forked from evildotuk/terraform-aws-pritunl
-
Notifications
You must be signed in to change notification settings - Fork 0
/
securitygroups.tf
87 lines (77 loc) · 2.05 KB
/
securitygroups.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
data "aws_vpc" "selected" {
id = var.vpc_id
}
locals {
whitelist_ip = ["${var.whitelist_ip}/32"]
inbound_ports = [80, 443]
pritunl_ports = [var.ovpn_udp_port, var.wireguard_udp_port]
# aws_ports = [500, 4500, 9790]
cidr_all_block = ["0.0.0.0/0"]
}
resource "aws_security_group" "pritunl" {
name = "${var.resource_name_prefix}-vpn"
description = "Allow necessary connections for pritunl vpn"
vpc_id = var.vpc_id
# port 80: for Let's Encrypt validation ; port 443: for PIN auth
dynamic "ingress" {
for_each = local.inbound_ports
content {
description = "standard port ${ingress.value} access"
from_port = ingress.value
to_port = ingress.value
protocol = "tcp"
cidr_blocks = local.cidr_all_block
}
}
# VPN WAN access
dynamic "ingress" {
for_each = local.pritunl_ports
content {
description = "pritunl udp port ${ingress.value} access"
from_port = ingress.value
to_port = ingress.value
protocol = "udp"
cidr_blocks = local.cidr_all_block
}
}
# AWS IPSec access
# dynamic "ingress" {
# for_each = local.aws_ports
# content {
# description = "pritunl aws udp port ${ingress.value} access"
# from_port = ingress.value
# to_port = ingress.value
# protocol = "udp"
# cidr_blocks = local.cidr_all_block
# }
# }
# SSH access conditional
dynamic "ingress" {
for_each = length(var.whitelist_ip) > 0 ? [local.whitelist_ip] : []
content {
description = "ssh whitelist ip ${var.whitelist_ip} access"
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ingress.value
}
}
# ICMP
ingress {
from_port = -1
to_port = -1
protocol = "icmp"
cidr_blocks = [data.aws_vpc.selected.cidr_block]
}
# outbound internet access
egress {
from_port = 0
to_port = 0
protocol = -1
cidr_blocks = local.cidr_all_block
}
tags = merge(
tomap({ "Name" = "pritunl-vpn" }),
var.tags
)
}