VPNサーバを建てるためのCloudFormation。詳細: https://itib.hatenablog.com/entry/2024/08/10/140000

aws-vpn.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Sample CloudFormation'

Parameters:
  Prefix:
    Type: String
    Default: "aws-vpn"
  VpcCidr:
    Type: String
    Default: "10.111.0.0/16"
  PublicSubnetCidr:
    Type: String
    Default: "10.111.1.0/24"
  MyHomeIp:
    Type: String
    Description: "My Home IP Address. This VPN will allow access only this IP address."

  SoftEtherAdminPassword:
    Type: String
    NoEcho: true
    Description: "SoftEther VPN Server Admin Password. If you want to change VPN settings, you will use this password."
  SoftEtherHubName:
    Type: String
    Default: "aws-vpn-hub"
    Description: "VPN hub name."
  SoftEtherHubPassword:
    Type: String
    NoEcho: true
    Description: "VPN hub password. This parameter will uses to setup VPN connection."

  VPNPreSharedKey:
    Type: String
    Default: "aws-vpn-psk"
    Description: "VPN PreSharedKey. This parameter will uses to setup VPN connection."
  VPNUserName:
    Type: String
    Description: "VPN User Name."
  VPNUserPassword:
    Type: String
    NoEcho: true
    Description: "VPN User Password."

Resources:
  VPC:
    Type: "AWS::EC2::VPC"
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub "${Prefix}-vpc"
        - Key: Service
          Value: !Sub "${Prefix}"

  InternetGateway:
    Type: "AWS::EC2::InternetGateway"
    Properties:
      Tags:
        - Key: Name
          Value: !Sub "${Prefix}-igw"
        - Key: Service
          Value: !Sub "${Prefix}"

  VPCGatewayAttachment:
    Type: "AWS::EC2::VPCGatewayAttachment"
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  RouteTablePublic:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub "${Prefix}-rt-public"
        - Key: Service
          Value: !Sub "${Prefix}"

  RoutePublicToInternet:
    Type: "AWS::EC2::Route"
    Properties:
      RouteTableId: !Ref RouteTablePublic
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  SubnetPublic:
    Type: "AWS::EC2::Subnet"
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref PublicSubnetCidr
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      Tags:
        - Key: Name
          Value: !Sub "${Prefix}-subnet-public"
        - Key: Service
          Value: !Sub "${Prefix}"

  SubnetRouteTableAssociationPublic:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      SubnetId: !Ref SubnetPublic
      RouteTableId: !Ref RouteTablePublic

  SecurityGroupPublic:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupDescription: "Public Security Group"
      VpcId: !Ref VPC
      SecurityGroupIngress:
        # - Description: "Allow SSH from MyHomeIp"
        #   IpProtocol: "TCP"
        #   FromPort: 22
        #   ToPort: 22
        #   CidrIp: !Sub "${MyHomeIp}/32"
        - Description: "Allow VPN from MyHomeIp"
          IpProtocol: "UDP"
          FromPort: 4500
          ToPort: 4500
          CidrIp: !Sub "${MyHomeIp}/32"
        - Description: "Allow VPN from MyHomeIp"
          IpProtocol: "UDP"
          FromPort: 500
          ToPort: 500
          CidrIp: !Sub "${MyHomeIp}/32"
      SecurityGroupEgress:
        - CidrIp: "0.0.0.0/0"
          IpProtocol: "-1"
      Tags:
        - Key: Name
          Value: !Sub "${Prefix}-sg-public"
        - Key: Service
          Value: !Sub "${Prefix}"

  EIP:
    Type: "AWS::EC2::EIP"
    Properties:
      Domain: "vpc"
      Tags:
        - Key: Name
          Value: !Sub "${Prefix}-eip"
        - Key: Service
          Value: !Sub "${Prefix}"

  # This key will save to AWS Systems Manager Parameter Store as '/ec2/keypair/key-0xxxxxx'
  # https://us-east-1.console.aws.amazon.com/systems-manager/parameters/
  KeyPair:
    Type: "AWS::EC2::KeyPair"
    Properties:
      KeyName: !Sub "${Prefix}-key"
      KeyType: "ed25519"

  EC2LaunchTemplate:
    Type: "AWS::EC2::LaunchTemplate"
    Properties:
      LaunchTemplateName: !Sub "${Prefix}-lt"
      LaunchTemplateData:
        ImageId: "ami-0b72821e2f351e396" # Amazon Linux 2023 AMI (64bit x81)
        InstanceType: "t2.micro"
        KeyName: !Ref KeyPair
        SecurityGroupIds:
          - !GetAtt SecurityGroupPublic.GroupId
        UserData:
          'Fn::Base64': !Sub |
            #!/bin/bash -x
            # Install the files and packages from the metadata
            /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource EC2LaunchTemplate --region ${AWS::Region}

            # Signal the status from cfn-init
            /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource EC2LaunchTemplate --region ${AWS::Region}
        TagSpecifications:
          - ResourceType: instance
            Tags:
              - Key: Name
                Value: !Sub "${Prefix}-ec2"
              - Key: Service
                Value: !Sub "${Prefix}"
          - ResourceType: volume
            Tags:
              - Key: Name
                Value: !Sub "${Prefix}-volume"
              - Key: Service
                Value: !Sub "${Prefix}"
        BlockDeviceMappings:
          - DeviceName: "/dev/xvda"
            Ebs:
              VolumeSize: 8
              VolumeType: "gp3"
              DeleteOnTermination: true
    Metadata:
      "AWS::CloudFormation::Init":
        configSets:
          default:
            - install
            - setup
        install:
          # Install SoftEther VPN Server
          # ref. https://ja.softether.org/4-docs/1-manual/7/7.3
          packages:
            yum:
              gcc: []
          sources:
            "/usr/local/": "https://jp.softether-download.com/files/softether/v4.43-9799-beta-2023.08.31-tree/Linux/SoftEther_VPN_Server/64bit_-_Intel_x64_or_AMD64/softether-vpnserver-v4.43-9799-beta-2023.08.31-linux-x64-64bit.tar.gz"
          files:
            "/opt/vpnserver.sh":
              content: |
                #!/bin/sh
                # chkconfig: 2345 99 01
                # description: SoftEther VPN Server
                DAEMON=/usr/local/vpnserver/vpnserver
                LOCK=/var/lock/subsys/vpnserver
                test -x $DAEMON || exit 0
                case "$1" in
                start)
                $DAEMON start
                touch $LOCK
                ;;
                stop)
                $DAEMON stop
                rm $LOCK
                ;;
                restart)
                $DAEMON stop
                sleep 3
                $DAEMON start
                ;;
                *)
                echo "Usage: $0 {start|stop|restart}"
                exit 1
                esac
                exit 0
              mode: "000755"
              owner: root
              group: root
            "/etc/systemd/system/vpnserver.service":
              content: |
                [Unit]
                Description = vpnserver daemon

                [Service]
                ExecStart = /opt/vpnserver.sh start
                ExecStop = /opt/vpnserver.sh stop
                ExecReload = /opt/vpnserver.sh restart
                Restart = always
                Type = forking

                [Install]
                WantedBy = multi-user.target
              mode: "000644"
              owner: root
              group: root
          commands:
            01_make:
              command: "make"
              cwd: "/usr/local/vpnserver"
            02_chmod:
              command: "chmod 600 * && chmod 700 vpncmd && chmod 700 vpnserver && chown root:root *"
              cwd: "/usr/local/vpnserver"
          services:
            sysvinit:
              vpnserver:
                enabled: true
                ensureRunning: true
        setup:
          commands:
            03_wait_vpnserver:
              command: "while ! (echo > /dev/tcp/localhost/443) >/dev/null 2>&1; do sleep 10; done"
            04_admin_password:
              command: "./vpncmd localhost /SERVER /CMD ServerPasswordSet $SAPassword"
              cwd: "/usr/local/vpnserver"
              env:
                "SAPassword": !Ref SoftEtherAdminPassword
            05_hub:
              command: "./vpncmd localhost /SERVER /PASSWORD:$SAPassword /CMD HubCreate $SEHubName /PASSWORD:$SEHubPassword"
              cwd: "/usr/local/vpnserver"
              env:
                "SAPassword": !Ref SoftEtherAdminPassword
                "SEHubName": !Ref SoftEtherHubName
                "SEHubPassword": !Ref SoftEtherHubPassword
            06_hub_delete_default_hub:
              command: "./vpncmd localhost /SERVER /PASSWORD:$SAPassword /CMD HubDelete DEFAULT"
              cwd: "/usr/local/vpnserver"
              env:
                "SAPassword": !Ref SoftEtherAdminPassword
            07_psk:
              command: "./vpncmd localhost /SERVER /PASSWORD:$SAPassword /CMD IPsecEnable /L2TP:yes /L2TPRAW:no /ETHERIP:no /DEFAULTHUB:$SEHubName /PSK:$VPNPSK"
              cwd: "/usr/local/vpnserver"
              env:
                "SAPassword": !Ref SoftEtherAdminPassword
                "SEHubName": !Ref SoftEtherHubName
                "VPNPSK": !Ref VPNPreSharedKey
            08_enable_securenat:
              command: "./vpncmd localhost /SERVER /PASSWORD:$SEHubPassword /HUB:$SEHubName /CMD SecureNatEnable"
              cwd: "/usr/local/vpnserver"
              env:
                "SEHubName": !Ref SoftEtherHubName
                "SEHubPassword": !Ref SoftEtherHubPassword
            09_dhcpset:
              command: "./vpncmd localhost /SERVER /PASSWORD:$SEHubPassword /HUB:$SEHubName /CMD Dhcpset /Start:192.168.30.10 /End:192.168.30.200 /Mask:255.255.255.0 /Expire:7200 /GW:192.168.30.1 /DNS:192.168.30.1 /DNS2:none /Domain:none /Log:yes /PushRoute:$VPCIP/255.255.0.0/192.168.30.1"
              cwd: "/usr/local/vpnserver"
              env:
                "SEHubName": !Ref SoftEtherHubName
                "SEHubPassword": !Ref SoftEtherHubPassword
                "VPCIP": !Select [0, !Split ["/", !Ref VpcCidr]]
            10_user:
              command: "./vpncmd localhost /SERVER /PASSWORD:$SEHubPassword /HUB:$SEHubName /CMD UserCreate $VPNUName /GROUP:none /REALNAME:none /NOTE:none"
              cwd: "/usr/local/vpnserver"
              env:
                "SEHubName": !Ref SoftEtherHubName
                "SEHubPassword": !Ref SoftEtherHubPassword
                "VPNUName": !Ref VPNUserName
            11_user_password:
              command: "./vpncmd localhost /SERVER /PASSWORD:$SEHubPassword /HUB:$SEHubName /CMD UserPasswordSet $VPNUName /PASSWORD:$VPNUPassword"
              cwd: "/usr/local/vpnserver"
              env:
                "SEHubName": !Ref SoftEtherHubName
                "SEHubPassword": !Ref SoftEtherHubPassword
                "VPNUName": !Ref VPNUserName
                "VPNUPassword": !Ref VPNUserPassword

  EC2Instance:
    Type: "AWS::EC2::Instance"
    Properties:
      SubnetId: !Ref SubnetPublic
      Monitoring: false
      LaunchTemplate:
        LaunchTemplateId: !Ref EC2LaunchTemplate
        Version: !GetAtt EC2LaunchTemplate.LatestVersionNumber

  EIPAssociation:
    Type: "AWS::EC2::EIPAssociation"
    Properties:
      AllocationId: !GetAtt EIP.AllocationId
      InstanceId: !Ref EC2Instance

Outputs:
  EIPPublicIp:
    Description: "Elastic IP Public IP Address"
    Value: !GetAtt EIP.PublicIp
    Export:
      Name: !Sub "${Prefix}-eip-public-ip"

  VPNAccessName:
    Description: "VPN Access User Name"
    Value: !Sub "${VPNUserName}@${SoftEtherHubName}"
    Export:
      Name: !Sub "${Prefix}-vpn-access-name"

  KeyPairURL:
    Description: "Key Pair URL"
    Value: !Sub
      - |
        https://us-east-1.console.aws.amazon.com/systems-manager/parameters//ec2/keypair/${KeyPairId}
      - KeyPairId: !GetAtt KeyPair.KeyPairId
    Export:
      Name: !Sub "${Prefix}-keypair-url"