Creating a Site-to-Site VPN with Public IPv4 Encryption Domain Using AWS Bring Your Own IP Address (BYOIP) feature

Organizations often need to establish secure connectivity between their on-premises networks and AWS using public IPv4 addresses within their encryption domains (IP address ranges that will be included in the encrypted VPN tunnel). Traditional AWS Site-to-Site VPN configurations typically use private CIDR ranges (like those specified in RFC 1918). Although AWS allows assigning any public IPv4 CIDR range to a VPC, several challenges arise when using a Site-to-Site VPN to connect to it from on-premises.

1. Routing Conflicts:
   • Public IPv4 ranges are globally routable on the internet.
   • Using public IPv4 ranges within your VPC can cause routing conflicts both within AWS and on the broader internet.
   • Your on-premises network may experience difficulties routing traffic correctly to these public IPv4 addresses via the VPN.
2. IP Address Ownership:
   • While AWS typically doesn't restrict the use of public IPv4 ranges that you don't own as VPC CIDRs, using such addresses can lead to reachability issues and potential legal complications.
3. VPN Configuration:
   • Many VPN devices and configurations are designed to connect private networks.
   • Using public IPv4 addresses on both sides of a VPN can create configuration complexities.

Due to these challenges, it's generally recommended to use private IPv4 ranges for VPCs and internal networks. For organizations that cannot use private IPv4 ranges within their IPsec VPN encryption domains, AWS Bring Your Own IP Address (BYOIP) to Amazon EC2 feature provides a solution. This feature allows organizations to use their own public IPv4 ranges within AWS infrastructure, thereby addressing the above challenges.

Solution

By leveraging EC2 BYOIP feature, organizations can bring their public IPv4 address ranges into AWS and use them within their VPC infrastructure while maintaining secure connectivity through a Site-to-Site VPN. Figure 1 illustrates a hybrid network architecture that connects an on-premises data center to AWS using public IPv4 ranges. It showcases how AWS's BYOIP feature enables the use of public IPv4 addresses within a VPC, while offering multiple connectivity options (Virtual Private Gateway, AWS Transit Gateway, or AWS Cloud WAN) to establish a secure Site-to-Site VPN connection between the AWS cloud and on-premises environments. This setup demonstrates a unique approach to maintaining seamless communication between public IPv4 ranges across hybrid cloud infrastructures.

Figure 1: AWS Site-to-Site VPN with public IPv4 Encryption Domains

Here's a high-level implementation approach:

1. EC2 BYOIP Implementation
   1. Obtain ROA (Route Origin Authorization) for your public IPv4 range
   2. Provision the IPv4 address range for use in AWS using AWS CLI or using AWS Console through Amazon VPC IP Address Manager
   3. Advertise the address pool in your selected AWS region

For detailed instructions, refer to the Bring your own IP addresses (BYOIP) to Amazon EC2 and the Bring your IP addresses to IPAM documentations.

2. VPC Configuration
   1. Create a VPC with the desired CIDR range from your imported BYOIP range
   2. Create subnets for your workloads
   3. Allocate private and elastic IP addresses (if needed) from your BYOIP pool to use in the VPC
   4. Configure route tables and Internet Gateway

For detailed instructions, refer to the Create a VPC documentation.

3. Customer Gateway Configuration
   1. Set up your on-premises VPN device
   2. Create a Customer Gateway in AWS
   3. Configure using your on-premises public IPv4 address for Site-to-Site VPN tunnel termination

For detailed steps, refer to the Step 1: Create a customer gateway documentation.

4. Target Gateway Setup in AWS
   1. Create a Virtual Private Gateway, Transit Gateway or a Cloud WAN Core Network based on your needs
   2. Attach/associate your VPC to the chosen gateway
   3. Configure routing to enable traffic flow between VPC and on-premises networks

For detailed instructions, refer to the Create a target gateway documentation.

5. Site-to-Site VPN Connection
   1. Create the VPN connection
   2. Configure the encryption domain to include your BYOIP range
   3. Download and apply the VPN configuration to your on-premises Customer Gateway device
   4. Establish the VPN tunnels

For detailed instructions, refer to the Step 5: Create a VPN connection and Create an AWS Site-to-Site VPN attachment for AWS Cloud WAN documentation.

Considerations

When setting up and managing your VPN connection, it’s important to account for factors beyond basic connectivity. The following considerations covering security, routing, cost, and performance will help ensure a reliable, secure, and efficient deployment.

Security

• Ensure proper security group and NACL configurations are in place
• Implement strong encryption and authentication methods
• Regularly rotate certificates when using certificate-based authentication
• Monitor VPN connection status and metrics through CloudWatch

Routing

• Carefully plan route table entries
• Avoid routing conflicts between public and private ranges
• Consider dynamic routing using BGP, if supported on the Customer Gateway device
• Implement proper failover mechanisms

Cost

• There is no charge for bringing your own IP addresses to AWS and using them as VPC CIDR ranges or as Elastic IP addresses
• VPN connection charges apply and data transfer costs across the VPN should be considered. Refer to AWS VPN Pricing documentation for details

Performance

• Monitor bandwidth utilization using CloudWatch metrics
• Consider implementing VPN acceleration if needed
• Plan for high availability with multiple tunnels. Use BGP to handle the failover vs using static routes

Conclusion

Implementing a Site-to-Site VPN with public IPv4 CIDR ranges as encryption domain using AWS BYOIP provides a robust solution for organizations requiring secure connectivity with public IPv4 address ranges. While the setup requires careful planning and consideration of various factors, the resulting configuration offers:

1. Secure communication between on-premises and AWS resources
2. Flexibility in IP address management
3. Control over routing and traffic flow
4. Compliance with security requirements

For more information, refer to the following documentation:

• Bring your own IP addresses (BYOIP) to Amazon EC2
• Bring your IP addresses to IPAM
• What is AWS Site-to-Site VPN?

About the author

Mandar is a Senior Networking Solutions Architect at AWS. He is passionate about networking technologies and loves to innovate and help solve complex customer problems. He holds a master’s degree in Telecommunications from University of Colorado Boulder. Mandar lives in Seattle and loves travel and outdoor activities.