Run your own VPN in AWS, with IPv6 support and all!
Once I had a hard time setting up a VPN. OpenVPN is too complicated for me, so I'll use Wireguard. I do not understand much, but after reading a ton of tutorials over the net and almost going crazy, I think I've found the exact incantation that shall be used to have an actually working VPN, with IPv6 support. Really, that is much harder than it should be in my opinion. Why can't things have IPv6 by default nowadays?
- https://sa-east-1.console.aws.amazon.com/vpc/home
- Launch VPC Wizard
- VPC with a Single Public Subnet
- IPv6 CIDR block: Amazon provided IPv6 CIDR block
- VPC name: my-vpn
- Public subnet's IPv6 CIDR: Specify a custom IPv6 CIDR
- Create VPC
- https://sa-east-1.console.aws.amazon.com/ec2/v2/home
- Security Groups
- Create Security Group
- Security group name: my-vpn
- Description: my-vpn
- VPC: my-vpn
- Add Rule
- Type: SSH
- Source: Anywhere
- Add Rule
- Type: Custom UDP Rule
- Port Range: 51820
- Source: Anywhere
- https://sa-east-1.console.aws.amazon.com/ec2/v2/home
- Launch Instance
- Ubuntu Server 18.04 LTS
- Next: configure instance details
- Network: my-vpn
- Auto-assign Public IP: Enable
- Auto-assign IPv6 IP: Enable
- Next: Add Storage
- Next: Add Tags
- Next: Configure Security Group
- Select an existing security group
- my-vpn
- Review and Launch
- Launch
- Execute
./vpn.sh <the path to the secret key file> <the instance public IP>
- When done, run
wg-quick down wg0
and terminate the instance
Alternatively, you can launch an EC2 instance via the script start-vpn.sh
.
The script has some requirements that must be fulfilled for it to work properly:
- aws-cli
- a configured named profile for your
aws-cli
enviroment - jq installed
- the ids of the security group and subnet created in the infra setup steps above
The script was only tested on Ubuntu.
- Execute
./start-vpn.sh <desired AWS region> <local profile name> <the previously created subnet id> <the previously created security group id> <the secret key name> <the path to the secret key file>
- The script will ask for some user inputs, in the form of consenting with
yes
or sudo access to install the required packages - When done with spinning up the EC2 instance and with configuring the VPN, the script will hang
- Pressing CTRL+c will trigger its tear down function, that terminates the previously launched EC2 instance and turns off WireGuard