SA status INSTALLED. This confirms the IPsec connection between strongSwan and the Alibaba Cloud VPN Gateway is up.

Basic connectivity

1. Make sure the security group for the ECS instance allows inbound ICMP traffic. Then, from the strongSwan server, ping the ECS instance:

   ping 10.0.0.1

   A successful reply confirms communication from the IDC to the VPC.

2. Make sure your on-premises firewall allows inbound ICMP traffic. Then, log in to the ECS instance (10.0.0.1) and ping the strongSwan device:

   ping 172.16.0.1

   A successful reply confirms reverse connectivity from the VPC to the IDC.

Verify high availability

1. Start a long-running ping from the ECS instance to the on-premises server:

   ping 172.16.0.1 -c 10000

2. Interrupt the active tunnel: in the Alibaba Cloud console, change the pre-shared key of the active tunnel to create a mismatch.

3. Watch the ping output. After a brief interruption, communication resumes — traffic has failed over to the standby tunnel automatically.

4. Restore the active tunnel: change the pre-shared key back to the correct value. Traffic fails back after the tunnel recovers.