In this post, I’m going to guide how to set up AWS client VPN from scratch including Simple AD deployment.
AWS Client VPN can be used to connect to private segment directly from your client. It is well documented here in official document “AWS Client VPN Administrator Guide“.
In VPN settings, there are two main part you need to consider first:
- Authentication … AWS Client VPN supports two types:
- Active Directory Authentication
- Mutual (Certificate) Authentication
- Security Groups
- Network-based Authorization (work with Active Directory Authentication)
In my opinion, Active Directory Authentication is more flexible and intuitive compared to Mutual Authentication. It doesn’t support MFA yet, but it provides user/password authentication as well as it allows specific groups of users in AD to be able to connect to SSLVPN, which is a requirement of most clients.
Setup procedure is below:
- Generate certs and keys using
easy-rsa, and register them on ACM
- Procure Simple AD
- Create users and groups on Simple AD
- Procure Client VPN Endpoint
- (Option) Configure a web server for connection test
- Configure OpenVPN client
By the end of this guide, the test environment looks like below:
1. Generate Certificate and Keys
You need to generate certificate and keys for servers to process client vpn first. You can follow the official steps here. It is not required to generate client certificate/key because we use Active Directory Authentication.
git clone https://github.com/OpenVPN/easy-rsa.git
./easyrsa build-ca nopass
./easyrsa build-server-full lab_server nopass
cp pki/ca.crt /temp_folder/
cp pki/issued/lab_server.crt /temp_folder/
cp pki/private/lab_server.key /temp_folder/
Once they are generated, register them into the AWS Certificate Manager(ACM). Please note you need to register these to the region you are going to have your VPN connection.
aws acm import-certificate --certificate file://lab_server.crt --private-key file://lab_server.key --certificate-chain file://ca.crt --region eu-west-1
If it returns arn, you are successfully registered certificate/key on ACM.
2. Procure Simple AD
Simple AD is not available yet in all regions. You can check the availability here.
First, select “Simple AD”, and select your VPC and subnet you want this service.
Once created, wait for a ew minutes till Directory service is ready. Note the DNS address listed in Directory detail, this information is required later to have management server join this domain.
3. Create Users and Groups for VPN access
In order to manage this AD, I procure another Windows server(management server) in public subnet.
For DNS configuration, you can either change DHCP option of your subnet or set DNS server statically in the servers.
After restart, reconnect to the server, this time with domain administrator account – password is the one you set during Simple AD setup. Install RSAT.
Launch “Active Directory Users and Computers”. If you logged in with domain administrator account, you should be able to see your domain is listed. I created two users “shogo.kobayashi” and “john.smith”, and only “shogo.kobayashi” is a member of “SSLVPN_USERS” group.
4. Procure Client VPN Endpoint
In Create Client VPN Endpoint wizard, you need to specify IPv4 CIDR which should be different from your existing VPC.
- Server certificate ARN … Select arn, which you received in step 1.
- Authentication Options … Select “Use Active Directory authentication”
- Directory ID … select Directory ID you created on step 2.
- DNS Server 1/2 IP Address … Use DNS IP address of your Simple AD
Associate this endpoint with your subnet in order to use it. Note that you will be charged once you associate endpoint with subnet. I used private subnet for this.
- VPC … VPC you want to use this VPN Endpoint in
- Subnet … Subnet you want to use this VPN Endpoint in
This is to authorize which network is reachable for each group of users. In this lab, I created only one rule that allows VPN connection to communicate anyone in the network as long as the authenticated user is in “SSLVPN_USERS” AD security group.
- Destination network to enable … Which network this group of users can access
- Grant access to … Allow access to users in a specific Active Directory group
- Active Directory Group ID … SID of the SSLVPN_USERS group in AD
5. (Optional) Setup web server for connection test
We are going to setup web server for connection test. We use VPC endpoint to retrieve httpd packages because we want this server to be in private subnet, and hence there is no direct internet connectivity.
And minimum setup to bootstrap web server.
6. Configure OpenVPN Client
You can download configuration file from AWS console.
Launch OpenVPN client of your choice, and use the configuration file you just downloaded. Note you need to have a root CA certificate, which you generate in step 1, in the same folder you have your configuration file.
Now you should …
- Be able to access web server if you login with user who is a member of “SSLVPN_USERS”, and
- Not be able to access web server if you login with user who is NOT a member of “SSLVPN_USERS”.