aws clientvpnを使って個人VPNを構築する

忘れもしない2021/11/27日土曜日。一体インターネッツで何が起こったのかを...
休日の朝。普段のようにベッドから起きた自分は、今日もネッツゲームをやる気満々だった。まずはdis〇〇サーバへJOIN!
と思いきや...接続できない...

まぁ焦らない焦らない。Dis〇〇もこんなことはたまにはあるやんな。と思い原〇を起動...つながらない...
あれ...ネットワーク死んだか?怪しんだ自分はまずpingが通るか確認...問題なし
え...サイトとかも普通に見える...どうなっていやがる...

俺のインターネッツは一体...今...どうなってやがるんだああああああ(半日経過)

$ cdk init app --language python
$ source .venv/bin/activate
$ python -m pip install -r requirements.txt

from aws_cdk import (
    # Duration,
    Stack,
    # aws_sqs as sqs,
    aws_ec2
)
from constructs import Construct


class AwsCdkVpnStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, certificate_arn: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        vpc = aws_ec2.Vpc(
            self,
            "Vpc_CDK",
            cidr="172.31.0.0/16",
            max_azs=1,
            subnet_configuration=[
                aws_ec2.SubnetConfiguration(
                    name='Public-Subent',
                    subnet_type=aws_ec2.SubnetType.PUBLIC,
                    cidr_mask=20
                ),
            ],
        )

        isubnet = vpc.public_subnets

        client_vpn = aws_ec2.ClientVpnEndpoint(
            scope=self,
            id="Client_VPN",
            vpc=vpc,
            cidr="10.0.0.0/22",
            authorize_all_users_to_vpc_cidr=False,
            split_tunnel=False,
            server_certificate_arn=certificate_arn,
            client_certificate_arn=certificate_arn,
        )

        client_vpn.add_authorization_rule(
            id="auth",
            cidr="0.0.0.0/0",
        )

        for isub in isubnet:
            client_vpn.add_route(
                id="routing",
                cidr='0.0.0.0/0',
                target=aws_ec2.ClientVpnRouteTarget.subnet(subnet=isub)
            )

#!/usr/bin/env python3
import os

import aws_cdk as cdk

from aws_cdk_vpn.aws_cdk_vpn_stack import AwsCdkVpnStack
from dotenv import load_dotenv

load_dotenv()

app = cdk.App()
certificate_arn = os.environ['CERTIFICATE_ARN']
client_vpn = AwsCdkVpnStack(app, "AwsCdkVpnStack", certificate_arn)

cdk.Tags.of(client_vpn).add('Name', 'Test_VPN')

app.synth()

cd .\EasyRSA-3.1.0\
.\EasyRSA-Start.bat
./easyrsa init-pki
./easyrsa build-ca nopass
./easyrsa build-server-full server nopass
./easyrsa build-client-full client1.domain.tld nopass
exit
mkdir ../certificate
copy pki\ca.crt ../certificate
copy pki\issued\server.crt ../certificate
copy pki\private\server.key ../certificate
copy pki\issued\client1.domain.tld.crt ../certificate
copy pki\private\client1.domain.tld.key ../certificate
cd ../certificate
aws acm import-certificate --certificate fileb://server.crt --private-key fileb://server.key --certificate-chain fileb://ca.crt

$ cdk deploy
...

 ✅  AwsCdkVpnStack

✨  Deployment time: 459.08s

Stack ARN:
arn:aws:cloudformation:ap-northeast-1:576272532983:stack/AwsCdkVpnStack/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

✨  Total time: 486.84s

client
dev tun
proto udp
remote cvpn-endpoint-xxxxxxxxxxxxxxxxxxx.prod.clientvpn.ap-northeast-1.amazonaws.com 443
remote-random-hostname
resolv-retry infinite
nobind
remote-cert-tls server
cipher AES-256-GCM
verb 3
<ca>
-----BEGIN CERTIFICATE-----
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-----END CERTIFICATE-----

</ca>

# これを追記する
cert C:\\Path\\client1.domain.tld.crt
key C:\\client1.domain.tld.key

reneg-sec 0