Step 12: Configuring Your Router
This step covers configuring your local router to establish the VPN tunnel with AWS. Router configuration varies by manufacturer, so this guide provides general instructions.
Before You Begin
Gather the following information from your downloaded VPN configuration file:
- AWS Virtual Private Gateway outside IP address
- Pre-shared key
- Your local network subnet (e.g., 192.168.1.0/24)
- AWS VPC subnet (10.0.0.0/16)
- IKE and IPSec parameters
General Router Configuration Steps
1. Access your router's administration interface
- Open a web browser on a computer connected to your local network.
- Enter your router's IP address (commonly 192.168.1.1 or 192.168.0.1).
- Log in with your administrator credentials.
2. Navigate to VPN settings
Look for sections labeled:
- VPN
- IPSec
- Site-to-Site VPN
- Gateway-to-Gateway VPN
3. Create a new VPN tunnel
Enter the following settings (field names vary by router):
| Setting | Value |
|---|---|
| Remote Gateway IP | AWS Virtual Private Gateway outside IP |
| Pre-shared Key | Key from configuration file |
| Local Network | Your LAN subnet (e.g., 192.168.1.0/24) |
| Remote Network | AWS VPC subnet (10.0.0.0/16) |
4. Configure IKE (Phase 1) settings
| Setting | Value |
|---|---|
| Exchange Mode | Main |
| Encryption | AES-256 |
| Authentication | SHA256 |
| DH Group | Group 14 (2048-bit) or higher |
| Lifetime | 28800 seconds |
5. Configure IPSec (Phase 2) settings
| Setting | Value |
|---|---|
| Protocol | ESP |
| Encryption | AES-256 |
| Authentication | SHA256 |
| PFS Group | Group 14 (2048-bit) or higher |
| Lifetime | 3600 seconds |
6. Configure dead peer detection (DPD)
If your router supports Dead Peer Detection:
| Setting | Value |
|---|---|
| DPD | Enabled |
| DPD Interval | 10 seconds |
| DPD Timeout | 30 seconds |
7. Save and apply settings
- Save your VPN configuration.
- Enable or activate the VPN tunnel.
- Check the tunnel status in your router's VPN status page.
Troubleshooting Common Issues
| Issue | Possible Cause | Solution |
|---|---|---|
| Tunnel won't connect | Wrong pre-shared key | Verify key matches exactly |
| Phase 1 fails | Mismatched IKE settings | Verify encryption and auth match |
| Phase 2 fails | Mismatched IPSec settings | Verify protocol settings match |
| Tunnel connects but no traffic | Missing routes | Add route to 10.0.0.0/16 via tunnel |
Router-Specific Documentation
For detailed instructions, consult your router manufacturer's documentation:
- Cisco: Search for "Site-to-Site VPN configuration"
- Netgear: Search for "IPSec VPN setup"
- Ubiquiti: Search for "Site-to-Site VPN UniFi"
- pfSense: Search for "IPSec VPN AWS"