0

I have been following this guide to setup my AWS architecture, but instead of an ssh bastion host/jump box I'd prefer to use a VPN. There are lots of guides on connecting a VPC directly to a customer router, say for connecting the office to your AWS infrastructure.

However I'd like to make several individual users who can connect to the VPN directly from their laptops no matter their location. Just like individual employees can VPN into the office network, I'd like a solution where a few users could VPN directly into the AWS infrastructure.

Is that baked into AWS, or do I have to configure a separate EC2 instance with OpenVPN/Openswan to handle it?

Improve this question
1
  • There is currently no built-in solution for this in AWS.
    – Michael - sqlbot
    Aug 13, 2015 at 2:52

2 Answers 2

Reset to default
2

I would suggest using an OpenVPN solution: https://docs.openvpn.net/how-to-tutorialsguides/virtual-platforms/amazon-ec2-appliance-ami-quick-start-guide/

Alternatively, if you don't want to spin up an instance just for that, you could terminate the VPN at your own firewall and provide routes to the AWS environment from there. Then you could either build your own VPN solution onsite or use whatever solution came with your edge gear.

Improve this answer
3
  • Really, an OpenVPN-like solution is the best choice here. The AWS VPN offerings are pretty explicitly site-to-site, not individual-to-site.
    – sysadmin1138 ♦
    Aug 13, 2015 at 3:16
  • @jorfus renegotiating session keys isn't the same as authentication; I suspect something else is going on -- but the comments of an unrelated answer aren't the place to discuss it.
    – womble ♦
    Aug 28, 2015 at 3:17
  • Thanks @womble. I've added an answer with information about the two VPN options I've tried. Hopefully that will be more helpful.
    – jorfus
    Sep 1, 2015 at 19:28
1

Both OpenVPN and OpenSwan (or Libreswan) will work. I'm not sure which one I like better. OpenVPN was way easier to set up. I never got 2FA and PAM working with Openswan (or any variant)

One warning about OpenVPN: If you implement openvpn with 2FA, you may wish to set session key renegotiation reneg-sec=0 Your client must also support this (tunnelblick seems not to)

I also recommend a transparent ssh proxy bastion inside the VPN. This allows you to have restrictive security groups with little hassle. It's a very solid security foundation and can be extended with 2fa at each stage later if needed.

Some quick notes about the two VPN options:

OpenVPN ipsec

The Viscosity ($9) client is way more stable than Tunnelblick Single incoming port Single config file NOTE: Requires some iptables work

The simplest OpenVPN instructions I've found are here You can also use a community AMI of a pre-built openvpn server. (Though I haven't tried that)

OpenSwan ipsec + l2tpd

  1. Mac OS has a built-in client
  2. Requires 3 ports
  3. 2 main packages and 3 config files
  4. Also requires some iptables work
  5. PAM support is disabled by default. It's hard to get best security practices implemented (mac os prior to 10.11 only support IKE1, secure password storage and 2fa are a challenge without pam.)

There's a good write-up and a really nice setup script here I stepped through the script and confirmed that it appears to be doing the right thing at each stage.

Improve this answer
1
  • 1
    OpenVPN isn't an "SSL VPN", in the sense that term is usually used. If you've never had to support a "real" SSL VPN, you don't know how lucky you are...
    – womble ♦
    Sep 1, 2015 at 20:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .