How to access a cloud computer using SSL-VPN - Elastic Desktop Service

SSL-VPN is a network connection technology based on the OpenVPN architecture. Once deployed, you can load a certificate into the client to remotely access applications and services in a Virtual Private Cloud (VPC). This topic describes how to use an SSL-VPN connection to connect an on-premises client to the Elastic Desktop Service (EDS) Enterprise office network VPC. This allows the client to access a cloud computer over a private network.

Prerequisites

Before you begin, read the Solutions for connecting to a cloud computer over a private network topic and complete the following prerequisite tasks.

Create a Cloud Enterprise Network (CEN) instance. For more information, see Create a CEN instance.
Create a Virtual Private Cloud (VPC) instance and add it to a Cloud Enterprise Network instance. For more information, see Create a VPC and a vSwitch or Quickly join a Cloud Enterprise Network.
Create an office network and add its VPC to a Cloud Enterprise Network instance. For more information, see Create and manage an office network that uses convenience accounts or Create and manage an office network that uses enterprise AD accounts.
Important
- To prevent the IPv4 CIDR block of a new office network from conflicting with existing CIDR blocks in a Cloud Enterprise Network instance or an on-premises data center (IDC), you must plan the IPv4 CIDR block before you create the office network. For more information, see Plan CIDR blocks.
- If you already have an office network, you need to add it to Cloud Enterprise Network.
- If Active Directory (AD) is deployed on an Elastic Compute Service (ECS) instance, you must add the VPC that contains the AD server to a Cloud Enterprise Network instance. If AD is deployed on a local server, you must establish a connection between your on-premises and cloud networks before you can connect to AD. You can create an AD workspace network first and then complete the AD domain configuration after the network connection is established.
Create a cloud computer and a user account, and then assign the cloud computer to the user account.
- For more information about how to create a user account, see Create a convenience account or Create and manage AD accounts.
- For more information about how to create and assign a cloud computer, see Create a cloud computer and Assign a cloud computer to a user.
Prepare a device to install OpenVPN and the Alibaba Cloud Workspace client. Install both on the same device.
Note
The supported Alibaba Cloud Workspace clients include the Windows client and the macOS client.

Step 1: Configure an SSL-VPN

Configuring an SSL-VPN includes creating a VPN Gateway, creating an SSL server, publishing the client CIDR block to Cloud Enterprise Network (CEN), and creating and downloading an SSL client certificate. The following steps describe this process.

Purchase a VPN Gateway and enable the SSL-VPN feature. For more information, see VPN Gateway instances.

The following table describes the parameters and provides example values.

Parameter	Description	Example
Instance Name	The name of the VPN Gateway instance.	test-vpn
Region	Select the region where you want to create the VPN Gateway instance. Make sure that the VPN Gateway instance and the associated Virtual Private Cloud (VPC) instance are in the same region.	China (Hangzhou)
Network Type	Select the network type of the VPN Gateway instance. Public network: The VPN Gateway establishes VPN connections over the internet. Private network: The VPN Gateway establishes VPN connections over a private network.	Public network
VPC	Select the VPC instance to associate with the VPN Gateway instance.	test-vpc
Specify VSwitch	Specifies whether to specify a VSwitch for the VPN Gateway instance. No: Does not specify a VSwitch for the VPN Gateway instance. After the VPN Gateway is created, it is automatically associated with a random VSwitch in the VPC. Yes: Specifies a VSwitch for the VPN Gateway instance. After the VPN Gateway is created, it is associated with the specified VSwitch.	No
Peak Bandwidth	Select the maximum bandwidth of the VPN Gateway instance. Unit: Mbps.	200 Mbps
Traffic	The billing method of the VPN Gateway instance. Default value: Pay-by-data-transfer.	Pay-by-data-transfer
IPsec-VPN	Specifies whether to enable the IPsec-VPN feature. Default value: Enabled. IPsec-VPN can establish secure connections between a data center and a VPC, or between different VPCs.	Disabled
SSL-VPN	Specifies whether to enable the SSL-VPN feature. Default value: Disabled. SSL-VPN can establish secure connections between sites without the need to configure a customer gateway. For example, SSL-VPN can establish a secure connection between a Linux client and a VPC.	Enabled
Number of SSL Connections	Select the maximum number of clients that can be connected at the same time. Note This parameter is available only after you enable the SSL-VPN feature.	5
Subscription Duration	The billing cycle of the VPN Gateway. Default value: Pay-by-hour.	1 Month
Service-Linked Role	Click Create Service-Linked Role. The system automatically creates the AliyunServiceRoleForVpn service-linked role. The VPN Gateway uses this role to access resources in other Alibaba Cloud services. For more information, see AliyunServiceRoleForVpn. If this parameter is displayed as Created, the role has been created under your account and you do not need to create it again.	/

Create an SSL server. For more information, see Create and manage an SSL server.

The following table describes the parameters and provides example values.

Parameter	Description	Example
Name	The name of the SSL server. The name must be 2 to 128 characters in length. It must start with a letter and can contain digits, hyphens (-), and underscores (_).	test-ssl
VPN Gateway	Select the VPN Gateway to associate. Make sure that the SSL-VPN feature is enabled for the VPN Gateway.	test-vpn
Local Network	The local network is the CIDR block that clients access through the SSL-VPN connection. The local network can be the CIDR block of a Virtual Private Cloud (VPC), a VSwitch, a data center connected to a VPC through an Express Connect circuit, or an Alibaba Cloud service such as Object Storage Service (OSS) or ApsaraDB RDS. Click Add Local Network to add multiple local networks. Note The subnet mask of the local network must be 8 to 32 bits in length.	Includes the following three CIDR blocks: The CIDR block of the office network VPC: 172.16.111.0/24 The CIDR block of the user VPC: 192.168.0.0/16 The CIDR block for DNS in the VPC and the CIDR block where the Alibaba Cloud private OpenAPI endpoint resides. This is fixed to 100.64.0.0/10.
Client CIDR Block	The client CIDR block is a network segment from which IP addresses are allocated to client virtual network interface cards (NICs). It is not the existing private CIDR block of the client. When a client connects to the local network through an SSL-VPN connection, the VPN Gateway assigns an IP address from the specified client CIDR block to the client. When you specify the client CIDR block, make sure that the number of IP addresses in the client CIDR block is at least four times the maximum number of SSL connections supported by the VPN Gateway. Important The subnet mask of the client CIDR block must be 16 to 29 bits in length. Make sure that the client CIDR block and the local network do not overlap. When you specify the client CIDR block, use 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or their subnets. If you must use a public CIDR block, set it as a user CIDR block for the VPC to ensure that the VPC can access the public CIDR block. For more information about user CIDR blocks, see VPC FAQ and VPC FAQ.	10.10.111.0/24
Advanced Configuration	Advanced configurations include protocol and encryption algorithm settings. This example does not use advanced configurations.	No additional parameters are required. Use the default settings.

Publish the client CIDR block that is specified in the SSL server to CEN.
1. In the navigation pane on the left, click Route Tables.
2. On the Route Tables page, find the user VPC for which you want to establish the connection and click the ID of its route table.
3. On the Route Entry List tab, click the Custom Route Entry tab.
4. Find the client CIDR block that is specified in the SSL server and click Publish.
  If the value in the Status in CEN column for the client CIDR block is Published, the publishing is successful.
Create an SSL client certificate. For more information, see Create and manage SSL client certificates.
On the SSL Clients page, find the target SSL client certificate, and in the Actions column, click Download.
After you download the SSL client certificate to your computer, store it in a secure location. You will need this certificate when you configure the client.

Step 2: Install and connect to OpenVPN on your local computer

Install OpenVPN on your local computer.
Windows
1. Click Download OpenVPN.
2. Install OpenVPN.
3. Extract and copy the SSL client certificate to the OpenVPN\config directory.
  Important
  Copy the certificate to the directory that matches your OpenVPN installation path. For example, if you installed OpenVPN to the C:\Program Files\OpenVPN directory, extract and copy the certificate to the C:\Program Files\OpenVPN\config directory.
Mac
1. Run the following command to install OpenVPN.
  brew install openvpn
  If you do not have Homebrew installed, install it first.
2. Extract and copy the SSL client certificate to the configuration directory.
Start OpenVPN on your local computer and start a connection.
Windows
Open OpenVPN and start a connection.
Mac
Run the following command to start a connection:
```
sudo /usr/local/opt/openvpn/sbin/openvpn --config /usr/local/etc/openvpn/config.ovpn
```

Step 3: Configure an enterprise private network address or a cloud service route

You can use one of the following solutions. Solutions 1 and 2 describe how to configure an enterprise network address. Solution 1 uses a fixed address and is simpler for end users because they do not need to configure a custom address.

Solution 1: Configure a fixed enterprise network address

Obtain the private gateway address of the office network.
1. Log on to the Elastic Desktop Service Enterprise console.
2. In the left-side navigation pane, choose Networks & Storage > Office Networks.
3. On the Office Networks page, click the ID of the target office network.
4. In the Network Information section of the office network details page, copy the Private Gateway Address. You will use this address in a later step.
Configure a CNAME record on your enterprise DNS service to point private.wuying.com to the private network gateway address of your office network.
End users configure the network connection on their WUYING Terminals.
1. Open the Windows client.
2. In the upper-right corner of the logon page, click the icon and select Network Access Configuration.
3. In the Network Access Configuration dialog box, complete the following configurations:
  Important
  Make sure that the Windows client that you use is V7.7 or later. Otherwise, you cannot configure the enterprise private network address.
  - Connection Type: Select Enterprise Network.
  - Enterprise Network Address: Select Fixed Address.
4. Click OK.

Solution 2: Configure a custom enterprise network address

Obtain the private gateway address of the office network and provide it to your end users.
1. Log on to the Elastic Desktop Service Enterprise console.
2. In the left-side navigation pane, choose Networks & Storage > Office Networks.
3. On the Office Networks page, click the ID of the target office network.
4. In the Network Information section of the office network details page, copy the Private Gateway Address. You will use this address in a later step.
End users configure the network connection on their WUYING Terminals.
1. Open the Windows client.
2. In the upper-right corner of the logon page, click the icon and select Network Access Configuration.
3. In the Network Access Configuration dialog box, complete the following configurations:
  Important
  Make sure that you use Windows client V7.7 or later. Otherwise, you cannot configure an enterprise private network address.
  - Connection Type: Select Enterprise Network.
  - Enterprise Network Address: Select Custom Address.
  - Custom Address: Enter the private gateway address of the office network that is provided by the administrator.
4. Click OK.

Method 3: Configure a cloud service route and DNS

Configure a cloud service route.
The CIDR block for private cloud services on Alibaba Cloud is 100.64.0.0/10. This is a reserved CIDR block as specified in RFC 6598. The Alibaba Cloud Workspace client needs to call service APIs for Elastic Desktop Service (EDS). To enable this, add the 100.64.0.0/10 CIDR block as a local address in your VPN. This ensures that requests to this CIDR block are forwarded to your VPC on the cloud.
Note
- If your 100.x.x.x network segment has a conflict, use Method 1 or Method 2.
- If you use cloud computers in multiple regions, you can set the large 100.64.0.0/10 CIDR block as the CIDR block for cloud services. If you need a more granular network, see Cloud computer service port requirements to set the cloud service CIDR block. The IP address that corresponds to the domain name of the private management service is the cloud service IP address.
(Optional) Before you configure DNS, run the following command to test if the domain name can be resolved.
```
nslookup ecd-vpc.cn-hangzhou.aliyuncs.com
```
If an IP address is returned, the domain name is resolved correctly and you can skip Step 3. If no IP address is returned, you must configure DNS as described in the next step.
Configure DNS on your local computer.
1. Add 100.100.2.136 or 100.100.2.138 to the DNS server list.
  The following steps show how to configure DNS on a Windows 10 operating system:
  1. From the Start menu, search for and open Control Panel.
  2. In the Control Panel window, click Network and Internet, and then click Network and Sharing Center.
  3. In the navigation pane on the left, click Change adapter settings.
  4. Right-click the network adapter for OpenVPN and choose Properties.
  5. In the dialog box that appears, in the This connection uses the following items section, double-click Internet Protocol Version 4 (TCP/IPv4).
  6. In the panel that appears, enter the specified DNS server addresses.
    Set the Preferred DNS server to 100.100.2.136 and the Alternate DNS server to 100.100.2.138.
2. Run the following command to verify that DNS works correctly.
```
nslookup ecd-vpc.cn-hangzhou.aliyuncs.com
```

Step 4: Verify the private network connection to your cloud computer

Note

The following example demonstrates how to connect to a cloud computer using the Windows client V7.7 to verify that you can access the cloud computer over a private network. The steps may vary depending on the client that you use.

Open the Windows client.
In the upper-right corner of the logon page, click the icon and select Network Access Configuration.
In the Network Access Configuration dialog box, set Connection Type to Enterprise Network.
On the logon page, enter the logon credentials that you received in the cloud computer allocation notification email (including your workspace ID or organization ID, username, and password), and click the next icon.
On the cloud resource list page of the client, find your cloud computer, and then turn it on and connect to it.
Note
If a network request timeout error occurs, the network connection failed. Check your configuration. After you confirm that the configuration is correct, log on to the client again and connect to the cloud computer.