Skip to content

Commit 9cb2ab3

Browse files
dealfonsodealfonso
committed
first version of the script to automate VPC creation by means of OpenVPN
1 parent ec58f6c commit 9cb2ab3

File tree

3 files changed

+589
-2
lines changed

3 files changed

+589
-2
lines changed

‎README.md

+173-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,173 @@
1-
# vpc
2-
Create a VPC using a private and isolated network and a publicly routable IP address
1+
# VPC installer
2+
3+
This is a command that installs and configures a OpenVPN server with the aim of being the entry point for a private and isolated network. The basic setup is shown in the next figure:
4+
5+
![VPC Setup](scheme.png)
6+
7+
This script will install a OpenVPN server in the front-end, and will prepare the `iptables` rules to be able for the clients to get to the nodes in the internal network. So that the client keep their network setup and only the traffic directed to the private network is routed through the VPN.
8+
9+
## Installation
10+
11+
At this time, it is only available for apt-based distributions like Ubuntu.
12+
13+
### Dependencies
14+
15+
The script relies on some dependencies such as `jq`, `curl`, `wget` and `bash`, that are usually installed in most of Linux boxes. If not, please install them.
16+
17+
- `jq`, `curl`, `wget` are needed to install EasyRSA.
18+
- `bash` is needed for the whole script.
19+
- `iptables` is needed for NAT from the VPN network to the internal network (openvpn will also install it).
20+
21+
#### Ubuntu
22+
23+
```
24+
$ apt update
25+
$ apt install wget curl jq iptables --no-install-recommends
26+
```
27+
28+
### Installing
29+
30+
There is no installation procedure... just clone the repo (I prefer this method)
31+
32+
```
33+
$ git clone https://github.com/grycap/vpc
34+
```
35+
36+
or get the `vpc.sh` file from [here](https://raw.githubusercontent.com/grycap/vpc/master/vpc.sh).
37+
38+
And you are ready to use it.
39+
40+
## Using the script to create your VPC
41+
42+
In first place, you need to install [EasyRSA](https://github.com/OpenVPN/easy-rsa). The script will automatically download it and put it in folder `/opt/`. You just need to issue the next command:
43+
44+
```
45+
$ ./vpc.sh easyrsa
46+
```
47+
48+
Once EasyRSA is available at `/opt/easyrsa` folder, you can install and configure the OpenVPN server. Have in mind that you need an interface connected to the internal network (e.g. 10.0.0.1, that is connected to network 10.0.0.0/24). Then you can use the next command:
49+
50+
```
51+
$ ./vpc.sh server -i 10.0.0.1/24
52+
(...)
53+
Service file for systemd /etc/openvpn/openvpnserver/scripts/vpcnat_openvpnserver.service has been created
54+
55+
This file makes that masquerading is enabled from the VPN network to the private network once the OpenVPN server is started.
56+
57+
To automate this process, you can
58+
- copy (or to move) the file to /etc/systemd/system/
59+
- run systemctl daemon-reload
60+
- run systemctl enable vpcnat_openvpnserver.service
61+
62+
When service openvpn@openvpnserver.service is started, the masquerading process will be triggered by running the script /etc/openvpn/openvpnserver/scripts/donat.sh
63+
When the service is stopped, the script /etc/openvpn/openvpnserver/scripts/rmnat.sh will be triggered
64+
```
65+
66+
> This command
67+
> 1. Installs OpenVPN
68+
> 1. Generates the certificates for the server
69+
> 1. Configures the OpenVPN server
70+
> 1. Generates some files to enable and disable NAT from the VPN to the internal network
71+
> 1. Generates a `.service` file to be used in `systemd` based linux boxes to enable NAT and start the OpenVPN server at once.
72+
73+
As the scripts suggest, you should copy the service file to the proper location and start the services:
74+
75+
```
76+
$ cp /etc/openvpn/openvpnserver/scripts/vpcnat_openvpnserver.service /etc/systemd/system/
77+
$ systemctl daemon-reload
78+
$ systemctl start vpcnat_openvpnserver.service
79+
# systemctl status vpcnat_openvpnserver.service
80+
● vpcnat_openvpnserver.service - Nat rules to access the private network 10.0.0.0/24 from VPN 172.19.148.0/24
81+
Loaded: loaded (/etc/systemd/system/vpcnat_openvpnserver.service; enabled; vendor preset: enabled)
82+
Active: active (exited) since Wed 2020-06-17 15:14:05 UTC; 5s ago
83+
Process: 13333 ExecStart=/etc/openvpn/openvpnserver/scripts/donat.sh (code=exited, status=0/SUCCESS)
84+
Main PID: 13333 (code=exited, status=0/SUCCESS)
85+
86+
Jun 17 15:14:05 vpcfront systemd[1]: Starting Nat rules to access the private network 10.0.0.0/24 from VPN 172.19.148.0/24...
87+
Jun 17 15:14:05 vpcfront donat.sh[13333]: net.ipv4.ip_forward = 1
88+
Jun 17 15:14:05 vpcfront systemd[1]: Started Nat rules to access the private network 10.0.0.0/24 from VPN 172.19.148.0/24.
89+
```
90+
91+
At this point you just need to enable one client to access to the VPC:
92+
93+
```
94+
$ ./vpc.sh client new
95+
$ ls -l
96+
total 28
97+
-rw------- 1 root root 8226 Jun 17 15:14 a7d399659b333e931046e4959e635e32.ovpn
98+
-rwxr-xr-x 1 root root 14007 Jun 17 15:00 vpc.sh
99+
```
100+
101+
Now you can copy file `a7d399659b333e931046e4959e635e32.ovpn` to your client computer and issue the next command (where 158.42.1.123 is the publicly routable IP address of the server in which we have just installed the OpenVPN server):
102+
103+
```
104+
root@openvpnclient:~# openvpn --config a7d399659b333e931046e4959e635e32.ovpn --remote 158.42.1.123 --port 10443
105+
Wed Jun 17 17:16:51 2020 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2019
106+
Wed Jun 17 17:16:51 2020 library versions: OpenSSL 1.1.1 11 Sep 2018, LZO 2.08
107+
Wed Jun 17 17:16:51 2020 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
108+
Wed Jun 17 17:16:51 2020 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
109+
(...)
110+
```
111+
112+
And that's all.
113+
114+
Now you can verify that (in the client) you have a new interface (typically `tun0`) with an IP address in the VPN that we have just created, and the route to the internal network is through the VPN:
115+
116+
```
117+
root@openvpnclient:~# ip a
118+
(...)
119+
7: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
120+
link/none
121+
inet 172.19.148.6 peer 172.19.148.5/32 scope global tun0
122+
valid_lft forever preferred_lft forever
123+
inet6 fe80::d43a:bb50:50fa:34c0/64 scope link stable-privacy
124+
valid_lft forever preferred_lft forever
125+
root@openvpnclient:~# ip route
126+
default via 192.168.64.1 dev enp0s2 proto dhcp src 192.168.64.10 metric 100
127+
10.0.0.0/24 via 172.19.148.5 dev tun0
128+
172.19.148.1 via 172.19.148.5 dev tun0
129+
172.19.148.5 dev tun0 proto kernel scope link src 172.19.148.6
130+
192.168.64.0/24 dev enp0s2 proto kernel scope link src 192.168.64.10
131+
192.168.64.1 dev enp0s2 proto dhcp scope link src 192.168.64.10 metric 100
132+
```
133+
134+
Finally you can (e.g) ssh to an internal host:
135+
136+
```
137+
root@openvpnclient:~# ssh ubuntu@172.19.0.5
138+
Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-43-generic x86_64)
139+
140+
* Documentation: https://help.ubuntu.com
141+
* Management: https://landscape.canonical.com
142+
* Support: https://ubuntu.com/advantage
143+
144+
(...)
145+
```
146+
147+
## Other things that this script can do
148+
149+
This script can do some more things. E.g. configure different OpenVPN servers with different names (and certificates), generate client configuration files for each of the servers, use specific names for the client certificates, install a simple OpenVPN server, etc. Please check the help:
150+
151+
```
152+
$ ./vpc.sh help
153+
```
154+
155+
### Generate more client credentials
156+
157+
You can generate more client credentials to enable other users to get to your VPC.
158+
159+
```
160+
$ ./vpc.sh client new -f credentials_file.ovpn
161+
```
162+
163+
The file `credentials_file.ovpn` will be ready to be used with the openvpn client.
164+
165+
### Install and configure an OpenVPN server
166+
167+
If you just want to install and configure a OpenVPN without access to any internal network, you can just issue the next command:
168+
169+
```
170+
$ ./vpc.sh server --skip-nat
171+
```
172+
173+
And a basic OpenVPN server will be automatically configured. Later you can generate more clients.

‎scheme.png

20.5 KB
Loading

0 commit comments

Comments
 (0)