pptp.yaml

Description: Setting up our own private and secure VPN.

Parameters:
  VPNUsername:
    Description: PPTP-VPN User
    Type: String
    MinLength: 4
    MaxLength: 255
    AllowedPattern: "[a-zA-Z][a-zA-Z0-9]*"
    ConstraintDescription: must begin with a letter and contain only alphanumeric characters.
  VPNPassword:
    NoEcho: true
    Description: PPTP-VPN Password
    Type: String
    MinLength: 4
    MaxLength: 255
    ConstraintDescription: must contain atleast 4 characters.
  VPNPhrase:
    NoEcho: true
    Description: Passphrase for IPSEC PSK
    Type: String
    MinLength: 4
    MaxLength: 255
    ConstraintDescription: must contain atleast 4 characters.
  DNSServerPrimary:
    Description: IPv4 Address for DNS server primary
    Type: String
    Default: "1.1.1.1"
  DNSServerSecondary:
    Description: IPv4 Address for DNS server secondary
    Type: String
    Default: "1.0.0.1"

Mappings:
  Region2AMI:
    us-west-2:
      AMI: ami-003634241a8fcdec0

Resources:
  VPNServerInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId:
        Fn::FindInMap:
          - Region2AMI
          - Ref: AWS::Region
          - AMI
      InstanceType: t2.micro
      SecurityGroups:
        - Ref: VPNSecurityGroup
      Tags:
        - Key: Name
          Value:
            Ref: AWS::StackName
      UserData:
        Fn::Base64: !Join
          - "#"
          - - !Sub |
              #!/bin/sh
              #Passing variables to shell
              YOUR_IPSEC_PSK=${VPNPhrase}
              YOUR_USERNAME=${VPNUsername}
              YOUR_PASSWORD=${VPNPassword}
              YOUR_DNS_PRIMARY=${DNSServerPrimary}
              YOUR_DNS_SECONDARY=${DNSServerSecondary}
            - |
              #VPN 1 - L2TP IPSEC Server
              wget https://git.io/vpnsetup -O vpnsetup.sh && sudo \
              VPN_IPSEC_PSK=$YOUR_IPSEC_PSK \
              VPN_USER=$YOUR_USERNAME \
              VPN_PASSWORD=$YOUR_PASSWORD sh vpnsetup.sh

              #VPN 2 - Setup PPTP Server
              apt-get install pptpd -y
              echo "localip 10.0.0.1" >> /etc/pptpd.conf
              echo "remoteip 10.0.0.100-200" >> /etc/pptpd.conf
              echo "$YOUR_USERNAME pptpd $YOUR_PASSWORD *" >> /etc/ppp/chap-secrets
              echo "ms-dns $YOUR_DNS_PRIMARY" >> /etc/ppp/pptpd-options
              echo "ms-dns $YOUR_DNS_SECONDARY" >> /etc/ppp/pptpd-options
              service pptpd restart

              echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
              sysctl -p
              iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE && iptables-save

  VPNSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: VPN Security Groups
      SecurityGroupIngress:
        # used by IPSec for Internet Key Exchange(IKE)
        - IpProtocol: tcp
          FromPort: "500"
          ToPort: "500"
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: "500"
          ToPort: "500"
          CidrIp: 0.0.0.0/0
        # used by IPSec for NAT traversal
        - IpProtocol: udp
          FromPort: "4500"
          ToPort: "4500"
          CidrIp: 0.0.0.0/0
        # used by PPTP
        - IpProtocol: tcp
          FromPort: "1723"
          ToPort: "1723"
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: "1723"
          ToPort: "1723"
          CidrIp: 0.0.0.0/0
        # used by L2TP
        - IpProtocol: udp
          FromPort: "1701"
          ToPort: "1701"
          CidrIp: 0.0.0.0/0
Outputs:
  VPNServerAddress:
    Description: Use the IP as Server Address or VPN Host
    Value:
      Fn::GetAtt:
        - VPNServerInstance
        - PublicIp