GCP to Local Home Network VPN Setup

This project uses OpenTofu (or Terraform) to configure a VPC and VPN on Google Cloud Platform (GCP), establishing a Site-to-Site VPN connection with a home server (e.g., Raspberry Pi).

Architecture Overview

• GCP Side:

  • VPC Network: rpi-vpn-test-vpc
  • Subnet: rpi-vpn-subnet (10.10.0.0/24)
  • VPN Gateway: Classic VPN Gateway
  • Firewall Rules:
    • Allow VPN and internal traffic (ICMP, TCP, UDP)
    • Allow SSH access (for test VM)
  • Compute Engine: vpn-test-vm (e2-micro instance for connection testing)

• Local Side (User Environment):

  • Raspberry Pi (or home server) behind a router running a VPN daemon (e.g., StrongSwan, Libreswan)
  • Port Forwarding required: UDP 500, 4500 -> Raspberry Pi internal IP

Prerequisites

1. GCP Account & Project: A billing-enabled GCP project is required.
2. OpenTofu/Terraform Installed: Refer to the OpenTofu Installation Guide.
3. GCP Authentication: Authenticate locally via terminal.

   gcloud auth application-default login
   

4. Check Home Public IP: Identify your current public IP address.

Usage

1. Configure Variables (terraform.tfvars)

Create a terraform.tfvars file in the project root and configure it according to your environment.

project_id         = "YOUR_GCP_PROJECT_ID"
home_public_ip     = "123.123.123.123"
vpn_psk            = "your-secret-password"
home_internal_cidr = "192.168.0.0/24"
ssh_public_key     = "ssh-rsa AAA..."

2. Initialize and Apply

# Initialize
tofu init

# Plan
tofu plan

# Apply
tofu apply

3. Check Results

Upon completion of tofu apply, the following information will be output:

• gcp_vpn_ip: The public IP of the GCP VPN Gateway (target for Raspberry Pi connection).
• vm_public_ip: The public IP of the test VM.

Raspberry Pi Configuration Guide (StrongSwan with swanctl)

This guide uses the modern swanctl (VICI protocol) provided by StrongSwan 6.x+.

1. Install StrongSwan and Plugins:

   sudo apt-get update
   sudo apt-get install -y strongswan libcharon-extra-plugins libstrongswan-extra-plugins libstrongswan-standard-plugins strongswan-pki
   

2. Configure /etc/swanctl/swanctl.conf: Replace the content of /etc/swanctl/swanctl.conf with the following configuration.

   Note

   : Replace YOUR_HOME_PUBLIC_IP, GCP_VPN_IP, YOUR_PSK, and HOME_CIDR with your actual values.

   connections {
      gcp-vpn {
         remote_addrs = GCP_VPN_IP
   
         local {
            auth = psk
            id = YOUR_HOME_PUBLIC_IP
         }
   
         remote {
            auth = psk
            id = GCP_VPN_IP
         }
   
         children {
            gcp-net {
               local_ts = 192.168.0.0/24   # Your Home Network CIDR (e.g., 192.168.2.0/24)
               remote_ts = 10.10.0.0/24    # GCP Network CIDR
   
               esp_proposals = aes256-sha1-modp2048
               start_action = start
            }
         }
   
         version = 2
         proposals = aes256-sha1-modp2048
      }
   }
   
   secrets {
      ike-gcp {
         id = GCP_VPN_IP
         secret = "YOUR_PSK"
      }
   }
   

3. Apply & Start:

   # Load configuration
   sudo swanctl --load-all
   
   # Check status (should show ESTABLISHED)
   sudo swanctl --list-sas
   

4. Enable IP Forwarding: For the Raspberry Pi to act as a gateway and forward traffic to other devices, you must enable packet forwarding.

   Edit /etc/sysctl.conf and uncomment (or add) the following line:

   net.ipv4.ip_forward=1
   

   Apply changes:

   sudo sysctl -p
   

• Important: Ensure UDP 500 and 4500 ports are port-forwarded to the Raspberry Pi's internal IP in your router settings.

• Routing Setup (Home Router): You must configure a Static Route on your home router so that other devices in your home network can reach the GCP network.

  • Destination Network: 10.10.0.0
  • Subnet Mask: 255.255.255.0 (or /24)
  • Gateway: The internal IP of your Raspberry Pi (e.g., 192.168.2.x)

  Without this, only the Raspberry Pi itself can access the GCP network. Other devices (like your PC) won't know that traffic for 10.10.0.x should go through the Raspberry Pi.

Connection Test

1. Verify the tunnel status is "Established" in the VPN menu of the GCP Console.
2. SSH into the test VM (vpn-test-vm).
3. Ping a device in the home internal network (e.g., Raspberry Pi).

   ping 192.168.0.x