All Products
Search

This Product

    VPN Gateway:Establish an SSL-VPN connection with IDaaS authentication

    Document Center

    VPN Gateway:Establish an SSL-VPN connection with IDaaS authentication

    Last Updated:Sep 24, 2026

    SSL-VPN two-factor authentication requires clients to pass two separate forms of authentication before establishing a connection: the default SSL client certificate authentication and an IDaaS (Identity as a Service) username and password authentication. An SSL-VPN connection to the VPC is allowed only after both authentications succeed. This dual-authentication mechanism enhances security by preventing identity theft and unauthorized access, thereby protecting sensitive data within your VPC from external threats. This topic describes how to use the SSL-VPN two-factor authentication feature to allow clients to securely access resources in a VPC.

    Example scenario

    image

    This topic uses the scenario in the preceding diagram as an example. A company uses Alibaba Cloud IDaaS to manage and maintain employee accounts and permissions. The company has a VPC instance in the China (Hangzhou) region and has deployed applications on Elastic Compute Service (ECS) instances in the VPC. The company wants employees on business trips to access VPC resources at any time, while ensuring that employee identities are authenticated.

    The company can use the SSL-VPN feature of VPN Gateway and enable two-factor authentication for SSL-VPN. After passing both SSL client certificate authentication and IDaaS username and password authentication, a client can establish an SSL-VPN connection to the VPC and securely access resources within it.

    Prerequisites

    • You have created an Enterprise Edition IDaaS EIAM instance. For more information, see Manage instances.

      Important

    • You have created an organization and accounts in the EIAM instance.

      This topic describes how to manually create an organization and accounts in the EIAM instance. An example of the organization and account is provided. If you want to automatically synchronize account information to the EIAM instance over the LDAP protocol so that employees can log on to applications by using AD/LDAP authentication, see Establish an SSL-VPN connection between a client and a VPC with AD authentication. For more information about account synchronization methods, see Create an account or organization. For example, on the Account Management page of the IDaaS instance, the SSL-VPN organization in the organization tree contains an account named Lisi with a Normal status.

    • You have created a VPC in the China (Hangzhou) region and deployed applications on ECS instances in the VPC. For more information, see Create a VPC with an IPv4 CIDR block.

      Ensure the security group rules for the ECS instances in the VPC allow clients to access the cloud resources. For more information, see Query security group rules and Add a security group rule.

    • Make sure that the client can access the internet and the private CIDR block of the client does not overlap with the private CIDR block of the VPC.

    Procedure

    image

    Step 1: Add an Alibaba Cloud SSL-VPN application

    1. Log on to the IDaaS console.

    2. On the EIAM page, find the EIAM instance that you created in the Prerequisites section and click Console in the Actions column.

    3. In the left-side navigation pane of the EIAM instance, choose Application. On the Application page, click Add Application.

    4. On the Add Application page, find the Alibaba Cloud - SSL VPN template and click Add Application.

    5. In the Add Application dialog box, enter a custom name for the application and click Add Now.

    6. On the Sign-In tab of the application details page, configure the following parameters and click Save at the bottom of the tab.

      SSO: Keep this enabled.

      Grant Types: The default value is Password Grant. For IdP, select the default value IDaaS Account. The system uses the accounts that you manually created in the EIAM instance to authenticate employees.

      Authorize: Use the default value Manually. In this mode, you must manually grant access to specific accounts so that they can access the application. For more information, see Authorization scope.

    7. On the Sign-In tab, click the Application Authorization tab.

      Grant authorization to the employee accounts that need to establish SSL-VPN connections. For more information, see Application authorization.

    Step 2: Create a VPN Gateway instance

    1. Log on to the VPN gateway console.

    2. On the VPN Gateways page, click Create VPN Gateway.

    3. On the VPN Gateway page, configure the VPN gateway as described below, click Buy Now, and complete the payment.

      The following table describes only the parameters that are relevant to this topic. Keep the default values for other parameters. For more information, see Create and manage a VPN Gateway instance.

      Parameter

      Description

      Region

      Select the region where you want to create the VPN Gateway instance. In this example, China (Hangzhou) is selected.

      Note

      Make sure that the VPC and the VPN Gateway instance are in the same region.

      gateway type

      Select the type of VPN gateway that you want to create. In this example, Standard is selected.

      Network Type

      Select the network type of the VPN Gateway instance. In this example, Public is selected.

      tunnel

      The system displays the tunnel modes for IPsec-VPN connections that are supported in the current region.

      VPC

      Select the VPC that you want to connect.

      vSwitch 1

      Select a vSwitch from the VPC.

      • If you select Single-tunnel, you need to specify only one vSwitch.

      • If you select Dual-tunnel, you need to specify two vSwitches.

        After the IPsec-VPN feature is enabled, the system creates an elastic network interface (ENI) for each of the two vSwitches as an interface to communicate with the VPC over an IPsec-VPN connection. Each ENI occupies one IP address in the vSwitch.

      Note

      • The system selects a vSwitch by default. You can change or use the default vSwitch.

      • After a VPN gateway is created, you cannot modify the vSwitch associated with the VPN gateway. You can view the vSwitch associated with the VPN gateway, the zone to which the vSwitch belongs, and the ENI in the vSwitch on the details page of the VPN gateway.

      vSwitch 2

      Select the second vSwitch from the VPC.

      • Specify two vSwitches in different zones in the associated VPC to implement disaster recovery across zones for IPsec-VPN connections.

      • For a region that supports only one zone, disaster recovery across zones is not supported. We recommend that you specify two vSwitches in the zone to implement high availability of IPsec-VPN connections. You can also select the same vSwitch as the first one.

      Note

      If the VPC does not have a second vSwitch, you can create one. For more information, see Create and manage a vSwitch.

      IPsec-VPN

      Specifies whether to enable the IPsec-VPN feature. In this example, select Disable.

      SSL-VPN

      Specifies whether to enable the SSL-VPN feature. In this example, select Enable.

      SSL connections

      Select the maximum number of clients that can connect at the same time.

      Note

      You can configure SSL Connections only after you enable the SSL-VPN feature.

    4. Return to the VPN Gateways page to view the VPN Gateway instance.

      A new VPN Gateway instance is in the Preparing state. After 1 to 5 minutes, the state changes to Normal. The Normal state indicates that the VPN Gateway instance is initialized.

    Step 3: Create an SSL server

    1. In the left navigation pane, choose Interconnections > VPN > SSL Servers.

    2. In the top navigation bar, select the region for the SSL server.

      Note

      Make sure that the SSL server and the VPN Gateway instance are in the same region.

    3. On the SSL Server page, click Create SSL Server.

    4. In the Create SSL Server panel, configure the SSL server as described in the following table, and click OK.

      The following table describes only the parameters that are relevant to this topic. Keep the default values for other parameters. For more information, see Create and manage an SSL server.

      Parameter

      Description

      VPN Gateways

      Select the VPN Gateway instance that you created.

      Local Network

      Enter the CIDR block of the VPC that you want to access. In this example, 192.168.0.0/16 is used.

      Client CIDR Block

      Enter the CIDR block that is used by the client to access the VPC. In this example, 10.0.0.0/24 is used.

      Important

      • The subnet mask of the client CIDR block must be 16 to 29 bits in length.

      • The client CIDR block must not overlap with the Local Network, the VPC CIDR block, or any CIDR blocks routed on the client.

      • Use private CIDR blocks such as 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, or their subnets. To use a public IP range, configure it as a user-defined CIDR block in the VPC for proper routing. VPC FAQ and VPC FAQ.

      • After you create the SSL server, the system adds a route for the client CIDR block to the VPC route table. Do not manually add this route, as it may disrupt SSL-VPN traffic. If a vSwitch is associated with a custom route table, the system does not automatically add the route for the client CIDR block to that custom route table. You must manually add a route entry whose destination CIDR block is the client CIDR block and whose next hop is the VPN gateway. Otherwise, hosts in the CIDR blocks associated with the custom route table cannot communicate with SSL-VPN clients.

      Advanced Settings

      Enable two-factor authentication. This topic uses EIAM 2.0. Keep the default values for the other settings.

      • IDaaS Instance Region: Select China (Hangzhou).

      • IDaaS Instance: Select the EIAM instance that you created in the prerequisites.

      • IDaaS Application: Select the Alibaba Cloud SSL-VPN application that you added.

        Note

        When creating an SSL server in the UAE (Dubai) region, bind an IDaaS EIAM 2.0 instance in the Singapore region to reduce cross-region latency.

    Step 4: Create an SSL client certificate

    1. In the navigation pane on the left, choose Interconnections > VPN > SSL Clients.

    2. On the SSL Client page, click Create SSL Client.

    3. In the Create SSL Client panel, enter a name for the SSL client certificate, select the corresponding SSL Server, and then click OK.

    4. On the SSL Client page, find the SSL client certificate that you created and click Download Certificate in the Actions column.

      Save the downloaded SSL client certificate. You will need it to configure the client.

    Step 5: Configure the client

    Linux client

    1. Open a command-line window.

    2. Run the following commands to install the OpenVPN client. 

      # On CentOS, run the following commands:
yum install -y openvpn
# Check whether the /etc/openvpn/conf/ directory exists. If not, create it.
cd /etc/openvpn # Enter the openvpn directory.
ls              # Check whether the conf directory exists.
mkdir -p /etc/openvpn/conf # If the conf directory does not exist, create it.

# On Ubuntu, run the following commands:
apt-get update
apt-get install -y openvpn
# Check whether the /etc/openvpn/conf/ directory exists. If not, create it.
cd /etc/openvpn # Enter the openvpn directory.
ls              # Check whether the conf directory exists.
mkdir -p /etc/openvpn/conf # If the conf directory does not exist, create it.

    3. Extract the downloaded SSL client certificate and copy the files to the /etc/openvpn/conf/ directory.

    4. Go to the /etc/openvpn/conf/ directory, run the following command, and then enter the username and password. After IDaaS authenticates the client, an SSL-VPN connection is established. 

      openvpn --config /etc/openvpn/conf/config.ovpn --daemon
      [root@iZuxxx raihcZ conf]# openvpn --config /etc/openvpn/conf/config.ovpn --daemon
Enter Auth Username: Lisi
Enter Auth Password: *********
[root@iZuf6fxxxxxxxxxihcZ conf]# ps aux | grep openvpn
root      10592  0.0  0.1  14532  5640 ?        Ss   14:46   0:00 openvpn --config /etc/openvpn/conf/config.ovpn --daemon
root      10594  0.0  0.0 221528   828 pts/1    S+   14:46   0:00 grep --color=auto openvpn
[root@iZufxxx ihcZ conf]#

    Windows client

    1. Download the OpenVPN client that is compatible with your Windows system version, and complete the installation as prompted by the interface:

    2. Decompress the downloaded SSL client certificate and copy the extracted all files to the OpenVPN configuration directory.

      • Default path: C:\Program Files\OpenVPN\config

      • Note: If you have modified the installation path, copy them to the config folder in your actual installation directory.

      image

    3. Open the config.ovpn file with Notepad and add one line at the end: disable-dco.

      The Data Channel Offload (DCO) feature introduced in OpenVPN 2.6 has compatibility issues on some Windows systems (such as specific versions of Windows 10/11). This configuration is used to disable DCO to resolve the issue of some devices being unable to connect.

      image

    4. Start the OpenVPN client, click Connect, and then enter your username and password. After IDaaS authenticates the client, the SSL-VPN connection is established.

    macOS client (OpenVPN)

    1. Open a command-line window.

    2. If Homebrew is not installed, run the following command to install it.

      /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

    3. Run the following command to install the OpenVPN client. 

      brew install openvpn

    4. Extract the downloaded SSL client certificate and copy the files to the configuration directory.

      1. Back up all configuration files in the /usr/local/etc/openvpn folder.

        Important

        The default installation path for OpenVPN may vary based on the macOS version. Make sure to use the actual installation path in the following steps.

      2. Run the following command to delete the OpenVPN configuration files.

        rm /usr/local/etc/openvpn/*

      3. Run the following command to copy the downloaded SSL client certificate to the configuration directory.

        cp cert_location /usr/local/etc/openvpn/

        cert_location is the path to the downloaded SSL client certificate. Example: /Users/example/Downloads/certs6.zip.

    5. Run the following command to extract the certificate.

      cd  /usr/local/etc/openvpn/
unzip /usr/local/etc/openvpn/certs6.zip

    6. Go to the /usr/local/etc/openvpn/ directory, run the following command, and then enter the username and password to establish an SSL-VPN connection.

      sudo /usr/local/opt/openvpn/sbin/openvpn --config /usr/local/etc/openvpn/config.ovpn

    Step 6: Test connectivity

    The following procedure shows how to test the connectivity between a Linux client and the VPC.

    1. Open the command-line window on the client.

    2. Run the ping command to access the ECS1 instance in the VPC and verify the connectivity.

      ping <IP address of the ECS1 instance>

      If you receive reply packets like those shown below, the client is successfully connected to the VPC.

      [root@iZuf6         ihcZ conf]# ping 192.168.10.154
PING 192.168.10.154 (192.168.10.154) 56(84) bytes of data.
64 bytes from 192.168.10.154: icmp_seq=1 ttl=63 time=11.9 ms
64 bytes from 192.168.10.154: icmp_seq=2 ttl=63 time=11.7 ms
64 bytes from 192.168.10.154: icmp_seq=3 ttl=63 time=11.7 ms
64 bytes from 192.168.10.154: icmp_seq=4 ttl=63 time=11.8 ms
64 bytes from 192.168.10.154: icmp_seq=5 ttl=63 time=11.5 ms
^Z
[8]+  Stopped                 ping 192.168.10.154
[root@iZuf6hgotc     :Z conf]#

    FAQ

    IDaaS EIAM 1.0 configuration

    If you are using an IDaaS EIAM 1.0 instance, skip the Add an Alibaba Cloud SSL-VPN application step. When you create the SSL server, directly associate the EIAM 1.0 instance. The other steps are the same. On the Create SSL Server page, expand advanced configuration, set Protocol to TCP (Recommended), set Port to 1194, set Encryption Algorithm to AES-128-CBC, set Compression to No, and enable two-factor authentication. For IDaaS instance version, select EIAM 1.0 (Legacy). If the current VPN version does not support EIAM 2.0, you must upgrade to the latest version first. Then, select the Region of IDaaS instance and the corresponding IDaaS instance.

    Support for OTP secondary authentication

    No.

    IDaaS supports only username and password authentication. Secondary authentication methods for clients, such as one-time passwords (OTPs) or SMS authentication, are not supported.