pptp-server.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Setting up your own private and secure VPN.

Parameters:
  VPNUsername:
    Description: PPTP-VPN User
    Type: String
    MinLength: 4
    MaxLength: 255
    AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'
    ConstraintDescription: must begin with a letter and contain only alphanumeric characters.
  VPNPassword:
    NoEcho: true
    Description: PPTP-VPN Password
    Type: String
    MinLength: 4
    MaxLength: 255
    ConstraintDescription: must contain atleast 4 characters.
  VPNPhrase:
    NoEcho: true
    Description: Passphrase for IPSEC PSK
    Type: String
    MinLength: 4
    MaxLength: 255
    ConstraintDescription: must contain atleast 4 characters.
  InstanceSize:
    Description: Instance Type
    Type: String
    Default: Standard.VPN-t2.micro
    AllowedValues:
    - Standard.VPN-t2.micro
    - High.Speed.VPN-t2.medium
    - Ultra.High.Speed.VPN-m3.xlarge
  DNSServerPrimary:
    Description: IPv4 Address for DNS server primary
    Type: String
    AllowedPattern: '((\d{1,3})\.){3}\d{1,3}'
    ConstraintDescription: Must be a valid IPv4 address (e.g. 1.1.1.1)
    Default: '1.1.1.1'
  DNSServerSecondary:
    Description: IPv4 Address for DNS server secondary
    Type: String
    AllowedPattern: '((\d{1,3})\.){3}\d{1,3}'
    ConstraintDescription: Must be a valid IPv4 address (e.g. 1.0.0.1)
    Default: '1.0.0.1'

Mappings:
  AWSInstanceType2Arch:
    Standard.VPN-t2.micro:
      InstanceType: t2.micro
    High.Speed.VPN-t2.medium:
      InstanceType: t2.medium
    Ultra.High.Speed.VPN-m3.xlarge:
      InstanceType: m3.xlarge
  AWSRegionArch2AMI:
    us-east-1:
      HVM64: ami-80861296
    us-east-2:
      HVM64: ami-618fab04
    us-west-1:
      HVM64: ami-2afbde4a
    us-west-2:
      HVM64: ami-efd0428f
    eu-west-1:
      HVM64: ami-a8d2d7ce
    eu-west-2:
      HVM64: ami-f1d7c395
    eu-west-3:
      HVM64: ami-c1cf79bc
    eu-central-1:
      HVM64: ami-060cde69
    ap-northeast-1:
      HVM64: ami-afb09dc8
    ap-northeast-2:
      HVM64: ami-66e33108
    ap-southeast-1:
      HVM64: ami-8fcc75ec
    ap-southeast-2:
      HVM64: ami-96666ff5
    sa-east-1:
      HVM64: ami-4090f22c
    ap-south-1:
      HVM64: ami-c2ee9dad
    ca-central-1:
      HVM64: ami-b3d965d7

Resources:
  VPNServerInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId:
        Fn::FindInMap:
          - AWSRegionArch2AMI
          - Ref: AWS::Region
          - HVM64
      InstanceType:
        Fn::FindInMap:
          - AWSInstanceType2Arch
          - Ref: InstanceSize
          - InstanceType
      SecurityGroups:
        - Ref: VPNSecurityGroup
      Tags:
        - Key: Name
          Value:
            Ref: AWS::StackName
      UserData:
        Fn::Base64: !Join
          - '#'
          - - !Sub |
              #!/bin/sh
              #Passing variables to shell
              YOUR_IPSEC_PSK=${VPNPhrase}
              YOUR_USERNAME=${VPNUsername}
              YOUR_PASSWORD=${VPNPassword}
              YOUR_DNS_PRIMARY=${DNSServerPrimary}
              YOUR_DNS_SECONDARY=${DNSServerSecondary}
            - |
              #VPN 1 - L2TP IPSEC Server
              wget https://git.io/vpnsetup -O vpnsetup.sh && sudo \
              VPN_IPSEC_PSK=$YOUR_IPSEC_PSK \
              VPN_USER=$YOUR_USERNAME \
              VPN_PASSWORD=$YOUR_PASSWORD sh vpnsetup.sh

              #VPN 2 - Setup PPTP Server
              apt-get install pptpd -y
              echo "localip 10.0.0.1" >> /etc/pptpd.conf
              echo "remoteip 10.0.0.100-200" >> /etc/pptpd.conf
              echo "$YOUR_USERNAME pptpd $YOUR_PASSWORD *" >> /etc/ppp/chap-secrets
              echo "ms-dns $YOUR_DNS_PRIMARY" >> /etc/ppp/pptpd-options
              echo "ms-dns $YOUR_DNS_SECONDARY" >> /etc/ppp/pptpd-options
              service pptpd restart

              echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
              sysctl -p
              iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE && iptables-save

  VPNSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: VPN Security Groups
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '500'
          ToPort: '500'
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: '500'
          ToPort: '500'
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: '4500'
          ToPort: '4500'
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: '1723'
          ToPort: '1723'
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: '1723'
          ToPort: '1723'
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: '1701'
          ToPort: '1701'
          CidrIp: 0.0.0.0/0
Outputs:
  VPNServerAddress:
    Description: Use the IP as Server Address or VPN Host
    Value:
      Fn::GetAtt:
        - VPNServerInstance
        - PublicIp