aws_clientvpn

KO | EN

gitlite — search

#javascript #ai #typescript #llm #golang #rust #deep-learning #nodejs #windows #awesome #cli #security #mcp #ios

(★ 10)

No description available.

aws_clientvpn Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# 🔐 AWS Client VPN - Agnostic Deployment Solution

A complete, ready-to-deploy AWS Client VPN solution that can be used in any AWS account with minimal configuration. This solution provides secure remote access to VPC resources using mutual certificate authentication.

## 🚀 Features

- **🏗️ Complete Infrastructure as Code**: CloudFormation template with all necessary resources
- **🔐 Automated Certificate Management**: Easy-RSA integration for PKI generation
- **📋 Ready-to-Use Client Configurations**: Complete .ovpn files with embedded certificates
- **📖 Comprehensive Documentation**: User guides, admin guides, and troubleshooting
- **🛡️ Security Best Practices**: Mutual authentication, disabled self-service portal
- **🧹 Automated Cleanup**: Complete removal including certificates and local files
- **🔧 Highly Configurable**: Customizable for any environment and use case

## 📁 Project Structure

```
clientvpn_solution/
├── templates/
│   └── client-vpn.yml          # CloudFormation template
├── scripts/
│   ├── deploy-client-vpn.sh    # Main deployment script
│   └── generate-documentation.sh # Documentation generator
├── docs/
│   ├── PREREQUISITES.md        # Prerequisites and setup
│   ├── DEPLOYMENT-GUIDE.md     # Detailed deployment guide
│   └── TROUBLESHOOTING.md      # Common issues and solutions
├── tools/                      # Additional utilities
└── README.md                   # This file
```

## ⚡ Quick Start

### 1. Prerequisites

- AWS CLI installed and configured
- Easy-RSA installed (for certificate generation)
- Appropriate AWS permissions (VPC, EC2, ACM, CloudFormation, CloudWatch)

```bash
# macOS
brew install awscli easy-rsa

# Ubuntu/Debian
apt-get install awscli easy-rsa

# Or download Easy-RSA from: https://github.com/OpenVPN/easy-rsa
```

### 2. Deploy Client VPN

```bash
# Clone or download this solution
cd clientvpn_solution

# Deploy with your parameters
./scripts/deploy-client-vpn.sh \
    --stack-name "my-client-vpn" \
    --region "us-east-1" \
    --vpc-id "vpc-12345678" \
    --subnet-id "subnet-87654321" \
    --vpc-cidr "172.27.64.0/20"
```

### 3. Distribute Client Configuration

After deployment, you'll find:
- `client-configs/my-client-vpn/client-vpn-my-client-vpn.ovpn` - Ready-to-use VPN configuration
- `client-configs/my-client-vpn/USER-INSTRUCTIONS.md` - User setup guide
- `client-configs/my-client-vpn/ADMIN-GUIDE.md` - Administrator guide

## 📋 Deployment Options

### Basic Deployment
```bash
./scripts/deploy-client-vpn.sh \
    --stack-name "basic-vpn" \
    --region "us-east-1" \
    --vpc-id "vpc-12345678" \
    --subnet-id "subnet-87654321" \
    --vpc-cidr "172.27.64.0/20"
```

### Advanced Deployment
```bash
./scripts/deploy-client-vpn.sh \
    --stack-name "advanced-vpn" \
    --region "us-west-2" \
    --profile "production" \
    --vpc-id "vpc-abcdef12" \
    --subnet-id "subnet-12abcdef" \
    --vpc-cidr "10.0.0.0/16" \
    --client-cidr "192.168.100.0/24" \
    --environment "prod" \
    --project "secure-access" \
    --owner "security-team"
```

### Using Existing Certificates
```bash
./scripts/deploy-client-vpn.sh \
    --stack-name "existing-certs-vpn" \
    --region "us-east-1" \
    --vpc-id "vpc-12345678" \
    --subnet-id "subnet-87654321" \
    --vpc-cidr "172.27.64.0/20" \
    --skip-certificates
```

## 🗑️ Removal

```bash
# Remove everything (stack, certificates, local files)
./scripts/deploy-client-vpn.sh \
    --stack-name "my-client-vpn" \
    --region "us-east-1" \
    --action remove

# Force removal without confirmation
./scripts/deploy-client-vpn.sh \
    --stack-name "my-client-vpn" \
    --region "us-east-1" \
    --action remove \
    --force-delete
```

## 🔧 Configuration Parameters

| Parameter | Required | Default | Description |
|-----------|----------|---------|-------------|
| `--stack-name` | ✅ | - | CloudFormation stack name |
| `--region` | ✅ | - | AWS region |
| `--vpc-id` | ✅ | - | VPC ID for deployment |
| `--subnet-id` | ✅ | - | Subnet ID (private recommended) |
| `--vpc-cidr` | ✅ | - | VPC CIDR block |
| `--profile` | ❌ | default | AWS CLI profile |
| `--client-cidr` | ❌ | 10.100.0.0/22 | Client IP range |
| `--environment` | ❌ | dev | Environment name |
| `--project` | ❌ | client-vpn | Project name |
| `--owner` | ❌ | infrastructure-team | Owner/team |
| `--action` | ❌ | deploy | Action (deploy/remove) |
| `--skip-certificates` | ❌ | false | Skip certificate generation |
| `--force-delete` | ❌ | false | Force deletion without confirmation |

## 🛡️ Security Features

- **Mutual Certificate Authentication**: Both server and client certificates required
- **Self-Service Portal Disabled**: Prevents unauthorized configuration downloads
- **Split Tunneling**: Only VPC traffic routed through VPN
- **CloudWatch Logging**: Connection and activity monitoring
- **Security Groups**: Controlled access to VPC resources
- **Certificate Management**: Automated PKI with Easy-RSA

## 📊 What Gets Created

### AWS Resources
- **Client VPN Endpoint**: The main VPN service
- **Security Group**: Controls VPN client access
- **CloudWatch Log Group**: Connection logging
- **Network Association**: Links VPN to subnet
- **Authorization Rules**: Defines access permissions
- **Route Tables**: Directs traffic appropriately

### Certificates (ACM)
- **Server Certificate**: Authenticates VPN endpoint
- **Client Certificate**: Authenticates VPN clients
- **Certificate Authority**: Root CA for PKI chain

### Local Files
- **PKI Directory**: Certificate authority and certificates
- **Client Configurations**: Ready-to-distribute .ovpn files
- **Documentation**: User and admin guides

## 💰 Cost Considerations

- **VPN Endpoint**: ~$0.10/hour when active
- **Data Transfer**: ~$0.05/GB (varies by region)
- **CloudWatch Logs**: ~$0.50/GB ingested + storage
- **ACM Certificates**: Free for AWS services

**Estimated monthly cost for light usage**: $75-150/month

## 🔍 Monitoring and Logging

### CloudWatch Metrics
- Connection attempts and success rates
- Data transfer volumes
- Active connections
- Authentication failures

### Log Analysis
```bash
# View recent connections
aws logs filter-log-events \
    --log-group-name "/aws/clientvpn/my-client-vpn" \
    --start-time $(date -d '1 hour ago' +%s)000

# Search for failed authentications
aws logs filter-log-events \
    --log-group-name "/aws/clientvpn/my-client-vpn" \
    --filter-pattern "authentication-failure"
```

## 🆘 Support and Troubleshooting

### Common Issues
1. **Certificate Generation Fails**: Ensure Easy-RSA is installed
2. **Deployment Fails**: Check AWS permissions and VPC configuration
3. **Connection Issues**: Verify security groups and network ACLs
4. **Access Denied**: Check authorization rules and routes
5. **SSH/Private Resource Access Fails**: When Client VPN route type is "Nat", traffic appears to come from the **associated subnet CIDR**, not the VPN client CIDR. Security groups must allow the subnet CIDR range - see [Deployment Guide](docs/DEPLOYMENT-GUIDE.md#ssh-private-resource-access-issues-nat-behavior)

### Getting Help
1. Check the generated `ADMIN-GUIDE.md` for detailed troubleshooting
2. Review CloudWatch logs for connection issues
3. Validate AWS permissions and resource limits
4. Ensure VPC and subnet configuration is correct

## 📚 Additional Documentation

- [Prerequisites and Setup](docs/PREREQUISITES.md)
- [Detailed Deployment Guide](docs/DEPLOYMENT-GUIDE.md)
- [Troubleshooting Guide](docs/TROUBLESHOOTING.md)

## 🤝 Contributing

This solution is designed to be self-contained and agnostic. If you have improvements or bug fixes:

1. Test thoroughly in your environment
2. Ensure backward compatibility
3. Update documentation accordingly
4. Consider security implications

## 📄 License

This solution is provided as-is for educational and operational use. Please review and test thoroughly before production deployment.

---

**🚀 Ready to deploy secure remote access to your AWS VPC!**

aws_clientvpn

aws_clientvpn Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

aws_clientvpn

aws_clientvpn Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README