118 lines
5.5 KiB
Markdown
118 lines
5.5 KiB
Markdown
# Cloud VPN Route-based Module
|
|
|
|
This module makes it easy to deploy a [Classic VPN](https://docs.cloud.google.com/network-connectivity/docs/vpn/concepts/overview#classic-vpn) with static routing.
|
|
|
|
<!-- BEGIN TOC -->
|
|
- [Examples](#examples)
|
|
- [Classic VPN with single tunnel](#classic-vpn-with-single-tunnel)
|
|
- [Classic VPN with single tunnel and custom ciphers](#classic-vpn-with-single-tunnel-and-custom-ciphers)
|
|
- [Variables](#variables)
|
|
- [Outputs](#outputs)
|
|
<!-- END TOC -->
|
|
|
|
## Examples
|
|
|
|
### Classic VPN with single tunnel
|
|
|
|
```hcl
|
|
module "addresses" {
|
|
source = "./fabric/modules/net-address"
|
|
project_id = var.project_id
|
|
external_addresses = {
|
|
vpn = { region = "europe-west1" }
|
|
}
|
|
}
|
|
|
|
module "vpn" {
|
|
source = "./fabric/modules/net-vpn-static"
|
|
project_id = var.project_id
|
|
region = var.region
|
|
network = var.vpc.self_link
|
|
name = "remote"
|
|
gateway_address_create = false
|
|
gateway_address = module.addresses.external_addresses["vpn"].address
|
|
remote_ranges = ["10.10.0.0/24"]
|
|
tunnels = {
|
|
remote-0 = {
|
|
peer_ip = "1.1.1.1"
|
|
shared_secret = "mysecret"
|
|
traffic_selectors = { local = ["0.0.0.0/0"], remote = ["0.0.0.0/0"] }
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=2 resources=8 inventory=vpn-single-tunnel.yaml
|
|
```
|
|
|
|
### Classic VPN with single tunnel and custom ciphers
|
|
|
|
```hcl
|
|
module "addresses" {
|
|
source = "./fabric/modules/net-address"
|
|
project_id = var.project_id
|
|
external_addresses = {
|
|
vpn = { region = "europe-west1" }
|
|
}
|
|
}
|
|
|
|
module "vpn" {
|
|
source = "./fabric/modules/net-vpn-static"
|
|
project_id = var.project_id
|
|
region = var.region
|
|
network = var.vpc.self_link
|
|
name = "remote"
|
|
gateway_address_create = false
|
|
gateway_address = module.addresses.external_addresses["vpn"].address
|
|
remote_ranges = ["10.10.0.0/24"]
|
|
tunnels = {
|
|
remote-0 = {
|
|
cipher_suite = {
|
|
phase1 = {
|
|
dh = ["Group-14"]
|
|
encryption = ["AES-CBC-256"]
|
|
integrity = ["HMAC-SHA2-256-128"]
|
|
prf = ["PRF-HMAC-SHA2-256"]
|
|
}
|
|
phase2 = {
|
|
encryption = ["AES-CBC-128"]
|
|
integrity = ["HMAC-SHA2-256-128"]
|
|
pfs = ["Group-14"]
|
|
}
|
|
}
|
|
peer_ip = "1.1.1.1"
|
|
shared_secret = "mysecret"
|
|
traffic_selectors = { local = ["0.0.0.0/0"], remote = ["0.0.0.0/0"] }
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=2 resources=8 inventory=vpn-single-tunnel-custom-ciphers.yaml
|
|
```
|
|
<!-- BEGIN TFDOC -->
|
|
## Variables
|
|
|
|
| name | description | type | required | default |
|
|
|---|---|:---:|:---:|:---:|
|
|
| [name](variables.tf#L29) | VPN gateway name, and prefix used for dependent resources. | <code>string</code> | ✓ | |
|
|
| [network](variables.tf#L34) | VPC used for the gateway and routes. | <code>string</code> | ✓ | |
|
|
| [project_id](variables.tf#L39) | Project where resources will be created. | <code>string</code> | ✓ | |
|
|
| [region](variables.tf#L44) | Region used for resources. | <code>string</code> | ✓ | |
|
|
| [gateway_address](variables.tf#L17) | Optional address assigned to the VPN gateway. Ignored unless gateway_address_create is set to false. | <code>string</code> | | <code>null</code> |
|
|
| [gateway_address_create](variables.tf#L23) | Create external address assigned to the VPN gateway. Needs to be explicitly set to false to use address in gateway_address variable. | <code>bool</code> | | <code>true</code> |
|
|
| [remote_ranges](variables.tf#L49) | Remote IP CIDR ranges. | <code>list(string)</code> | | <code>[]</code> |
|
|
| [route_priority](variables.tf#L56) | Route priority, defaults to 1000. | <code>number</code> | | <code>1000</code> |
|
|
| [tunnels](variables.tf#L62) | VPN tunnel configurations. | <code title="map(object({ cipher_suite = optional(object({ phase1 = optional(object({ dh = optional(list(string)) encryption = optional(list(string)) integrity = optional(list(string)) prf = optional(list(string)) })) phase2 = optional(object({ encryption = optional(list(string)) integrity = optional(list(string)) pfs = optional(list(string)) })) })) ike_version = optional(number, 2) peer_ip = string shared_secret = optional(string) traffic_selectors = object({ local = list(string) remote = list(string) }) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
## Outputs
|
|
|
|
| name | description | sensitive |
|
|
|---|---|:---:|
|
|
| [address](outputs.tf#L17) | VPN gateway address. | |
|
|
| [gateway](outputs.tf#L22) | VPN gateway resource. | |
|
|
| [id](outputs.tf#L27) | Fully qualified VPN gateway id. | |
|
|
| [name](outputs.tf#L32) | VPN gateway name. | |
|
|
| [random_secret](outputs.tf#L37) | Generated secret. | |
|
|
| [self_link](outputs.tf#L42) | VPN gateway self link. | |
|
|
| [tunnel_names](outputs.tf#L47) | VPN tunnel names. | |
|
|
| [tunnel_self_links](outputs.tf#L55) | VPN tunnel self links. | |
|
|
| [tunnels](outputs.tf#L63) | VPN tunnel resources. | |
|
|
<!-- END TFDOC -->
|