> For the complete documentation index, see [llms.txt](https://docs.cloud.olakrutrim.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloud.olakrutrim.com/basics/core-infrastructure/networking/virtual-private-network.md).
# Virtual Private Network
Virtual Private Network (VPN) establishes a secure, IPsec-encrypted connection between your VPC and an external network — your office, a data center, or another cloud — over the public internet. Each gateway is deployed as an active/standby pair with automatic failover, so the connection remains available even if a node fails.
Setting this up involves three resources, in order: a Gateway on your side, a Customer Gateway recording the identity of the remote side, and a VPN Tunnel connecting the two.
### Key Features
* IPsec-encrypted tunnels — every tunnel is authenticated with a pre-shared key and encrypted end-to-end, so traffic between your VPC and your remote network can't be read or tampered with in transit.
* Active/Standby high availability — every gateway is deployed as a pair of nodes. One is Active and carries traffic; the other is Standby and takes over automatically if the Active node fails, with no manual intervention.
* Automatic failover — a health watchdog on each node continuously checks that the tunnel is actually passing traffic, not just that the VM is running, and fails over the moment it isn't.
* Configurable Dead Peer Detection (DPD) — set how long your gateway waits without a response from your remote peer before it considers the tunnel down and acts on it. Tune this to match how quickly your own network expects to detect an outage.
* Reusable Customer Gateways — the identity of your remote peer (its public IP) is its own resource, independent of any one tunnel. Create it once and reuse it across multiple tunnels without re-entering the same details.
* Live health monitoring — a dashboard shows the real-time status of every gateway and tunnel, including which node is Active, so you don't have to guess whether a connection is actually healthy.
* Multi-region availability — deploy gateways in In-Hyderabad-1 or In-Bangalore-1, in the same region as the VPC you're connecting.
### Gateway
Managed IPsec gateways that terminate VPN tunnels for the selected VPC. Each gateway is deployed as an Active/Standby pair.
Creating a gateway:
1. Open Networking > Virtual Private Network (VPN) in the console and select the Gateway tab.
2. Select Create Gateway, then choose the VPC this gateway will attach to. The gateway is deployed into the same region as the VPC.
3. Your gateway is provisioned at the Standard tier (up to 100 Mbps) — the only tier currently offered, so there's no bandwidth selector to configure.
4. Review and create. This takes a few minutes while both nodes come up and the pairing completes.
Status: a gateway's overall status reflects both of its nodes together — Active means the pair is healthy and traffic is flowing; Degraded means one node is down and the other is carrying traffic alone; you'll also see Creating, Stopped, Deleting, Failed, or Deleted at other points in its lifecycle. Each Active/Standby pair has its own Floating IP, shown separately per role in the gateway list — traffic always arrives on the Active node's Floating IP.
Deleting a Gateway:
1. From the gateway's detail page, select Delete.
2. Confirm the deletion. This tears down both the Active and Standby nodes and every VPN Tunnel still attached to this gateway.
3. This can't be undone — the gateway, its tunnels, and their configuration are gone once deletion completes. Any Customer Gateway used by those tunnels is unaffected and can be reused for a new tunnel later.
### Customer Gateway
A Customer Gateway records the identity — the public IP — of the remote network you're connecting to. It's created once and can be reused across multiple VPN Tunnels, so you don't need to re-enter the same peer details for every connection to the same remote site.
Creating a Customer Gateway:
1. From the Customer Gateway tab, select Create Customer Gateway.
2. Give it a name and enter the remote peer's public IP address.
Deleting a Customer Gateway:
* A Customer Gateway can't be deleted while any VPN Tunnel is still using it. Delete or re-point those tunnels first.
* If you try anyway, you'll see an error telling you the Customer Gateway is still in use.
### VPN Tunnel
A VPN Tunnel is the actual encrypted IPsec connection, linking a Gateway to a Customer Gateway.
Creating a VPN Tunnel:
1. From the VPN Tunnel tab, select Create Tunnel, then choose the Gateway and Customer Gateway it connects.
2. Set the routing and IPsec parameters — these have to match what you configure on your own router or firewall, or the tunnel won't come up:
3. Pre-shared key (PSK) — the shared secret both sides authenticate with. Must be at least 20 characters and include an uppercase letter, a lowercase letter, a digit, and a special character.
4. Peer ID — how your side identifies itself to the remote peer during authentication. Defaults to the Customer Gateway's public IP if you don't set one.
5. Routing (CIDRs) — the Remote CIDR is the address range on the other side of the tunnel that traffic should be routed to; the Local CIDR is the range on your side being exposed. Only Remote CIDR is required.
6. IKE version — IKEv1 or IKEv2.
7. Phase 1 (IKE) parameters — the encryption, integrity, and Diffie-Hellman group used to negotiate the tunnel itself. Defaults to AES-256 / SHA-256 / DH Group 14 if left unset; you can also list multiple algorithms to offer several proposals at once.
8. Phase 2 (ESP) parameters — the encryption, integrity, and optional Perfect Forward Secrecy (PFS) group used for the actual data traffic. Falls back to your Phase 1 settings if unset; PFS can be turned off entirely.
9. Lifetimes — how long a negotiated session is used before it's renegotiated, for both Phase 1 and Phase 2 (ESP defaults to 3600 seconds).
10. Dead Peer Detection (DPD) — off by default. When enabled, set a delay (how often to check — defaults to 30s), a timeout (how long to wait before acting — defaults to 120s), and an action: restart the tunnel, clear it, or hold it open.
11. Supported Diffie-Hellman groups: Group 2 (1024-bit), Group 5 (1536-bit), Group 14 (2048-bit), Group 15 (3072-bit), Group 16 (4096-bit), Group 19 (ECP 256), Group 20 (ECP 384), Group 21 (ECP 521).
Deleting a VPN Tunnel: removes the tunnel and its IPsec configuration from both nodes of its Gateway. The Gateway and Customer Gateway it used are unaffected and remain available for other tunnels.
### Monitoring
The Monitoring tab shows the live, real-time health of your gateways and tunnels — not just the last-known state stored in the console, but a fresh check of what's actually running.
* Gateway health — which node (HA1/HA2) is currently Active vs. Standby, and whether the pairing itself is healthy.
* Tunnel health — whether IPsec is actually up on each tunnel, independent of the gateway's own status.
* On-demand ping checks — test connectivity to a specific node directly from the console.
* Failover history — a record of when and why a gateway's Active/Standby roles last switched.
### Billing and Pricing
VPN is billed postpaid, on three components: how long your gateway is provisioned, its two Floating IPs, and the data your tunnels transmit outbound (TX).
| Tier | IN-Hyderabad | IN-Banglore |
| ------------------------- | ------------------------- | ------------------------- |
| Standard (up to 100 Mbps) | ₹9.00/hour (₹6,570/month) | ₹9.00/hour (₹6,570/month) |
| High Bandwidth | Coming soon | Coming soon |
* Gateway fee — ₹9.00/hour while the gateway is provisioned, regardless of traffic.
* Floating IP fee — ₹0.28/hour per Floating IP. Every gateway has two (one per node), so ₹0.56/hour total.
* Traffic fee — ₹3.00/GB of outbound (TX) data across all of the gateway's tunnels.
Example: a Standard-tier gateway in IN-Hyderabad, active for 1 hour, transmitting 5 GB outbound:
| Component | Calculation | Cost |
| --------------- | ---------------------- | ------ |
| Gateway fee | ₹9.00 × 1 hour | ₹9.00 |
| Floating IP fee | ₹0.28 × 2 IPs × 1 hour | ₹0.56 |
| Traffic fee | ₹3.00 × 5 GB | ₹15.00 |
| Total |
| ₹24.56 |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.cloud.olakrutrim.com/basics/core-infrastructure/networking/virtual-private-network.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.