{"id":13340662,"url":"https://github.com/fivexl/terraform-aws-softether-radius-vpn","last_synced_at":"2025-03-11T18:31:34.705Z","repository":{"id":109422264,"uuid":"289247389","full_name":"fivexl/terraform-aws-softether-radius-vpn","owner":"fivexl","description":"Softether based VPN with LDAP/MFA auth via RADIUS","archived":true,"fork":false,"pushed_at":"2021-07-13T15:34:15.000Z","size":191,"stargazers_count":6,"open_issues_count":5,"forks_count":3,"subscribers_count":2,"default_branch":"master","last_synced_at":"2024-10-24T06:28:50.520Z","etag":null,"topics":["aws","softethervpn","terraform","terraform-module","vpn","vpn-server"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/fivexl/softether-radius-vpn/aws/latest","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fivexl.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-08-21T10:57:18.000Z","updated_at":"2024-05-29T05:02:06.000Z","dependencies_parsed_at":"2023-04-29T15:01:37.310Z","dependency_job_id":null,"html_url":"https://github.com/fivexl/terraform-aws-softether-radius-vpn","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fivexl%2Fterraform-aws-softether-radius-vpn","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fivexl%2Fterraform-aws-softether-radius-vpn/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fivexl%2Fterraform-aws-softether-radius-vpn/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fivexl%2Fterraform-aws-softether-radius-vpn/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fivexl","download_url":"https://codeload.github.com/fivexl/terraform-aws-softether-radius-vpn/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243090401,"owners_count":20234798,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","softethervpn","terraform","terraform-module","vpn","vpn-server"],"created_at":"2024-07-29T19:23:54.584Z","updated_at":"2025-03-11T18:31:34.699Z","avatar_url":"https://github.com/fivexl.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![FivexL](https://releases.fivexl.io/fivexlbannergit.jpg)](https://fivexl.io/)\n\n# AWS Client SRVPN Terraform module\n\nSoftether based VPN with LDAP/MFA auth via RADIUS with multi-AZ deployment\n\n```hlc\ndata \"aws_availability_zones\" \"available\" {\n  state = \"available\"\n}\n\nlocals {\n  project_name       = lower(\"vpn\")\n  vpc_cidr           = \"10.68.0.0/16\" # 10.68.0.1 - 10.68.255.254\n  vpc_azs_max        = 3\n  vpc_azs_list       = slice(data.aws_availability_zones.available.names, 0, tonumber(local.vpc_azs_max))\n  vpc_public_subnets = [\"10.68.32.0/19\", \"10.68.64.0/19\", \"10.68.96.0/19\"]\n}\n\nmodule \"vpc\" {\n  source                         = \"terraform-aws-modules/vpc/aws\"\n  version                        = \"2.70.0\"\n  name                           = local.project_name\n  cidr                           = local.vpc_cidr\n  azs                            = local.vpc_azs_list\n  public_subnets                 = local.vpc_public_subnets\n  manage_default_security_group  = true\n  default_security_group_name    = \"default-${local.project_name}\"\n  default_security_group_ingress = []\n  default_security_group_egress  = []\n}\n\nmodule \"softether_radius_vpn\" {\n  source          = \"fivexl/softether-radius-vpn/aws\"\n  version         = \"1.0.0\"\n  name            = \"softether-radius-vpn\"\n  ami_name_prefix = \"softether-radius-vpn\"\n  ami_owner       = \"self\"\n  azs             = [module.vpc.azs[0]]\n  subnets         = [module.vpc.public_subnets[0]]\n  vpc_id          = module.vpc.vpc_id\n  target_cidr     = module.vpc.vpc_cidr_block\n  ldap_addr       = \"ldaps://ldap.jumpcloud.com:636\"\n  ldap_user_dn    = \"uid={{username}},ou=users,o=XXXXXXXXXXXXXX,dc=jumpcloud,dc=com\"\n}\n```\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| terraform | \u003e= 0.14 |\n| aws | \u003e= 3.22.0 |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| name | The name used for logs group, security groups, iam roles, dns zone and VPN instance. | `string` | `softether-radius-vpn` | no |\n| vpc_id | ID of the VPC where to create VPN instance | `string` |  | yes |\n| subnets | Subnets for VPN servers | `list(string)` |  | yes |\n| azs | List of AZs where subnets places | `list(string)` |  | yes |\n| target_cidr | Typical your VPCs CIDR or any another CIDR used for target route | `string` | | yes |\n| ldap_addr | Your LDAP Address (e.g. ldaps://ldap.jumpcloud.com:636) | `string` | | yes |\n| ldap_user_dn | Your LDAP user DN (e.g.: uid={{username}},ou=users,o=****,dc=jumpcloud,dc=com) | `string` | | yes |\n| duo_enabled | Enable 2FA Duo | `bool` | `false` | no |\n| duo_ikey | DUO ikey | `string` | `\"\"` | no |\n| duo_skey | DUO skey | `string` | `\"\"` | no |\n| duo_api_host | DUO API host | `string` | `\"\"` | no |\n| duo_time_out | DUO TimeOut (seconds) | `number` | `60` | no |\n| instance_type | Type of EC2 instance. We recommend to use t3a.micro | `string` | `\"t3a.micro\"` | no |\n| enable_spot_instance | Use spot instance for all VPN instances | `bool` | `true` | no |\n| ami_name_prefix | The name prefix used for search AMI image | `string` | `\"softether-radius-vpn\"` | no |\n| ami_owner | The AMI owner | `string` | `\"self\"` | no |\n| tags | A mapping of tags. | `map(string)` | `{}` | no |\n| tags_asg | A list of ASG tags | `list()` | `[]` | no |\n| create_logs | Create a group log in CloudWatch | `bool` | `true` | no |\n| log_retention_days | How many days need to store logs | `number` | `90` | no |\n| create_dns | Create a dns record in Route53 | `bool` | `false` | no |\n| dns_zone_name | Name of Public DNS zone where record will be. DNS zone must exist. | `string` | `\"\"` | no |\n| dns_a_record_prefix | Prefix for A record in DNS zone | `string` | `\"vpn-\"` | no | \n| enable_azs_in_dns_a_record | Enable AZs in dns A record for VPN or use numbers (from 0). | `bool` | `false` | no |\n| private_domain_fqdn | Domain FQDN which will be used to resolve internal names. (e.g.: internal.example.com) | `string` | `\"\"` | no |\n| create_private_dns_zone | Create private DNS zone with private_domain_fqnd name and attach to VPC | `bool` | `false` | no |\n| custom_ec2_spot_price | Custom EC2 Spot price | `string` | `\"\"` | no |\n| key_pair_name | Key pair name for SSH login to VPC instance | `string` | `\"\"` | no |\n| enable_detailed_monitoring | If `true`, the launched EC2 instance will have detailed monitoring enabled. | `bool` | `false` | no |\n| enable_session_manager_connect | Use Session Manager to connect to EC2 instance | `bool` | `true` | no |\n| vpn_cidr | VPN CIDR. .1 - GW | `string` | `\"172.16.0.0/24\"` | no |\n| vpn_dhcp_start | VPN DHCP start cidrhost() hostnum | `number` | `10` | no |\n| vpn_dhcp_end | VPN DHCP end cidrhost() hostnum | `number` | `200` | no |\n| vpn_admin_port | VPN admin port for connect via MGMT client | `string` | `\"5555\"` | no |\n| enable_dhcp_gw | Enable push Gateway to clients. Route all networks through VPN. | `bool` | `true` | no |\n| enable_vpn_admin_external_access | Enable external access to admin MGMT. It used only for maintenance. Only external IP of the operator. | `bool` | `false` | no |\n\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| this_vpn_dns_fqdn_list | List of FQDN for created VPN instances |\n| this_vpn_dns_names_list | List of DNS names for created VPN instances. Useful if DNS zone in separate account. |\n| this_vpn_public_ip_list | The Public IPs of created VPN instance |\n| this_vpn_ipsec_psk | Pre-shared Key for VPN clients |\n| this_vpn_server_password | VPN server admin password |\n| this_vpn_push_route | Route for VPN clients if they can't get DHCP Classless Static Routes |\n| this_security_group_id | Security Group ID attached to VPN  |\n\n## License\n\nApache 2 Licensed. See LICENSE for full details.\n\n## How build own AMI for SRVPN\n- Prepare AWS credentials. Environment variables AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or AWS_PROFILE are supported.\n- [Install Hashicorp Packer](https://learn.hashicorp.com/tutorials/packer/getting-started-install?in=packer/getting-started)\n- [Build an Image](https://learn.hashicorp.com/tutorials/packer/getting-started-build-image?in=packer/getting-started): run `packer build softether-radius-vpn.json` in `ami/softether-radius-vpn` folder\n\n### Packer variables\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| name | Used for AMI prefix and tags. | `string` | `softether-radius-vpn` | no |\n| ami_region | AWS region where AMI will be builds and stored  | `string` | `env AWS_DEFAULT_REGION` | yes |\n| rserver_version | Version of [RServer](https://github.com/fivexl/golang-radius-server-ldap-with-mfa) | `string` | `v0.0.2` | no |\n| softether_vpnserver_version | Version of Softether VPN Server | `string` | `v4.34-9745-beta` | no |\n| softether_vpnserver_release_date | Release Date of Softether VPN Server | `string` | `2020.04.05` | no |\n\n## Ubuntu Client Demo setup\n- `sudo apt install network-manager-l2tp-gnome -y`\n- Settings -\u003e Network -\u003e Add VPN -\u003e Layer 2 Tunneling Protocol (L2TP)\n- gateway: tf ${vpn_dns}\n- User Auth\n  - User Name: user in LDAP (e: realuser)\n  - Password: pass in LDAP\n- Enable IPsec tunnel to L2TP host\n- Pre-shared key: tf ${vpn_ipsec_psk}\n- Phase 1 algos: aes256-sha1-modp2048,aes128-sha1-modp2048\n- Phase 2 algos: aes256-sha1,aes128-sha1\n- Add routes. Ubuntu default client doesn't support DHCP Classless Static Routes\n- Enable \"Use this connection only for resources on its network\" in case of `enable_dhcp_gw` = `false` or if split routing is required. \n\nGuide with pictures [here](https://help.vpntunnel.com/support/solutions/articles/5000782608-vpntunnel-l2tp-installation-guide-for-ubuntu-18-04-)\n\n## How to Test private DNS zone\n- Double check `enableDnsHostnames` and `enableDnsSupport`: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html\n- Connect VPN\n- Add record to private DNS zone\n- Try to resolve: nslookup test-record.private-zone.your-domain.com\n\n## WebGUI\n- SoftEther VPN Server HTML5 Ajax-based Web Administration Console (Under construction!)\n- Available on `vpn_admin_port` (`5555` by default)\n\n\n## VPN TODO\n- Add DUO support\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffivexl%2Fterraform-aws-softether-radius-vpn","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffivexl%2Fterraform-aws-softether-radius-vpn","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffivexl%2Fterraform-aws-softether-radius-vpn/lists"}