Unified-Cloud-Formation.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Setting up your own private and secure VPN. You can read instructions
  on our blog https://www.webdigi.co.uk/blog/2015/how-to-setup-your-own-private-secure-free-vpn-on-the-amazon-aws-cloud-in-10-minutes/
  and you can follow video instructions on Youtube https://www.youtube.com/watch?v=fBBERp5CUgo

Parameters:
  Username:
    Description: VPN Username
    Type: String
    MinLength: '1'
    MaxLength: '255'
    AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'
    ConstraintDescription: must begin with a letter and contain only alphanumeric
      characters.
  VPNPassword:
    NoEcho: 'true'
    Description: VPN Password (Min 4 characters)
    Type: String
    MinLength: '4'
    MaxLength: '255'
    ConstraintDescription: must contain atleast 4 characters.
  VPNPhrase:
    NoEcho: 'true'
    Description: Passphrase for IPSEC PSK (Min 4 characters)
    Type: String
    MinLength: '4'
    MaxLength: '255'
    ConstraintDescription: must contain atleast 4 characters.
  Size:
    Description: Instance Type
    Type: String
    Default: Standard.VPN-t3.micro
    AllowedValues:
    - Standard.VPN-t3.micro
    - High.Speed.VPN-t3.medium
    - Ultra.High.Speed.VPN-m5.xlarge

Mappings:
  AWSInstanceType2Arch:
    Standard.VPN-t3.micro:
      InstanceType: t3.micro
    High.Speed.VPN-t3.medium:
      InstanceType: t3.medium
    Ultra.High.Speed.VPN-m3.xlarge:
      InstanceType: m5.xlarge
  AWSRegionArch2AMI:
    us-east-1:
      HVM64: ami-80861296
    us-east-2:
      HVM64: ami-618fab04
    us-west-1:
      HVM64: ami-2afbde4a
    us-west-2:
      HVM64: ami-efd0428f
    eu-west-1:
      HVM64: ami-a8d2d7ce
    eu-west-2:
      HVM64: ami-f1d7c395
    eu-west-3:
      HVM64: ami-c1cf79bc
    eu-central-1:
      HVM64: ami-060cde69
    ap-northeast-1:
      HVM64: ami-afb09dc8
    ap-northeast-2:
      HVM64: ami-66e33108
    ap-southeast-1:
      HVM64: ami-8fcc75ec
    ap-southeast-2:
      HVM64: ami-96666ff5
    sa-east-1:
      HVM64: ami-4090f22c
    ap-south-1:
      HVM64: ami-c2ee9dad
    ca-central-1:
      HVM64: ami-b3d965d7
    eu-north-1:
      HVM64: ami-1dab2163
    me-south-1:
      HVM64: ami-01011404880c390bf
    ap-east-1:
      HVM64: ami-59780228

Resources:
  VPNServerInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId:
        Fn::FindInMap:
        - AWSRegionArch2AMI
        - Ref: AWS::Region
        - HVM64
      InstanceType:
        Fn::FindInMap:
        - AWSInstanceType2Arch
        - Ref: Size
        - InstanceType
      SecurityGroups:
      - Ref: VPNSecurityGroup
      Tags:
      - Key: Name
        Value:
          Ref: AWS::StackName
      UserData:
        Fn::Base64: !Join
          - '#'
          - - !Sub |
              #!/bin/sh
              #Passing variables to shell
              YOUR_IPSEC_PSK=${VPNPhrase}
              YOUR_USERNAME=${Username}
              YOUR_PASSWORD=${VPNPassword}
            - |
              #VPN 1 - L2TP IPSEC Server
              wget https://git.io/vpnsetup -O vpnsetup.sh && sudo \
              VPN_IPSEC_PSK=$YOUR_IPSEC_PSK \
              VPN_USER=$YOUR_USERNAME \
              VPN_PASSWORD=$YOUR_PASSWORD sh vpnsetup.sh

              #VPN 2 - Setup PPTP Server
              apt-get install pptpd -y
              echo "localip 10.0.0.1" >> /etc/pptpd.conf
              echo "remoteip 10.0.0.100-200" >> /etc/pptpd.conf
              echo "$YOUR_USERNAME pptpd $YOUR_PASSWORD *" >> /etc/ppp/chap-secrets
              echo "ms-dns 8.8.8.8" >> /etc/ppp/pptpd-options
              echo "ms-dns 8.8.4.4" >> /etc/ppp/pptpd-options
              service pptpd restart

              echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
              sysctl -p
              iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE && iptables-save

  VPNSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: VPN Security Groups
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '500'
        ToPort: '500'
        CidrIp: 0.0.0.0/0
      - IpProtocol: udp
        FromPort: '500'
        ToPort: '500'
        CidrIp: 0.0.0.0/0
      - IpProtocol: udp
        FromPort: '4500'
        ToPort: '4500'
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: '1723'
        ToPort: '1723'
        CidrIp: 0.0.0.0/0
      - IpProtocol: udp
        FromPort: '1723'
        ToPort: '1723'
        CidrIp: 0.0.0.0/0
      - IpProtocol: udp
        FromPort: '1701'
        ToPort: '1701'
        CidrIp: 0.0.0.0/0
Outputs:
  VPNServerAddress:
    Description: Use the IP as Server Address or VPN Host
    Value:
      Fn::GetAtt:
        - VPNServerInstance
        - PublicIp
  WebdigiNotes:
    Description: Allow upto 5 minutes after setup to connect. Please contact us at
      https://www.webdigi.co.uk/blog/2015/how-to-setup-your-own-private-secure-free-vpn-on-the-amazon-aws-cloud-in-10-minutes/
      for any help!
    Value: Comments