Securely connecting Civo and AWS with StrongSwan VPN

Connecting workloads across clouds has become a common requirement for teams that rely on hybrid environments. Organizations migrating to Civo Cloud, or expanding into it, often need a stable way to reach private AWS resources without exposing anything publicly. But this is where challenges appear quickly.

Most teams discover that cross-cloud connectivity is often expensive, complicated, and filled with vendor-specific requirements. AWS Direct Connect, proprietary firewalls, or managed VPNs introduce cost or administrative weight that small teams don’t always want to deal with.

Fortunately, there's a practical answer: a StrongSwan-powered site-to-site VPN running on a Civo VM that connects directly to an AWS VPC. This setup creates a secure tunnel where both cloud networks can communicate as if they belonged to the same private environment.

This tutorial provides a complete, end-to-end walkthrough—from planning IP address space and configuring AWS networking components, to deploying StrongSwan on Civo, establishing redundant IPsec tunnels, and extending connectivity to additional virtual machines.

Why cross-cloud private connectivity matters

Many organizations reach a point where hosting everything in one cloud is no longer viable. New products might be easier to run in a different provider, or teams may want to migrate workloads gradually while keeping backend systems in AWS.

In most of these scenarios, engineers face a similar challenge:

“How do we allow Civo workloads to reach AWS private resources without placing those resources on the public internet?”

A public endpoint is often unacceptable for:

Internal APIs
Databases
Legacy systems
Sensitive or regulated workloads

A site-to-site VPN addresses this problem by securely linking two private networks, so they behave as a single routed environment.

AWS supports IPsec-based VPNs via a Virtual Private Gateway (VGW). Civo, meanwhile, provides full control over virtual machines and networking, making StrongSwan a flexible and cost-effective VPN solution.

Prerequisites

To get started with this tutorial, you will need the following in place:

A Civo virtual machine
StrongSwan
Non-overlapping CIDR ranges
Standard AWS VPN components

The result is a secure IPsec tunnel that routes private traffic between Civo and AWS.

Planning the network layout

A stable VPN configuration begins with clean network planning. The most important rule is simple:

Your AWS VPC CIDR and Civo network CIDR must not overlap.

The following reference layout is used throughout this tutorial:

Component	Example IP / CIDR	Notes
AWS VPC	10.10.0.0/16	Primary AWS private network
AWS resource subnet	10.10.1.0/24	EC2 and application workloads
AWS instance IP	10.10.1.10	Example private VM
AWS database subnet	10.10.2.0/24	Private database network
AWS database IP	10.10.2.106	Example private database
Civo network	192.168.50.0/24	Civo private network
Civo StrongSwan VM (private)	192.168.50.5	VPN gateway local address
Civo StrongSwan VM (public)	X.Y.Z.W	VPN gateway public address

These CIDRs must remain consistent across AWS configuration, StrongSwan setup, and static routing.

Preparing the AWS side

This entire setup depends on defining the AWS components correctly. The following AWS pieces are required:

A VPC
Subnets
A Virtual Private Gateway (VGW)
A Customer Gateway (pointing to StrongSwan’s public IP)
A Site-to-Site VPN connection
A static route directing Civo traffic through the VPN

Create the AWS VPC

In the AWS console:

Navigate to VPC → Create VPC
Name: mumbai-main-vpc
IPv4 CIDR: 10.10.0.0/16
Tenancy: Default

Create subnets

You’ll need at least two subnets (the database subnet should not require internet access):

Subnet	CIDR	Purpose
Resource subnet	10.10.1.0/24	Application and EC2 workloads
Database subnet	10.10.2.0/24	Private database resources

(Optional) Internet gateway

An internet gateway is only required if some AWS resources need outbound internet access. It is not required for the VPN itself. If you need more information on this, refer to this documentation.

Launch AWS private resources

Example configuration:

Application instance
- Subnet: 10.10.1.0/24
- IP: 10.10.1.10
- Security group: allow traffic only from 192.168.50.0/24
Private database
- Subnet: 10.10.2.0/24
- IP: 10.10.2.106
- Security group: allow database port (for example, 3306 or 5432) from 192.168.50.0/24

This ensures private access exclusively through the VPN tunnel.

Creating AWS VPN components

AWS must now be configured to recognise the Civo VPN endpoint.

Create a Customer Gateway (CGW)

Console → VPC → Customer Gateways → Create
Name: civo-strongswan-cgw
IP address: Public IP of the Civo VM
Routing: Static
BGP ASN: Any valid value

Create a Virtual Private Gateway (VGW)

Console → VPC → Virtual Private Gateways → Create
Name: mumbai-vgw
Attach it to the VPC

Create the site-to-site VPN

Console → VPC → Site-to-Site VPN Connections → Create
Name: aws-civo-vpn
Target: mumbai-vgw
Customer Gateway: civo-strongswan-cgw
Routing: Static
Static Route: 192.168.50.0/24 (Civo CIDR)

Wait for it to enter the Available state.

Download the VPN configuration file

Choose:

Vendor: strongSwan
Platform: Ubuntu
IKE version: IKEv2

This file contains tunnel endpoints, pre-shared keys, encryption parameters, and tunnel interface IPs used later in the configuration.

Deploying StrongSwan on Civo

A single Civo virtual machine acts as the VPN gateway. StrongSwan supports route-based VPNs using VTI interfaces, which align well with AWS VGW requirements.

The provided script is a production-ready deployment tool that:

Installs StrongSwan
Enables IP forwarding
Configures two redundant tunnels
Creates VTI interfaces
Applies static routes and firewall rules
Starts and validates both tunnels

Rather than duplicating the entire script inline, this guide focuses on how it works and how to adapt it safely.

Key variables to update

Inside the script, update:

PUBLIC_IP
LOCAL_SUBNET
AWS_CIDR
AWS_T1_PUBLIC, AWS_T2_PUBLIC
AWS_T1_PSK, AWS_T2_PSK
T1_LOCAL_IP, T1_REMOTE_IP, T2_LOCAL_IP, T2_REMOTE_IP

These values all come directly from the AWS VPN configuration file.

Setup-vpn.sh

1#!/bin/bash
2
3##############################################
4# AWS VPN TUNNEL SETUP SCRIPT (Route-Based)
5# 
6# This script sets up a route-based IPsec VPN tunnel between
7# a Civo VM and AWS VPC using strongSwan.
8#
9# TO USE ON A NEW VM:
10# 1. Update the variables below with your values
11# 2. Run: sudo bash script.sh
12# 3. The script is idempotent - safe to run multiple times
13#
14##############################################
15
16##############################################
17#  CHANGE ONLY THESE VALUES FOR NEW VM
18##############################################
19
20PUBLIC_IP="212.2.249.102"          # Your Civo VM PUBLIC IP (must match AWS Customer Gateway) `leftid`
21LOCAL_SUBNET="192.168.50.0/24"     # Your Civo network CIDR `leftsubnet`
22AWS_CIDR="10.10.0.0/16"            # AWS VPC CIDR `rightsubnet`
23
24# AWS VPN Tunnel Endpoints (from AWS VPN config file)
25AWS_T1_PUBLIC="13.235.15.233"      # AWS Tunnel 1 Public IP
26AWS_T2_PUBLIC="65.0.248.54"        # AWS Tunnel 2 Public IP
27
28# Pre-Shared Keys (from AWS VPN config file)
29AWS_T1_PSK="xxxxx"
30AWS_T2_PSK="xxxxx"
31
32# Route-based VPN tunnel IPs (from AWS VPN config file)
33# These are the 169.254.x.x addresses for the tunnel interfaces
34T1_LOCAL_IP="169.254.26.210/30"    # Tunnel1 local IP
35T1_REMOTE_IP="169.254.26.209/30"   # Tunnel1 remote IP
36T2_LOCAL_IP="169.254.19.106/30"    # Tunnel2 local IP
37T2_REMOTE_IP="169.254.19.105/30"   # Tunnel2 remote IP
38
39# Get physical interface name (usually eth0 or ens5)
40PHYS_INTERFACE=$(ip route | grep default | awk '{print $5}' | head -1)
41if [ -z "$PHYS_INTERFACE" ]; then
42    PHYS_INTERFACE="eth0"  # fallback
43fi
44
45##############################################
46# INSTALL STRONGSWAN
47##############################################
48echo " Installing strongSwan..."
49sudo apt update && sudo apt install -y strongswan netfilter-persistent
50
51##############################################
52#  ENABLE IP FORWARDING
53##############################################
54echo "Enabling IP forwarding..."
55echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-ipforward.conf
56echo "net.ipv4.conf.all.accept_redirects=0" | sudo tee -a /etc/sysctl.d/99-ipforward.conf
57echo "net.ipv4.conf.all.send_redirects=0" | sudo tee -a /etc/sysctl.d/99-ipforward.conf
58sudo sysctl -p
59
60##############################################
61#  CREATE /etc/ipsec.conf  (ROUTE-BASED VPN)
62##############################################
63echo " Writing /etc/ipsec.conf..."
64sudo tee /etc/ipsec.conf &gt; /dev/null &lt;&lt; EOF
65config setup
66    charondebug="all"
67    uniqueids=yes
68    strictcrlpolicy=no
69
70conn Tunnel1
71    type=tunnel
72    auto=add
73    keyexchange=ikev2
74    authby=psk
75
76    left=%any
77    leftid=$PUBLIC_IP
78    leftsubnet=$LOCAL_SUBNET
79
80    right=$AWS_T1_PUBLIC
81    rightsubnet=$AWS_CIDR
82
83    aggressive=no
84    ikelifetime=28800s
85    lifetime=3600s
86    margintime=270s
87    rekey=yes
88    rekeyfuzz=100%
89    fragmentation=yes
90    replay_window=1024
91    dpddelay=30s
92    dpdtimeout=120s
93    dpdaction=restart
94    ike=aes128-sha1-modp1024
95    esp=aes128-sha1-modp1024
96    keyingtries=%forever
97    mark=100
98    leftupdown="/etc/ipsec.d/aws-updown.sh -ln Tunnel1 -ll $T1_LOCAL_IP -lr ${T1_REMOTE_IP%/*}/30 -m 100 -r $AWS_CIDR"
99
100conn Tunnel2
101    type=tunnel
102    auto=add
103    keyexchange=ikev2
104    authby=psk
105
106    left=%any
107    leftid=$PUBLIC_IP
108    leftsubnet=$LOCAL_SUBNET
109
110    right=$AWS_T2_PUBLIC
111    rightsubnet=$AWS_CIDR
112
113    aggressive=no
114    ikelifetime=28800s
115    lifetime=3600s
116    margintime=270s
117    rekey=yes
118    rekeyfuzz=100%
119    fragmentation=yes
120    replay_window=1024
121    dpddelay=30s
122    dpdtimeout=120s
123    dpdaction=restart
124    ike=aes128-sha1-modp1024
125    esp=aes128-sha1-modp1024
126    keyingtries=%forever
127    mark=200
128    leftupdown="/etc/ipsec.d/aws-updown.sh -ln Tunnel2 -ll $T2_LOCAL_IP -lr ${T2_REMOTE_IP%/*}/30 -m 200 -r $AWS_CIDR"
129EOF
130
131##############################################
132#  CREATE PSK FILE
133##############################################
134echo " Writing /etc/ipsec.secrets..."
135sudo tee /etc/ipsec.secrets &gt; /dev/null &lt;&lt; EOF
136$PUBLIC_IP $AWS_T1_PUBLIC : PSK "$AWS_T1_PSK"
137$PUBLIC_IP $AWS_T2_PUBLIC : PSK "$AWS_T2_PSK"
138EOF
139
140##############################################
141# 4.CREATE AWS UPDOWN SCRIPT
142##############################################
143echo " Creating AWS updown script..."
144sudo mkdir -p /etc/ipsec.d
145sudo tee /etc/ipsec.d/aws-updown.sh &gt; /dev/null &lt;&lt; 'UPSCRIPT'
146#!/bin/bash
147
148while [[ $# &gt; 1 ]]; do
149	case ${1} in
150		-ln|--link-name)
151			TUNNEL_NAME="${2}"
152			TUNNEL_PHY_INTERFACE="${PLUTO_INTERFACE}"
153			shift
154			;;
155		-ll|--link-local)
156			TUNNEL_LOCAL_ADDRESS="${2}"
157			TUNNEL_LOCAL_ENDPOINT="${PLUTO_ME}"
158			shift
159			;;
160		-lr|--link-remote)
161			TUNNEL_REMOTE_ADDRESS="${2}"
162			TUNNEL_REMOTE_ENDPOINT="${PLUTO_PEER}"
163			shift
164			;;
165		-m|--mark)
166			TUNNEL_MARK="${2}"
167			shift
168			;;
169		-r|--static-route)
170			TUNNEL_STATIC_ROUTE="${2}"
171			shift
172			;;
173		*)
174			echo "${0}: Unknown argument \"${1}\"" &gt;&2
175			;;
176	esac
177	shift
178done
179
180command_exists() {
181	type "$1" &gt;&2 2&gt;&2
182}
183
184create_interface() {
185	ip link add ${TUNNEL_NAME} type vti local ${TUNNEL_LOCAL_ENDPOINT} remote ${TUNNEL_REMOTE_ENDPOINT} key ${TUNNEL_MARK} 2&gt;/dev/null || true
186	ip addr add ${TUNNEL_LOCAL_ADDRESS} dev ${TUNNEL_NAME} 2&gt;/dev/null || true
187	ip link set ${TUNNEL_NAME} up mtu 1419
188}
189
190configure_sysctl() {
191	sysctl -w net.ipv4.ip_forward=1
192	sysctl -w net.ipv4.conf.${TUNNEL_NAME}.rp_filter=2
193	sysctl -w net.ipv4.conf.${TUNNEL_NAME}.disable_policy=1
194	sysctl -w net.ipv4.conf.${TUNNEL_PHY_INTERFACE}.disable_xfrm=1
195	sysctl -w net.ipv4.conf.${TUNNEL_PHY_INTERFACE}.disable_policy=1
196}
197
198add_route() {
199	# Get local IP from the physical interface
200	PHYS_IF=$(ip route | grep default | awk '{print $5}' | head -1)
201	LOCAL_IP=$(ip addr show ${PHYS_IF} 2&gt;/dev/null | grep "inet " | awk '{print $2}' | cut -d/ -f1)
202	if [ -z "$LOCAL_IP" ]; then
203		LOCAL_IP="${TUNNEL_LOCAL_ENDPOINT}"
204	fi
205	
206	IFS=',' read -ra route &lt;&lt;&lt; "${TUNNEL_STATIC_ROUTE}"
207    	for i in "${route[@]}"; do
208	    # Remove existing route first, then add with source IP
209	    ip route del ${i} dev ${TUNNEL_NAME} 2&gt;/dev/null || true
210	    ip route add ${i} dev ${TUNNEL_NAME} src ${LOCAL_IP} metric ${TUNNEL_MARK} 2&gt;/dev/null || true
211	done
212	iptables -t mangle -C FORWARD -o ${TUNNEL_NAME} -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2&gt;/dev/null || \
213		iptables -t mangle -A FORWARD -o ${TUNNEL_NAME} -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
214	iptables -t mangle -C INPUT -p esp -s ${TUNNEL_REMOTE_ENDPOINT} -d ${TUNNEL_LOCAL_ENDPOINT} -j MARK --set-xmark ${TUNNEL_MARK} 2&gt;/dev/null || \
215		iptables -t mangle -A INPUT -p esp -s ${TUNNEL_REMOTE_ENDPOINT} -d ${TUNNEL_LOCAL_ENDPOINT} -j MARK --set-xmark ${TUNNEL_MARK}
216	# Mark outgoing traffic based on route
217	iptables -t mangle -C OUTPUT -o ${TUNNEL_NAME} -j MARK --set-xmark ${TUNNEL_MARK} 2&gt;/dev/null || \
218		iptables -t mangle -A OUTPUT -o ${TUNNEL_NAME} -j MARK --set-xmark ${TUNNEL_MARK}
219	ip route flush table 220 2&gt;/dev/null || true
220}
221
222cleanup() {
223        IFS=',' read -ra route &lt;&lt;&lt; "${TUNNEL_STATIC_ROUTE}"
224        for i in "${route[@]}"; do
225            ip route del ${i} dev ${TUNNEL_NAME} metric ${TUNNEL_MARK} 2&gt;/dev/null || true
226        done
227	iptables -t mangle -D FORWARD -o ${TUNNEL_NAME} -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2&gt;/dev/null || true
228	iptables -t mangle -D INPUT -p esp -s ${TUNNEL_REMOTE_ENDPOINT} -d ${TUNNEL_LOCAL_ENDPOINT} -j MARK --set-xmark ${TUNNEL_MARK} 2&gt;/dev/null || true
229	iptables -t mangle -D OUTPUT -o ${TUNNEL_NAME} -j MARK --set-xmark ${TUNNEL_MARK} 2&gt;/dev/null || true
230	ip route flush cache 2&gt;/dev/null || true
231}
232
233delete_interface() {
234	ip link set ${TUNNEL_NAME} down 2&gt;/dev/null || true
235	ip link del ${TUNNEL_NAME} 2&gt;/dev/null || true
236}
237
238case "${PLUTO_VERB}" in
239	up-client)
240		create_interface
241		configure_sysctl
242		add_route
243		;;
244	down-client)
245		cleanup
246		delete_interface
247		;;
248esac
249UPSCRIPT
250sudo chmod 744 /etc/ipsec.d/aws-updown.sh
251
252##############################################
253# 4. CONFIGURE CHARON (DISABLE AUTO ROUTES)
254##############################################
255echo "  Configuring charon.conf..."
256if [ -f /etc/strongswan.d/charon.conf ]; then
257    sudo sed -i 's/# install_routes = yes/install_routes = no/' /etc/strongswan.d/charon.conf
258    if ! grep -q "install_routes = no" /etc/strongswan.d/charon.conf; then
259        echo "install_routes = no" | sudo tee -a /etc/strongswan.d/charon.conf
260    fi
261fi
262
263# Note: VTI interfaces will be created by the updown script when tunnels come up
264
265##############################################
266#  FLUSH OLD STATE & RESTART VPN
267##############################################
268echo "♻ Restarting VPN..."
269# Clean up any existing routes to AWS CIDR
270sudo ip route del $AWS_CIDR via 192.168.50.5 2&gt;/dev/null || true
271sudo ip route del $AWS_CIDR dev enp1s0 2&gt;/dev/null || true
272sudo ip route del $AWS_CIDR dev $PHYS_INTERFACE 2&gt;/dev/null || true
273sudo ip route del $AWS_CIDR dev Tunnel1 2&gt;/dev/null || true
274sudo ip route del $AWS_CIDR dev Tunnel2 2&gt;/dev/null || true
275
276sudo ip xfrm state flush
277sudo ip xfrm policy flush
278sudo ipsec restart
279sleep 5
280
281# Start the tunnels
282echo " Starting tunnels..."
283sudo ipsec up Tunnel1
284sudo ipsec up Tunnel2
285sleep 3
286
287# Routes are added by the updown script, but verify they have correct source IP
288echo "  Verifying routes..."
289LOCAL_IP=$(ip addr show $PHYS_INTERFACE | grep "inet " | awk '{print $2}' | cut -d/ -f1)
290if [ -n "$LOCAL_IP" ]; then
291    # Ensure routes have correct source IP (updown script should have done this, but double-check)
292    sudo ip route del $AWS_CIDR dev Tunnel1 2&gt;/dev/null || true
293    sudo ip route del $AWS_CIDR dev Tunnel2 2&gt;/dev/null || true
294    sudo ip route add $AWS_CIDR dev Tunnel1 src $LOCAL_IP metric 100 2&gt;/dev/null || true
295    sudo ip route add $AWS_CIDR dev Tunnel2 src $LOCAL_IP metric 200 2&gt;/dev/null || true
296fi
297
298echo " Tunnel status:"
299sudo ipsec statusall
300
301##############################################
302#  FORWARD TRAFFIC (REQUIRED FOR VM2,3,4...)
303##############################################
304echo "🔧 Allowing forwarded traffic..."
305sudo iptables -C FORWARD -s $LOCAL_SUBNET -d $AWS_CIDR -j ACCEPT 2&gt;/dev/null || \
306    sudo iptables -A FORWARD -s $LOCAL_SUBNET -d $AWS_CIDR -j ACCEPT
307sudo iptables -C FORWARD -s $AWS_CIDR -d $LOCAL_SUBNET -j ACCEPT 2&gt;/dev/null || \
308    sudo iptables -A FORWARD -s $AWS_CIDR -d $LOCAL_SUBNET -j ACCEPT
309sudo netfilter-persistent save
310
311##############################################
312#  TESTING INSTRUCTIONS FOR YOU
313##############################################
314echo ""
315echo " TESTING COMMANDS:"
316echo "-------------------------------------------"
317echo "sudo ipsec statusall                    # Check tunnel status"
318echo "ip route show                           # Check routes"
319echo "ip addr show Tunnel1                    # Check Tunnel1 interface"
320echo "ip addr show Tunnel2                    # Check Tunnel2 interface"
321echo "sudo tcpdump -n -i any proto esp        # Monitor ESP traffic"
322echo "ping -c 4 10.10.2.106                   # Test ping to AWS"
323echo "-------------------------------------------"
324echo "If you have another VM (192.168.50.10+):"
325echo "sudo ip route add 10.10.0.0/16 via &lt;STRONGSWAN_LOCAL_IP&gt;"
326echo "-------------------------------------------"
327echo " If tcpdump shows ESP packets — TUNNEL IS WORKING!"
328echo ""

Running the script

SSH into your Civo VM, then run:

1sudo bash Setup-vpn.sh

The script will:

Install packages
Create /etc/ipsec.conf
Create /etc/ipsec.secrets
Create /etc/ipsec.d/aws-updown.sh
Restart StrongSwan
Bring up Tunnel1 and Tunnel2
Add routes for AWS CIDR

You should see output indicating that both tunnels come up successfully.

Understanding what the script creates

Section	Details
IPsec tunnels	Two tunnels are created: - Tunnel1 (mark 100) - Tunnel2 (mark 200) AWS provides dual tunnels for redundancy, and both should remain active.
VTI interfaces	Each tunnel creates a virtual interface with: - A local tunnel IP - A remote tunnel endpoint - A route priority for failover
Static routing	Routes are added for the entire AWS VPC: - `10.10.0.0/16` dev Tunnel1 metric 100 - `10.10.0.0/16` dev Tunnel2 metric 200 This enables automatic failover between tunnels.
Firewall configuration	The script adds: - TCP MSS clamping to prevent MTU issues - Packet marking for routing consistency - Forwarding rules for bidirectional traffic

Testing the VPN

Once the StrongSwan VM is configured, it’s time to verify connectivity.

Check	Details
Check tunnel status	`sudo ipsec statusall` Both tunnels should show “INSTALLED”.
Check VTI interfaces	`ip addr show Tunnel1` `ip addr show Tunnel2` You should see the 169.254.x.x addresses.
Check the routing table	`ip route show` Look for: `10.10.0.0/16 dev Tunnel1` `10.10.0.0/16 dev Tunnel2`
Check for ESP traffic	`sudo tcpdump -n -i any proto esp` If ESP packets appear while pinging AWS, the tunnel is functioning.
Ping an AWS resource	`ping -c 4 10.10.1.10` A working ping indicates: - The tunnel is active - AWS security groups allow traffic - NAT is not interfering - Route tables are correct

Extending connectivity to other Civo VMs

Once the VPN gateway is operational, other VMs in the same Civo network can reach AWS resources by adding a single route:

1sudo ip route add 10.10.0.0/16 via 192.168.50.5

Test it by running:

1ping -c 4 10.10.1.10

If ping works, the routing path is correct.

Making static routes persistent

Routes added manually disappear after reboot. To make them persistent, use one of the options below.

Option A: Netplan (Ubuntu 18.04+)

Edit:

1sudo nano /etc/netplan/50-cloud-init.yaml

Add under your network interface:

1network:
2  version: 2
3  ethernets:
4    enp1s0:
5      dhcp4: true
6      routes:
7        - to: 10.10.0.0/16
8          via: 192.168.50.5

Apply:

1sudo netplan apply

Option B: Older Ubuntu versions

Edit:

1sudo nano /etc/network/interfaces

Add:

1up ip route add 10.10.0.0/16 via 192.168.50.5

Now AWS routing persists across reboots.

How traffic moves across the VPN

Here’s the flow for a VM in the Civo network:

1Civo VM (192.168.50.10)
2        ↓
3Route: 10.10.0.0/16 via 192.168.50.5
4        ↓
5StrongSwan VM (VPN Gateway)
6        ↓
7VTI Tunnel
8        ↓
9AWS Virtual Private Gateway
10        ↓
11AWS VPC Resource (10.10.x.x)

This architecture makes both clouds feel linked through a private connection.

Summary

Cross-cloud networking is often associated with complexity, cost, and restrictive vendor tooling. With Civo, StrongSwan, and standard AWS VPN components, it is possible to build a secure, private, and production-ready cloud-to-cloud connection without unnecessary overhead.

This architecture enables:

Private database access
Secure service-to-service communication
Gradual migration from AWS to Civo
Hybrid and multi-cloud deployments without public exposure

If you're looking for a straightforward method to connect AWS and Civo in a way that keeps traffic private and under your control, this StrongSwan VPN architecture is a strong option. With proper planning and the script provided earlier, you can have both clouds communicating through a secure tunnel in minutes.

This tutorial was written by Vikas Yadav, Founder of KubeNine. If you want to learn more about KubeNine and how they help businesses improve efficiency, reliability, and scalability through automation, click here >