Create a site-to-site VPN connection (async — the row is returned at once)

​

Returns 202 with the jobId and the connection, already inserted at creating. The connection reaches the whole VPC — the parameter sheet lists the local networks to name on the peer — and the VPC needs a subnet before it can take one. A VPC holds up to a per-VPC maximum of connections (four by default), one per peer address. Every parameter left out takes its documented default. Groups 2 and 5 are offered for compatibility with older peers and are weak; 14 is the default. One proposal per connection; tunnel mode and ESP are fixed, as is the tunnel MTU of 1400. The creation adds one inbound rule allowing each peer network to every security group bound to a subnet of the VPC at that moment; a subnet created later carries them only if its group does.

Path Parameters

  • id
    Type: stringFormat: uuid
    required

    Resource ID (UUID)

Body

required
application/json
  • name
    Type: string
    max length:  
    63
    required

    Letters, numbers, spaces, periods and hyphens, beginning and ending with a letter or number. Surrounding whitespace is trimmed first; the pattern and the length apply to what remains.

  • peerAddress
    Type: stringFormat: ipv4
    required

    The public IPv4 address of the customer's IPsec peer. An address in 0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4 or 240.0.0.0/4 is refused.

  • peerCidrs
    Type: array of string 1…10
    required

    The networks behind the peer, IPv4 CIDRs with a prefix of /8 to /32. Host bits are accepted and rewritten to the network address (192.168.10.7/24 is stored and returned as 192.168.10.0/24). They may not overlap each other, the VPC's own range, or the networks of another connection on the VPC.

  • psk
    Type: string
    min length:  
    16
    max length:  
    64    Format: password
    write-only
    required

    The pre-shared key: 16 to 64 printable ASCII characters with no spaces, double quotes or backslashes. Stored encrypted and never returned.

  • description
    Type: string
    max length:  
    500

    Surrounding whitespace is trimmed before the length applies.

  • dhGroup
    Type: 2 or 5 or 14enum

    The IKE Diffie-Hellman group. 2 and 5 are weak.

  • dpd
    Type: boolean

    Dead-peer detection. On, the peer is probed every 30 seconds and the connection restarted after 120 seconds without an answer.

  • encryption
    Type: "aes128" or "aes192" or "aes256"enum
  • ikeLifetimeSeconds
    Type: integer
    min:  
    60
    max:  
    86400
    multiple of:  
    60

    Integer numbers.

  • ikeVersion
    Type: "v1" or "v2"enum
  • integrity
    Type: "sha256" or "sha384" or "sha512"enum
  • ipsecLifetimeSeconds
    Type: integer
    min:  
    60
    max:  
    86400
    multiple of:  
    60

    Integer numbers.

Responses

  • application/json
  • 400

    A peer network overlaps another in the same request (Peer networks <a> and <b> overlap each other.), the VPC's own range (Peer network <cidr> overlaps the VPC's own range <vpcCidr>.), or, where the VPC's VPN gateway is of the appliance kind, a platform management network (Peer network <cidr> overlaps the platform's management network <source>.).

  • application/json
  • 403

    Missing permission, or the vpn or vpc feature is not enabled for the entity. The vpn feature gates create, update and reset; list, detail and delete need the vpc feature alone.

  • application/json
  • application/json
  • 422

    Validation failure — an unknown key, a missing required field, or a value outside its rule

  • application/json
Request Example for post/resource/vpcs/{id}/vpn-connections
curl https://api.gpcn.com/v1/resource/vpcs/123e4567-e89b-12d3-a456-426614174000/vpn-connections \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: YOUR_SECRET_TOKEN' \
  --data '{
  "name": "",
  "description": "",
  "peerAddress": "203.0.113.10",
  "peerCidrs": [
    "192.168.10.0/24"
  ],
  "psk": "",
  "ikeVersion": "v2",
  "encryption": "aes256",
  "integrity": "sha256",
  "dhGroup": 14,
  "pfsGroup": 14,
  "ikeLifetimeSeconds": 28800,
  "ipsecLifetimeSeconds": 3600,
  "dpd": true
}'

{
  "success": true,
  "data": {
    "jobId": "123e4567-e89b-12d3-a456-426614174000",
    "vpnConnection": {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "name": "string",
      "description": "string",
      "state": "creating",
      "providerState": "string",
      "failureReason": "string",
      "gatewayKind": "router",
      "localEndpointAddress": "string",
      "peerAddress": "203.0.113.10",
      "peerCidrs": [
        "192.168.10.0/24"
      ],
      "ikeVersion": "v1",
      "encryption": "aes128",
      "integrity": "sha256",
      "dhGroup": 14,
      "pfsGroup": 14,
      "ikeLifetimeSeconds": 28800,
      "ipsecLifetimeSeconds": 3600,
      "dpd": true,
      "desiredApplied": true,
      "activeJobId": "123e4567-e89b-12d3-a456-426614174000",
      "acceptedVerbs": [
        "update"
      ],
      "createdAt": "2026-10-21T16:19:07.197Z",
      "updatedAt": "2026-10-21T16:19:07.197Z"
    }
  }
}

Accepted — the row exists and its creation was dispatched

Previous
List a VPC's site-to-site VPN connections
Next
Get a site-to-site VPN connection and its parameter sheet