Connect an iPhone or iPad to a VPC using SSL-VPN - VPN Gateway

Scenario

This topic describes how to create a VPN Gateway instance and an IPsec server. You can then use the native VPN client on an iPhone or iPad to securely access an Elastic Compute Service (ECS) instance in a VPC by using its private IP address.

This scenario uses the following resources:

VPC
- Name: vpc-demo
- Region: China (Hangzhou)
- CIDR block: 10.0.0.0/16
- vSwitches: Two vSwitches are created and named vsw1 and vsw2.
  - vsw1 is in Zone J and its CIDR block is 10.0.0.0/24.
  - vsw2 is in Zone K and its CIDR block is 10.0.1.0/24.
- ECS instance: The private IP address is 10.0.0.1 and the operating system is Alibaba Cloud Linux 3.2104 LTS 64-bit.
Local network of the iPhone or iPad: 172.16.0.0/16

Important

This scenario requires a region that supports the IPsec server feature. This feature is available only in the following regions: China (Hangzhou), China (Shanghai), China (Nanjing), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Chengdu), China (Hong Kong), Japan (Tokyo), South Korea (Seoul), Singapore, Malaysia (Kuala Lumpur), Indonesia (Jakarta), Philippines (Manila), Thailand (Bangkok), Germany (Frankfurt), UK (London), US (Virginia), US (Silicon Valley), UAE (Dubai), Mexico (Mexico City), Saudi Arabia (Riyadh),.
If your VPC is in a region that does not support the IPsec server feature, you cannot use the method described in this topic, which relies on the native VPN feature of iPhones and iPads. In this case, consider one of the following solutions:
- Method 1: Create a VPC and a VPN Gateway instance in a supported region, and then connect this VPC to the VPC that you want to manage. For more information, see Access resources across VPCs from a client.
- Method 2: Migrate your services to a VPC in a supported region.

Step 1: Create a VPN Gateway instance

A VPN Gateway instance is the entry point and exit point for SSL-VPN connections in the cloud.

If you want to use an existing VPN Gateway instance for this scenario, make sure that it meets the following requirements:
1. No IPsec-VPN connections are configured on the VPN Gateway instance. If IPsec-VPN connections are already configured, you must create a new VPN Gateway instance.
2. The SSL-VPN feature must be enabled.
3. The VPN Gateway instance must be upgraded to the latest version.
If you have not created a VPN Gateway instance, perform the following steps:
1. Go to the VPN Gateway page and click Create VPN Gateway.
2. On the VPN Gateway page, configure the following parameters:
  - Instance Name: vpn-demo
  - Region: China (Hangzhou).
  - VPC: Select the VPC that you want the client to access.
  - vSwitch 1/vSwitch 2: Select vsw1 and vsw2 respectively.
    
    VPN Gateway instances use a dual-active architecture. To ensure cross-zone high availability in a region that supports multiple zones, your VPC must have at least two vSwitches in different zones. If this requirement is not met, create a vSwitch first.
  - Maximum Bandwidth: 10 Mbps
  - IPsec-VPN: Disabled (This option is available only after you enable SSL-VPN below.)
  - SSL-VPN: Enable.
  - SSL-VPN Connections: 5.
  - Service-linked Role: If a service-linked role does not exist, click Create Service-linked Role.
  For detailed parameter descriptions, see Create and manage a VPN Gateway instance.
3. After completing the purchase, the VPN Gateway instance appears on the VPN Gateway page.
  
  A newly created VPN Gateway instance is in the Preparing state. The state changes to Normal in about 1 to 5 minutes. The instance is then ready for use.

Step 2: Create an IPsec server

An IPsec server defines connection policies for clients, including the authentication method, the accessible cloud network, and the client address pool.

Go to the IPsec-VPN Server page. In the top navigation bar, select China (Hangzhou). Then, click Create IPsec-VPN Server.

On the Create IPsec-VPN Server page, configure the following parameters:

Name: Enter server-demo.
VPN Gateway: Select the VPN Gateway instance that you created.
Local Network: Enter 10.0.0.0/16.

This parameter specifies the CIDR block of the cloud network that the client will access. Typically, this is the CIDR block of your VPC.
Client CIDR Block: This is the address pool from which the VPN Gateway instance assigns IP addresses to clients. The client CIDR block cannot overlap with the Local Network or the CIDR block of the network where the client resides, such as the local network of the client. We recommend that you use a less common private CIDR block from RFC 1918, such as 10.222.222.0/24.
Pre-Shared Key: This key is used for authentication between the IPsec server and the client. A key is randomly generated by default. You can also manually specify a key, but you must ensure that it is strong. For example, the key must be at least 16 characters in length and contain uppercase and lowercase letters, digits, and special characters. Securely store and regularly rotate this key.
Effective Immediately: Select Yes.

Yes: Negotiation starts immediately after the configuration is complete. No: Negotiation starts only when traffic is initiated.

Leave other parameters in their default state. For more information about these parameters, see Create and manage an IPsec server.

After the IPsec server is created, go to the IPsec-VPN Server page and record the IP Address. You will need this IP address when you configure the client on your iPhone or iPad.

Step 3: Configure your iPhone or iPad

In this step, you add an IKEv2 VPN configuration on your iPhone or iPad to connect to the IPsec server that you created.

The following steps use an iPhone that runs iOS as an example:

Go to , and then tap Add VPN Configuration....
- Type: Keep the default value IKEv2.
- Description: Enter demo.
- Server: Enter the IP Address of the IPsec-VPN Server that you recorded in Step 2.
- Remote ID: Enter the same IP Address of the IPsec-VPN Server from Step 2.
- Local ID: Leave this parameter empty.
- User Authentication: Select None.
- Use Certificate: Turn off this switch.
- Secret: Enter the Pre-Shared Key that you set when you created the IPsec-VPN Server. To obtain the key, find the IPsec-VPN Server that you just created and click Edit in the Actions column.
- Proxy: Turn off this switch.
After you complete the configuration, tap Done in the upper-right corner.
On the VPN page, select the VPN configuration that you created and turn on the Status switch. A Connected status indicates that the connection is established.

Step 4: Test the connection

Log on to the ECS instance and install the Nginx service.

# Run the following commands on the ECS instance. Alibaba Cloud Linux 3 is used as an example.
yum install -y nginx
systemctl start nginx.service

In the security group that is associated with the ECS instance, add an inbound rule to allow traffic from the Client CIDR Block (10.222.222.0/24) to access the ECS instance on TCP port 80.
On your iPhone or iPad, open the Safari browser and enter the private IP address of the ECS instance: 10.0.0.1. If the Nginx welcome page appears, you have successfully accessed the ECS instance.

The Nginx welcome page confirms that the web server is installed and working correctly.