A Site-to-Site VPN with Modern Crypto, BGP, and a Connection
A connection with no ipsec_policy negotiates from a built-in list that still offers 1024-bit Diffie-Hellman and SHA-1, so a peer that proposes them gets them and the tunnel comes up looking healthy. Always writes an explicit policy and refuses the weak groups. A gateway with no connection bills by the hour for nothing, so the sites come with the gateway; BGP is on, Basic is refused.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "vpn_gateway" {
source = "www.iac-bazaar.com/iac-bazaar/azure-vpn-gateway/azure"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads static-verified because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/azure-vpn-gateway?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, static-verified on IaC Bazaar: [A Site-to-Site VPN with Modern Crypto, BGP, and a Connection](https://www.iac-bazaar.com/catalog/azure-vpn-gateway?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "vpn_gateway" {
source = "www.iac-bazaar.com/iac-bazaar/azure-vpn-gateway/azure"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
azure-vpn-gateway
A site-to-site VPN gateway with modern cryptography, BGP, and a connection.
Works with Terraform and OpenTofu (>= 1.6), azurerm provider
>= 4.0, < 5.0.
Azure's default proposal set still offers DH group 2 and SHA-1. A
connection with no ipsec_policy negotiates from Azure's built-in list,
which for compatibility includes 1024-bit Diffie-Hellman and SHA-1, so a peer
that proposes them gets them and the tunnel comes up looking healthy. This
module always writes an explicit policy - AES-256-GCM, SHA-384, DH group 14
and ECP384 by default - and a validation refuses the weak groups outright.
IKEv2 is pinned.
A gateway with no connection is a public IP that bills by the hour. The
gateway takes 30-45 minutes to build; the connections and local network
gateways are separate resources. This module takes the sites with the
gateway and refuses one with none unless accept_no_connections.
Static routes go stale; BGP does not. Without BGP the site's address
space is a list typed into the local network gateway. BGP is on by default;
static needs accept_static_routing.
The SKU decides throughput, and whether there is an SLA. Basic is refused
outright; a non-AZ SKU needs accept_single_zone. Active-active is on by
default because a single instance reboots for maintenance.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
azure-virtual-wan
A hub is billed from the moment it exists and routes nothing until something connects; disable_vpn_encryption sends branch traffic in clear; and a VNet connection without internet security sends 0.0.0.0/0 out its own default route, bypassing the hub firewall. Connections come with it, branch encryption stays on, every connection routes the internet through the hub, and the prefix must be a /23.
azure-expressroute
A provider circuit is a clear-text path across the provider's network - MACsec is for Direct ports only, and IPsec over the private peering is yours to build - so the module requires that to be stated and exports encrypted = false. The SKU tier decides where the circuit reaches; a circuit with no peering carries nothing once provisioned. Private peering with its /30 pairs and VLAN is created here.
azure-private-endpoint
An Azure Private Endpoint giving a target PaaS resource a private IP inside your VNet so traffic stays on the Microsoft backbone - wire to existing subnet/target or run fully self-contained.
azure-vnet
Production VNet with subnets, NSGs, route tables, peering and optional NAT Gateway - the network backbone every Azure deployment starts with.
azure-vnet-peering
Both halves of a hub-and-spoke VNet peering in one apply, since one half alone sits in Initiated and carries nothing. hub_has_gateway writes allow_gateway_transit on the hub and use_remote_gateways on the spoke, in the order Azure requires; forwarded traffic is on for both halves because a hub firewall forwards by definition. One subscription; both directions bill per gigabyte.
azure-nat-gateway
Default outbound access is retired, so a subnet with no NAT gateway has no internet at all and fails as a timeout rather than an error. Each public IP gives 64,512 SNAT ports held for the whole idle timeout; exceed that and connections fail intermittently in a way that looks like the remote service being flaky.