DocsICP FilingConsole
官方文档
首页

Connect PC and Android clients to a VPC with SSL-VPN

更新时间：
复制 MD 格式
产品详情
我的收藏

You can use an SSL-VPN connection to securely connect your clients (Windows, Linux, Android, or macOS) to your VPC and access cloud resources over the internet.

For iOS and iPadOS clients, see Connect an iPhone or iPad to a VPC by using an SSL-VPN connection.

Scenario

Goal: Create an SSL-VPN-enabled VPN Gateway that allows a local client to securely access an ECS instance in a VPC using its private IP address.

image

The following resources are planned for this tutorial:

  • VPC

    • Name: vpc-demo

    • Region: China (Hangzhou)

    • CIDR block: 10.0.0.0/16

    • vSwitches: Create two vSwitches named vsw1 and vsw2.

      • vsw1 is in zone J with the CIDR block 10.0.0.0/24.

      • vsw2 is in zone K with the CIDR block 10.0.1.0/24.

    • ECS: The IP address is 10.0.0.1, and the operating system is Alibaba Cloud Linux 3.2104 LTS 64-bit.

  • Client's on-premises network: 172.16.0.0/16

Step 1: Configure cloud VPN resources

Before you connect a client to the VPC, you must create and configure a VPN Gateway, an ssl server, and an ssl client in the Alibaba Cloud console.

1. Create a VPN Gateway

A VPN Gateway is the entry and exit point in the cloud for SSL-VPN connections.

  1. Go to the VPN Gateway page and click Create VPN Gateway.

  2. On the VPN Gateway (Subscription) page, set the following parameters:

    • Instance Name: vpn-demo

    • Region and Zone: China (Hangzhou).

    • Gateway Type: China Certification Type.

    • VPC: Select the VPC that your client needs to access.

    • vSwitch 1/vSwitch 2: Select vsw1 and vsw2 respectively.

      VPN gateways use a dual-active architecture. In a region that supports multiple zones, your VPC must have at least two vSwitches in different zones to ensure cross-zone high availability. If your VPC does not have vSwitches in different zones, create a vSwitch first.

    • Bandwidth: 5 Mbps.

    • IPsec-VPN: Disabled. (This option is available only after you enable SSL-VPN.)

    • SSL-VPN: Enable.

    • SSL-VPN Connections: 5.

    • Billing Cycle: Select a billing cycle. The minimum period is 1 Month.

    • Service-linked Role: If a service-linked role has not been created, click Create Service-linked Role.

    For detailed parameter descriptions, see Create and manage a VPN Gateway instance.

  3. After you complete the purchase, the new VPN Gateway appears on the VPN Gateway page.

    A new VPN gateway starts in the Preparing state. It changes to Normal in about 1 to 5 minutes, at which point it is ready for use.

2. Create an SSL server

An Ssl server defines the cloud network that clients can access and configures the client IP address pool.

  1. Go to the SSL Servers page. In the top navigation bar, select the China (Hangzhou) region, and then click Create SSL Server.

  2. In the Create SSL Server panel, configure the ssl server with the following settings:

    • Name: Enter server-demo.

    • VPN Gateway: Select the VPN Gateway that you just created.

    • Local Network: Enter the CIDR block of the VPC, 10.0.0.0/16.

      This is the cloud network that you want clients to access, which is typically the CIDR block of your VPC.

    • Client CIDR Block: This is the address pool from which the VPN Gateway assigns IP addresses to client-side virtual network adapters. To avoid routing conflicts, this block must not overlap with the Local Network or any of the client's existing CIDR blocks (such as your client's on-premises network). Use an RFC 1918 private address range that is unlikely to cause conflicts, such as 10.200.200.0/24.

    Keep the default values for other options. For detailed parameter descriptions, see Create and manage an ssl server.

3. Create an SSL client and download certificate

An SSL client manages a client certificate. Each connecting client must import a certificate for authentication and encryption.

  1. In the left-side navigation pane, choose Interconnections > VPN > SSL Clients. In the top navigation bar, select the China (Hangzhou) region. On the SSL Client page, click Create SSL Client.

  2. In the Create SSL Client panel, enter client-demo for Name, select server-demo for SSL Server, and then click OK.

  3. On the SSL Client page, find your ssl client and click Download Certificate in the Actions column.

Step 2: Configure the client

Follow the configuration instructions for your client's operating system.

Windows client

  1. Download the OpenVPN client for your Windows version and follow the on-screen instructions to install it.

    If you cannot open the download link, contact your account manager or an Alibaba Cloud engineer.

  2. Unzip the downloaded ssl client certificate package and copy all extracted files to the OpenVPN configuration directory.

    • Default path: C:\Program Files\OpenVPN\config

    • Note: If you changed the installation path, copy the files to the config folder in your actual installation directory.

    image

  3. Open the config.ovpn file with a text editor and add the following line to the end of the file: disable-dco.

    The Data Channel Offload (DCO) feature introduced in OpenVPN 2.6 is incompatible with some Windows systems, such as specific versions of Windows 10 and 11. This configuration disables DCO to resolve potential connection issues on these devices.

    image

  4. Right-click the OpenVPN icon in the system tray, and then click Connect to establish a VPN connection.

    image

  5. If the state changes to Connected and an IP address is assigned, the connection is successful.

    image

Linux client

  1. Run the following command to install the OpenVPN client and create the conf directory.

    CentOS
    yum install -y openvpn
mkdir -p /etc/openvpn/conf
    Ubuntu
    apt-get update
apt-get install -y openvpn
mkdir -p /etc/openvpn/conf

  2. Unzip the downloaded ssl client certificate package and copy the files to the /etc/openvpn/conf/ directory.

    image

  3. Go to the /etc/openvpn/conf/ directory and run the following command to establish the VPN connection. 

    openvpn --config /etc/openvpn/conf/config.ovpn --daemon

  4. (Optional) Configure the OpenVPN process to start automatically on boot.

    1. Edit the /etc/rc.local file and add the following lines.

      # Open the /etc/rc.local file in edit mode.
vi /etc/rc.local 
# Press i to enter edit mode, then add the following commands to the file.
cd /etc/openvpn/conf/
openvpn --config /etc/openvpn/conf/config.ovpn --daemon
# Press Esc to exit edit mode, then enter the following command to save and exit.
:wq

    2. Grant execute permissions to the /etc/rc.local file.

      chmod +x /etc/rc.local

Android client

  1. Download and install the OpenVPN client for Android. If you cannot open the download link, contact your account manager or an Alibaba Cloud engineer.

    This example uses an Android 9.0 device with OpenVPN client v3.0.5 installed.

  2. Transfer the downloaded ssl client certificate package to the Android device and unzip it.

    Note

    • If your Android device does not have an unzip utility, you can unzip the certificate package on a computer and then transfer the extracted files to your Android device.

    • Make sure that all extracted files are in the same folder, as shown in the following figure.

    文件保存位置

  3. Open the OpenVPN client, import the config.ovpn file, and add the VPN connection.

    导入config文件

    Step

    Description

    ①

    Select the OVPN Profile connection method.

    ②

    Find the config.ovpn file in the storage directory.

    ③

    Tap IMPORT to import the config.ovpn file.

    ④

    The client imports the configuration from the config.ovpn file and displays the public IP address of the VPN Gateway. Tap ADD to add the VPN connection.

  4. Tap the toggle to enable the VPN connection.

    开启OpenVPN

macOS client (GUI)

  1. Go to the Tunnelblick Releases page and download the .dmg file for the latest stable version. This example uses Tunnelblick 4.0.1 (build 5971). In the Assets section, download the .dmg file. If you cannot open the download link, contact your account manager or an Alibaba Cloud engineer.

    image

  2. Install the Tunnelblick software.

    image

    Step

    Description

    ①

    Double-click the downloaded Tunnelblick installer package.

    ②

    Double-click the Tunnelblick icon.

    ③

    Select I have configuration files.

    ④

    Click OK.

  3. Unzip the downloaded ssl client certificate package. Then, drag the extracted config.ovpn file to the Configurations panel.

image

Step

Description

①

In Launchpad, click the Tunnelblick icon to open Tunnelblick.

②

Drag the extracted config.ovpn file to the Configurations panel.

③

Select Only Me.

④

Click Connect.

macOS client (CLI)

  1. Open a Terminal window. If Homebrew is not installed on your client, run the following command to install it.

    Note

    The Homebrew installation script includes the sudo command and will prompt you for your administrator password. When "Press RETURN/ENTER to continue..." appears, press Enter to proceed.

    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

    image

  2. Run the following command to install the OpenVPN client. 

    brew install openvpn

    image

  3. Copy the downloaded ssl client certificate package to the configuration directory.

    1. Back up the /opt/homebrew/etc/openvpn directory.

      cp -r  /opt/homebrew/etc/openvpn /opt/homebrew/etc/openvpn_bak

    2. Run the following command to delete the current OpenVPN configuration files.

      rm /opt/homebrew/etc/openvpn/*

    3. Run the following command to copy the downloaded ssl client certificate package to the configuration directory.

      cp /path/to/certs.zip /opt/homebrew/etc/openvpn/
      Note

      /path/to/certs.zip is the path to your downloaded ssl client certificate package. It is typically in the current user's Downloads directory, for example, /Users/example/Downloads/certs.zip.

  4. Run the following commands to unzip the certificate package.

    cd /opt/homebrew/etc/openvpn/
unzip /opt/homebrew/etc/openvpn/certs.zip

  5. Choose a run mode.

    Run in the foreground

    Run the following command to start the client process and establish the VPN connection:

    sudo /opt/homebrew/opt/openvpn/sbin/openvpn --config /opt/homebrew/etc/openvpn/config.ovpn

    This command runs in the foreground. To disconnect, press Ctrl+C to terminate the process.

    Run in the background

    Run the following commands to run the VPN client as a background service that starts automatically on boot:

    cp config.ovpn openvpn.conf
sudo brew services start openvpn

    To stop the service, run the following command:

    sudo brew services stop  openvpn

Step 3: Test connectivity

  1. Configure security group rules

    To ensure the client can access resources in the VPC, add an inbound rule to the security group for the ECS instance to allow traffic from the Client CIDR Block (10.200.200.0/24).

    • For connectivity testing: Allow the ICMP protocol so that the ping command works.

    • For application access: Allow specific ports required by your services, such as TCP 22 (SSH), TCP 3389 (RDP), or TCP 80/443 (web services).

  2. Ping test

    On the client device, ping the ECS instance. A successful ping response indicates a private connection to the ECS instance.

    ping 10.0.0.1

    image

  3. Service port test

    To further verify application access, try to connect to a service running on the ECS instance. For example, install and start a web service (like Nginx) on the ECS instance:

    # Run on the ECS instance (Example for Alibaba Cloud Linux 3):
yum install -y nginx
systemctl start nginx.service

    Confirm that the security group for the ECS instance allows TCP port 80 traffic from the client CIDR block. Then, open a web browser on your client and navigate to http://10.0.0.1.

    If the Nginx welcome page appears, your application access is working correctly.

    image

FAQ

How do I use username and password authentication?

You can enable two-factor authentication, which requires clients to authenticate with both a certificate and a username/password before establishing an SSL-VPN connection.

Disconnect from VPN on Linux or macOS

  1. Open a command-line terminal, run the following command to find the OpenVPN process, and note the process ID.

    ps aux | grep openvpn

  2. Run the following command to terminate the OpenVPN process.

    kill -9 <process ID>

Troubleshooting connection issues

Symptom

Cause and solution

Connection fails. For example, the client logs show AUTH_FAILED or TLS Handshake failed.

1. Network issue: Confirm that your client device has a stable internet connection and that your local network firewall or security software is not blocking the OpenVPN client from accessing the public IP address and port of the VPN Gateway (default is TCP/1194).

2. Certificate issue: Verify that the imported config.ovpn file and related certificate files are complete and unmodified. Download and import the certificate again from the console.

Connection is successful, but you cannot ping the ECS instance in the VPC.

1. Security group rule: This is the most common cause. Log on to the ECS console and check the security group rules for the instance. Ensure that you have added an inbound rule for the ICMP protocol with the source set to your Client CIDR Block (for example, 10.200.200.0/24).

2. ECS internal firewall: Check if the ECS instance's operating system firewall (such as firewalld or iptables) is blocking ICMP requests.

Connection is successful and ping works, but you cannot access services on the ECS instance (such as a website or SSH).

1. Security group rule: Check the security group for the ECS instance and ensure it allows traffic on the relevant service ports (such as TCP 80 or TCP 22) from your client CIDR block.

2. Service listening status: Log on to the ECS instance and confirm that the port is in a listening state (for example, use netstat -nltp on a Linux system).

3. ECS internal firewall: Log on to the ECS instance and confirm that the instance's operating system firewall allows traffic on the required port.

After connecting to the VPN, you cannot access your local network (like a printer) or the internet.

Routing conflict: The Client CIDR Block configured in the ssl server may conflict with your local network's CIDR block. Return to Step 1, modify the client CIDR block in the ssl server to a less common range (such as 10.240.240.0/24), download the new certificate, and reconfigure your client.

The ECS instance cannot initiate a ping to the client.

This is expected behavior. For security reasons, client operating system firewalls typically block unsolicited incoming connections from external sources, including the VPN endpoint. This does not affect the client's ability to access cloud resources. If a cloud resource needs to access the client, you must configure the client's firewall to allow ICMP traffic.

For more information, see SSL-VPN connection FAQ.

Previous：Getting StartedNext：Connect an iPhone or iPad to a VPC using SSL-VPN