https://github.com/fivexl/terraform-aws-softether-radius-vpn
Softether based VPN with LDAP/MFA auth via RADIUS
https://github.com/fivexl/terraform-aws-softether-radius-vpn
aws softethervpn terraform terraform-module vpn vpn-server
Last synced: over 1 year ago
JSON representation
Softether based VPN with LDAP/MFA auth via RADIUS
- Host: GitHub
- URL: https://github.com/fivexl/terraform-aws-softether-radius-vpn
- Owner: fivexl
- License: apache-2.0
- Archived: true
- Created: 2020-08-21T10:57:18.000Z (almost 6 years ago)
- Default Branch: master
- Last Pushed: 2021-07-13T15:34:15.000Z (almost 5 years ago)
- Last Synced: 2024-10-24T06:28:50.520Z (over 1 year ago)
- Topics: aws, softethervpn, terraform, terraform-module, vpn, vpn-server
- Language: HCL
- Homepage: https://registry.terraform.io/modules/fivexl/softether-radius-vpn/aws/latest
- Size: 187 KB
- Stars: 6
- Watchers: 2
- Forks: 3
- Open Issues: 5
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
[](https://fivexl.io/)
# AWS Client SRVPN Terraform module
Softether based VPN with LDAP/MFA auth via RADIUS with multi-AZ deployment
```hlc
data "aws_availability_zones" "available" {
state = "available"
}
locals {
project_name = lower("vpn")
vpc_cidr = "10.68.0.0/16" # 10.68.0.1 - 10.68.255.254
vpc_azs_max = 3
vpc_azs_list = slice(data.aws_availability_zones.available.names, 0, tonumber(local.vpc_azs_max))
vpc_public_subnets = ["10.68.32.0/19", "10.68.64.0/19", "10.68.96.0/19"]
}
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "2.70.0"
name = local.project_name
cidr = local.vpc_cidr
azs = local.vpc_azs_list
public_subnets = local.vpc_public_subnets
manage_default_security_group = true
default_security_group_name = "default-${local.project_name}"
default_security_group_ingress = []
default_security_group_egress = []
}
module "softether_radius_vpn" {
source = "fivexl/softether-radius-vpn/aws"
version = "1.0.0"
name = "softether-radius-vpn"
ami_name_prefix = "softether-radius-vpn"
ami_owner = "self"
azs = [module.vpc.azs[0]]
subnets = [module.vpc.public_subnets[0]]
vpc_id = module.vpc.vpc_id
target_cidr = module.vpc.vpc_cidr_block
ldap_addr = "ldaps://ldap.jumpcloud.com:636"
ldap_user_dn = "uid={{username}},ou=users,o=XXXXXXXXXXXXXX,dc=jumpcloud,dc=com"
}
```
## Requirements
| Name | Version |
|------|---------|
| terraform | >= 0.14 |
| aws | >= 3.22.0 |
## Inputs
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| name | The name used for logs group, security groups, iam roles, dns zone and VPN instance. | `string` | `softether-radius-vpn` | no |
| vpc_id | ID of the VPC where to create VPN instance | `string` | | yes |
| subnets | Subnets for VPN servers | `list(string)` | | yes |
| azs | List of AZs where subnets places | `list(string)` | | yes |
| target_cidr | Typical your VPCs CIDR or any another CIDR used for target route | `string` | | yes |
| ldap_addr | Your LDAP Address (e.g. ldaps://ldap.jumpcloud.com:636) | `string` | | yes |
| ldap_user_dn | Your LDAP user DN (e.g.: uid={{username}},ou=users,o=****,dc=jumpcloud,dc=com) | `string` | | yes |
| duo_enabled | Enable 2FA Duo | `bool` | `false` | no |
| duo_ikey | DUO ikey | `string` | `""` | no |
| duo_skey | DUO skey | `string` | `""` | no |
| duo_api_host | DUO API host | `string` | `""` | no |
| duo_time_out | DUO TimeOut (seconds) | `number` | `60` | no |
| instance_type | Type of EC2 instance. We recommend to use t3a.micro | `string` | `"t3a.micro"` | no |
| enable_spot_instance | Use spot instance for all VPN instances | `bool` | `true` | no |
| ami_name_prefix | The name prefix used for search AMI image | `string` | `"softether-radius-vpn"` | no |
| ami_owner | The AMI owner | `string` | `"self"` | no |
| tags | A mapping of tags. | `map(string)` | `{}` | no |
| tags_asg | A list of ASG tags | `list()` | `[]` | no |
| create_logs | Create a group log in CloudWatch | `bool` | `true` | no |
| log_retention_days | How many days need to store logs | `number` | `90` | no |
| create_dns | Create a dns record in Route53 | `bool` | `false` | no |
| dns_zone_name | Name of Public DNS zone where record will be. DNS zone must exist. | `string` | `""` | no |
| dns_a_record_prefix | Prefix for A record in DNS zone | `string` | `"vpn-"` | no |
| enable_azs_in_dns_a_record | Enable AZs in dns A record for VPN or use numbers (from 0). | `bool` | `false` | no |
| private_domain_fqdn | Domain FQDN which will be used to resolve internal names. (e.g.: internal.example.com) | `string` | `""` | no |
| create_private_dns_zone | Create private DNS zone with private_domain_fqnd name and attach to VPC | `bool` | `false` | no |
| custom_ec2_spot_price | Custom EC2 Spot price | `string` | `""` | no |
| key_pair_name | Key pair name for SSH login to VPC instance | `string` | `""` | no |
| enable_detailed_monitoring | If `true`, the launched EC2 instance will have detailed monitoring enabled. | `bool` | `false` | no |
| enable_session_manager_connect | Use Session Manager to connect to EC2 instance | `bool` | `true` | no |
| vpn_cidr | VPN CIDR. .1 - GW | `string` | `"172.16.0.0/24"` | no |
| vpn_dhcp_start | VPN DHCP start cidrhost() hostnum | `number` | `10` | no |
| vpn_dhcp_end | VPN DHCP end cidrhost() hostnum | `number` | `200` | no |
| vpn_admin_port | VPN admin port for connect via MGMT client | `string` | `"5555"` | no |
| enable_dhcp_gw | Enable push Gateway to clients. Route all networks through VPN. | `bool` | `true` | no |
| enable_vpn_admin_external_access | Enable external access to admin MGMT. It used only for maintenance. Only external IP of the operator. | `bool` | `false` | no |
## Outputs
| Name | Description |
|------|-------------|
| this_vpn_dns_fqdn_list | List of FQDN for created VPN instances |
| this_vpn_dns_names_list | List of DNS names for created VPN instances. Useful if DNS zone in separate account. |
| this_vpn_public_ip_list | The Public IPs of created VPN instance |
| this_vpn_ipsec_psk | Pre-shared Key for VPN clients |
| this_vpn_server_password | VPN server admin password |
| this_vpn_push_route | Route for VPN clients if they can't get DHCP Classless Static Routes |
| this_security_group_id | Security Group ID attached to VPN |
## License
Apache 2 Licensed. See LICENSE for full details.
## How build own AMI for SRVPN
- Prepare AWS credentials. Environment variables AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or AWS_PROFILE are supported.
- [Install Hashicorp Packer](https://learn.hashicorp.com/tutorials/packer/getting-started-install?in=packer/getting-started)
- [Build an Image](https://learn.hashicorp.com/tutorials/packer/getting-started-build-image?in=packer/getting-started): run `packer build softether-radius-vpn.json` in `ami/softether-radius-vpn` folder
### Packer variables
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| name | Used for AMI prefix and tags. | `string` | `softether-radius-vpn` | no |
| ami_region | AWS region where AMI will be builds and stored | `string` | `env AWS_DEFAULT_REGION` | yes |
| rserver_version | Version of [RServer](https://github.com/fivexl/golang-radius-server-ldap-with-mfa) | `string` | `v0.0.2` | no |
| softether_vpnserver_version | Version of Softether VPN Server | `string` | `v4.34-9745-beta` | no |
| softether_vpnserver_release_date | Release Date of Softether VPN Server | `string` | `2020.04.05` | no |
## Ubuntu Client Demo setup
- `sudo apt install network-manager-l2tp-gnome -y`
- Settings -> Network -> Add VPN -> Layer 2 Tunneling Protocol (L2TP)
- gateway: tf ${vpn_dns}
- User Auth
- User Name: user in LDAP (e: realuser)
- Password: pass in LDAP
- Enable IPsec tunnel to L2TP host
- Pre-shared key: tf ${vpn_ipsec_psk}
- Phase 1 algos: aes256-sha1-modp2048,aes128-sha1-modp2048
- Phase 2 algos: aes256-sha1,aes128-sha1
- Add routes. Ubuntu default client doesn't support DHCP Classless Static Routes
- Enable "Use this connection only for resources on its network" in case of `enable_dhcp_gw` = `false` or if split routing is required.
Guide with pictures [here](https://help.vpntunnel.com/support/solutions/articles/5000782608-vpntunnel-l2tp-installation-guide-for-ubuntu-18-04-)
## How to Test private DNS zone
- Double check `enableDnsHostnames` and `enableDnsSupport`: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html
- Connect VPN
- Add record to private DNS zone
- Try to resolve: nslookup test-record.private-zone.your-domain.com
## WebGUI
- SoftEther VPN Server HTML5 Ajax-based Web Administration Console (Under construction!)
- Available on `vpn_admin_port` (`5555` by default)
## VPN TODO
- Add DUO support