create-instance-group-vm-and-setup-lb.sh

#!/usr/bin/env bash

# setup Pritunl startup script
cat << Parent_EOF > setup-pritunl.sh
#! /bin/bash

sudo tee /etc/apt/sources.list.d/pritunl.list << EOF
deb http://repo.pritunl.com/stable/apt focal main
EOF

# Import signing key from keyserver
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com --recv 7568D9BB55FF9E5287D586017AE645C0CF8E292A
# Alternative import from download if keyserver offline
# curl https://raw.githubusercontent.com/pritunl/pgp/master/pritunl_repo_pub.asc | sudo apt-key add -

sudo tee /etc/apt/sources.list.d/mongodb-org-5.0.list << EOF
deb https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/5.0 multiverse
EOF

wget -qO - https://www.mongodb.org/static/pgp/server-5.0.asc | sudo apt-key add -

sudo apt update

# WireGuard server support
sudo apt -y install wireguard wireguard-tools

# Disable firewall
sudo ufw disable

sudo apt -y install pritunl mongodb-org
sudo systemctl enable mongod pritunl
sudo systemctl start mongod pritunl

# change default port to 8443 if 443 in use
sudo sed -i 's/ 443/ 8443/' /etc/pritunl.conf

# start pritunl
sudo pritunl
Parent_EOF

# create instance template
gcloud compute instance-templates create pritunl-template \
    --machine-type n2-standard-2 \
    --boot-disk-size 100GB \
    --metadata-from-file=startup-script=setup-pritunl.sh

# create target pool
gcloud compute target-pools create pritunl-pool --region us-central1

# create managed instance groups
gcloud compute instance-groups managed create pritunl-group \
         --base-instance-name pritunl \
         --size 1 \
         --template pritunl-template \
         --target-pool pritunl-pool \
         --region us-central1

# Configure External IP, Forwarding Rules and Network Load Balancer for both UDP/TCP
gcloud compute addresses create vpn-network-lb --region=us-central1

# for TCP
gcloud compute backend-services create vpn-backend-tcp \
--protocol TCP \
--health-checks vpn-health-check \
--health-checks-region us-central1 \
--region us-central1

gcloud compute forwarding-rules create vpn-tcp-frontend \
--region=us-central1 \
--load-balancing-scheme=EXTERNAL \
--backend-service=vpn-backend-tcp \
--backend-service-region=us-central1 \
--ip-protocol=TCP \
--address=vpn-network-lb \
--ports=443

# for UDP
gcloud compute backend-services create vpn-backend-udp \
--protocol UDP \
--health-checks vpn-health-check \
--health-checks-region us-central1 \
--region us-central1

gcloud compute forwarding-rules create vpn-udp-frontend \
--region=us-central1 \
--load-balancing-scheme=EXTERNAL \
--backend-service=vpn-backend-udp \
--backend-service-region=us-central1 \
--ip-protocol=UDP \
--address=vpn-network-lb \
--ports=19708

gcloud compute addresses create default-nat-ip --region us-central1
 
gcloud compute routers create vpn-router --region=us-central1 --network=default

gcloud compute routers nats create nat1 --router=vpn-router --nat-external-ip-pool=default-nat-ip --nat-all-subnet-ip-ranges --region=us-central1

gcloud compute instance-templates create vpn-gw-instance-template \
    --region=us-central1 \
    --tags=vpn-gw-fw-rules \
    --image-family=ubuntu-pro-2004-lts \
    --image-project=ubuntu-os-pro-cloud \
    --network-interface=no-address \
    --boot-disk-size 100GB \
    --machine-type n2-standard-2 \
    --metadata=startup-script='#! /bin/bash
sudo tee /etc/apt/sources.list.d/pritunl.list << EOF
deb http://repo.pritunl.com/stable/apt focal main
EOF
# Import signing key from keyserver
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com --recv 7568D9BB55FF9E5287D586017AE645C0CF8E292A
sudo apt update
sudo apt -y install pritunl
sudo systemctl enable pritunl
sudo systemctl start pritunl'

gcloud compute instance-groups managed create vpn-gw-instance-group \
    --zone us-central1-a \
    --size 1 \
    --template vpn-gw-instance-template
    
gcloud compute firewall-rules create vpn-gw-network-lb \
    --target-tags vpn-gw-fw-rules \
    --allow tcp:80,tcp:443,tcp:19708 \
    --source-ranges=0.0.0.0/0
    
gcloud compute addresses create vpn-gw-lb-ip \
    --region us-central1

gcloud compute health-checks create tcp vpn-gw-health-check \
    --region us-central1 \
    --port 443
    
gcloud compute backend-services create vpn-gw-backend-service-tcp \
    --protocol TCP \
    --health-checks vpn-gw-health-check \
    --health-checks-region us-central1 \
    --region us-central1
    
gcloud compute backend-services add-backend vpn-gw-backend-service-tcp \
    --instance-group vpn-gw-instance-group \
    --instance-group-zone us-central1-a \
    --region us-central1
    
gcloud compute forwarding-rules create vpn-gw-forwarding-rule-tcp \
    --load-balancing-scheme external \
    --region us-central1 \
    --ports 443,80,19708 \
    --backend-service vpn-gw-backend-service-tcp  \
    --backend-service-region=us-central1 \
    --ip-protocol=TCP \
    --address=vpn-gw-lb-ip \