vpn.yaml

#
# Copyright 2017 Eonian Technologies.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

#
# CloudFormation template that installs the OpenVPN Access Server in the first
# public subnet of the given VPC. The VPCs NACL rules will be updated to allow
# connectivity. Additional charges for use of the OpenVPN software may apply.
#
---
AWSTemplateFormatVersion: '2010-09-09'
Description: OpenVPN Access Server.

# Parameters
Parameters:
  VPCStackName:
    Type: String
    Description: The name of the VPC stack where the VPN will be deployed.
  ImageId:
    Type: AWS::EC2::Image::Id
    Description: The id of the OpenVPN AMI.
  InstanceType:
    Type: String
    Description: The AWS instance type that will be used.
    AllowedValues:
    - t2.small
    - t2.medium
    - t2.large
    - m4.large
    - t2.xlarge
    - t2.2xlarge
    - m4.xlarge
    - m4.2xlarge
    - m4.4xlarge
    Default: t2.small
  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: The key that will be used to SSH into the OpenVPN Access Server instance.
  HostName:
    Type: String
    Description: The DNS host name of the VPN server.
    Default: vpn.nonprod.us-east-1
  DomainName:
    Type: String
    Description: The domain name of the Route53 public hosted zone that will contain the DNS record.
    Default: mycompany.com
  SSHCIDR:
    Type: String
    Description: The IPv4 CIDR allowed to SSH into the VPN instance. This is required for configuration. A VPC NACL rule will be added. To remove SSH access, set this to empty.
    Default: 0.0.0.0/0
  AccessCIDR:
    Type: String
    Description: The IPv4 CIDR allowed to use VPN services.
    Default: 0.0.0.0/0

# Metadata
Metadata:
  AWS::CloudFormation::Interface:

    # Parameter Groups
    ParameterGroups:
    - Label:
        default: VPC
      Parameters:
      - VPCStackName
    - Label:
        default: Instance
      Parameters:
      - ImageId
      - InstanceType
      - KeyName
    - Label:
        default: DNS
      Parameters:
      - HostName
      - DomainName
    - Label:
        default: Ingress
      Parameters:
      - SSHCIDR
      - AccessCIDR

    # Parameter Labels
    ParameterLabels:
      VPCStackName:
        default: VPC Stack
      ImageId:
        default: Image ID
      InstanceType:
        default: Instance Type
      HostName:
        default: Host Name
      DomainName:
        default: Domain Name
      SSHCIDR:
        default: IPv4 SSH CIDR
      NumberOfDevices:
        default: Number Of Users
      AccessCIDR:
        default: IPv4 Access CIDR

# Conditions
Conditions:
  HasSSHCIDR: !Not [!Equals ['', !Ref SSHCIDR]]

# Resources
Resources:

  # Security Group
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Ref 'AWS::StackName'
      GroupDescription: !Ref 'AWS::StackName'
      VpcId:
        Fn::ImportValue:
          Fn::Sub:
            ${VPCStackName}:vpc
      SecurityGroupIngress:
      - Fn::If:
        - HasSSHCIDR
        - - IpProtocol: tcp
            FromPort: '22'
            ToPort: '22'
            CidrIp: !Ref SSHCIDR
        - !Ref 'AWS::NoValue'
      - IpProtocol: tcp
        FromPort: '443'
        ToPort: '443'
        CidrIp: !Ref AccessCIDR
      - IpProtocol: tcp
        FromPort: '943'
        ToPort: '943'
        CidrIp: 0.0.0.0/0
      - IpProtocol: udp
        FromPort: '1194'
        ToPort: '1194'
        CidrIp: !Ref AccessCIDR
      Tags:
      - Key: Name
        Value: !Ref 'AWS::StackName'

  # Instance
  Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref InstanceType
      ImageId: !Ref ImageId
      KeyName: !Ref KeyName
      SecurityGroupIds:
      - !Ref SecurityGroup
      SubnetId:
        Fn::ImportValue:
          Fn::Sub:
             ${VPCStackName}:public-subnet-1
      Tags:
      - Key: Name
        Value: !Ref 'AWS::StackName'

  # EIP
  EIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc

  # Associate EIP
  EIPAssociation:
    Type: AWS::EC2::EIPAssociation
    Properties:
      EIP:
        Ref: EIP
      InstanceId:
        Ref: Instance

  # DNS Record
  Route53RecordSet:
    Type: "AWS::Route53::RecordSet"
    DependsOn: Instance
    Properties:
      HostedZoneName: !Sub "${DomainName}."
      Name: !Sub "${HostName}.${DomainName}."
      Type: A
      TTL: '300'
      ResourceRecords:
      - Ref: EIP

  # Inbound SSH
  PublicAclIngress500:
    Type: AWS::EC2::NetworkAclEntry
    DependsOn: Instance
    Condition: HasSSHCIDR
    Properties:
      CidrBlock: !Ref SSHCIDR
      Protocol: "6"
      RuleAction: allow
      RuleNumber: '500'
      PortRange:
        From: '22'
        To: '22'
      NetworkAclId:
        Fn::ImportValue:
          Fn::Sub:
            ${VPCStackName}:public-nacl

  # Inbound VPN UI
  PublicAclIngress510:
    Type: AWS::EC2::NetworkAclEntry
    DependsOn: Instance
    Properties:
      CidrBlock: !Ref AccessCIDR
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '510'
      PortRange:
        From: '943'
        To: '943'
      NetworkAclId:
        Fn::ImportValue:
          Fn::Sub:
            ${VPCStackName}:public-nacl

  # Inbound VPN UDP
  PublicAclIngress520:
    Type: AWS::EC2::NetworkAclEntry
    DependsOn: Instance
    Properties:
      CidrBlock: !Ref AccessCIDR
      Protocol: '17'
      RuleAction: allow
      RuleNumber: '520'
      PortRange:
        From: '1194'
        To: '1194'
      NetworkAclId:
        Fn::ImportValue:
          Fn::Sub:
            ${VPCStackName}:public-nacl

# Outputs
Outputs:
  AdminURL:
    Description: The URL to the OpenVPN Admin UI.
    Value: !Sub "https://${HostName}.${DomainName}:943/admin"
  DomainName:
    Description: The domain name of the OpenVPN instsance.
    Value: !Sub "${HostName}.${DomainName}"
  IPAddress:
    Description: The IP address of the OpenVPN instance.
    Value: !Ref EIP