AWS VPN (Client VPN) with VGW
Published: 2022-11-08 14:13:51

A **Virtual Private Network (VPN)** apparently is a private secure connection between two devices that is achieved using encryption over a public network, typically the internet.

**We will be working on 2 project:**
1. AWS Client VPN - Client-to-Site(AWS Cloud).
2. AWS Site-to-Site - On-premises/cloud-to-site(AWS Cloud).

**What is AWS Client VPN?** AWS Client VPN is a managed client-based VPN service that enables you to securely access AWS resources and resources in your on-premises network - AWS Documentation.

**Project 1:**
In this task, we will be working with AWS client VPN.

Outlines:
- I have my Windows 10 Laptop on-premises.
- I have a windows server in a private subnet in us-east-2 (Ohio).
- We will need SSL for mutual authentication, this can be created using EasyRSA on cmd and upload to AWS Certificate Manager (ACM)
- I have my VPC created which consist of 2 subnet and 2 route table (private and public).
- I have my server launched in the private subnet which can't be accessed from the internet. 


**STEPS:**
**Login to your AWS account and search VPC, click on VPC.
On the left hand side. Expand Virtual Private Network (VPN)
- Click on Virtual Private Gateway (VGW)**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aolm2jx52yw95s5ytnbx.PNG)
- Under VGW. Click create virtual private gateway
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0opxbp6l2941yuoozgoq.PNG)
- Once created. click on Action then select Attach to VPC.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lwiewybi0ovr90e9k9g4.PNG)
- Under state "Attaching", refresh and wait for few minute and state shows "Attached".
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7w7frwimmenxwcs0ckuw.PNG)
**On the left hand side. Expand Virtual Private Network (VPN)
Click on Customer Gateway.**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zq0alom5b5b9wdtvmc3o.PNG)
Click create Customer Gateway.
- Input your ASN or leave default
- Enter your public IP address for customer device.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/29o1oko76tiv46al7qhm.PNG)
Create customer gateway. 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pulhsox7owf4j4mf9li2.PNG)

**Create certificates and keys and upload them to ACM**
The following procedure installs Easy-RSA 3.x software and uses it to generate server and client certificates and keys and upload them to ACM.

Copy the link and open in your broswer. Download the latest EasyRSA zip file for your windows and extract it..

https://github.com/OpenVPN/easy-rsa/releases
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lzwbe482d0ksabtylt6a.PNG)

Open a command prompt and navigate to the location that the EasyRSA-3.x folder was extracted to.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/55nkdcoowk0nzi2tg81e.PNG)
Open the EasyRSA-Start.bat via CMD or Naviha=gate to the EasyRSA folder.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qmxx0seau4rqyifqmqcl.PNG)
Run the following command to open the EasyRSA 3 shell.
- Initialize a new PKI environment.
# ./easyrsa init-pki
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rvlwime6jyb4apz6oihh.PNG)
- To build a new certificate authority (CA), run this command and follow the prompts.
# ./easyrsa build-ca nopass
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k6nc5pcvr6lforwjkl5s.PNG)
- Generate the server certificate and key.
# ./easyrsa build-server-full server nopass
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xp8w0jl43p30t0mo4y1f.PNG)
- Generate the client certificate and key.
# ./easyrsa build-client-full client1.domain.tld nopass
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vnwi7rg2uww44byv5rzg.PNG)

> You can optionally repeat this step for each client (end user) that requires a client certificate and key.

Exit the EasyRSA 3 shell.

I will create a custom folder by using the mkdir command, then copy the server certificate plus key and the client certificate plus key to the custom folder.

> C:\Program Files\EasyRSA-3.x> mkdir C:\custom_folder
> C:\Program Files\EasyRSA-3.x> copy pki\ca.crt C:\custom_folder
> C:\Program Files\EasyRSA-3.x> copy pki\issued\server.crt C:\custom_folder
> C:\Program Files\EasyRSA-3.x> copy pki\private\server.key C:\custom_folder
> C:\Program Files\EasyRSA-3.x> copy pki\issued\client1.domain.tld.crt C:\custom_folder
> C:\Program Files\EasyRSA-3.x> copy pki\private\client1.domain.tld.key C:\custom_folder
> C:\Program Files\EasyRSA-3.x> cd C:\custom_folder

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xcbqsh1e665wptlwci76.PNG)
Upload the server certificate plus key and client certificate plus key to ACM. Be sure to upload them in the same Region in which you intend to create the Client VPN endpoint.

On the Search Bar, search for ACM, click on ACM.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3r4z9ud7te2y4jalhzjl.PNG)
On ACM page, click on import a certificate.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ot0cc031qsui90nrl44d.PNG)

I will navigate to my computer folder where i have the certificates and key, open with notepad to copy the details then paste on ACM.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/skzxuk5jh4t6r0ztjvhh.PNG)
First. I will copy and paste the server cert, key and ca into ACM and import
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gbbcmcfd68o5b3znmwy8.PNG)
Done. Next. i will copy the client cert, key and ca into ACM and import.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uf1ztqip2tenk5jkqcew.PNG)
Both Certificates are on ACM and can be seen under list of certificates.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zco9awnojklm0reqipbe.PNG)

**Let's create the AWS Client VPN Endpoints**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/w2zh3f7hjedtq04k255d.PNG)

**Click create client VPN Endpoint.**

> Input the information like client IP address - private ip address that will be allocated to the client devices
> I selected mutual authentication using server and client certificate we created earlier via EasyRSA and ACM.
> You can select user-based authentication if you have active directory setup.
> I will recommend you enable split-tunnel. you can also enable connection logs for monitoring client connectivity and troubleshooting.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b1dsjjdtzf7y1lc4bu4h.PNG)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s2c05tgbucn4bgnh21pi.PNG)
Once you've filled the correct information. click create
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cor0fp3tanuduiieqech.PNG)

While the status state is pending-association. 
Under Target network association. Click on associate target network
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xmb7zz94fek4np4lgbm7.PNG)
Select the VPC where you have your server. and select the subnet then associate the target network.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5fc1h1qenubw5khpnme4.PNG)

Under Association rules. Click on add association rule.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s2nit352e1r7acet11uw.PNG)
Enter the destination network, in my case i used the private subnet IPv4 CIDR address where my servers are located. 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j9ve69wybdvtijdmpfda.PNG)
Once added, your client vpn endpoint status should now be "Available".

Now head over to your private route table, under Route Propagation click on edit route propagation
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jtnzn16ltvf88tf159vt.PNG)
Enable Propagation for the virtual private gateway and save.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bv0iz3weikkkrznqxa1s.PNG)

**Now. Let's Download the Client configuration.**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6iajut5ub830o1017f1y.PNG)
Once downloaded, open the downloaded-client-config.ovpn file as notepad.
Scroll to the end of the page inbetween </ca> and reneg-sec 0 input the cert and key.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wjnp1lyqgj6fhvo3lqwl.PNG)
_e.g_
> </ca>
> <cert>
> client1.domain.tld cert
> </cert>
> <key>
> client1.domain.tld private key
> </key>
> reneg-sec 0
You copy and paste the client certificate and key then save the notepad. 
Download OpenVPN or AWS VPN Client
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9kx3l5ih39yqyxsx7rz0.png)
click on manage profiles, then Add Profile. Input a display name and attach the .ovpn file.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wwzhzqxa91vis87iexpz.PNG)

Click Add Profile and connect. 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ezryk9fem2xzoertn8xo.PNG)
The welcome Banner configured and VPN connected.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/w83xcu0rbkphsbr8p1uk.PNG)
using ipconfig and see the IP address we configured for client IPV4
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xdte20zploxq0mn3c05v.PNG)

Now let access our server in the AWS cloud residing in a private subnet(us-east-2b)

I will be connection via RDP port 3389 to my window server
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qkel91epp8qwdod3ultx.PNG)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/iprpumg9kyiume8ygn48.PNG)
Now i am successfully logged in and can perform task on the server.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/al3e2rtv0lcmom2f32pb.png)

You can have more than one server in the private subnet and access everyone of them via AWS VPN Client.

Ciao! Thank you so much for reading and i hope my write up is informational. I will be writing on AWS Site-to-Site VPN real soon.

_For more steps and guidelines. You can check out AWS Document: https://docs.aws.amazon.com/vpn/latest/clientvpn-user/user-getting-started.html#install-client_