This module makes it easy to deploy an OpenVPN server in an auto-scaling group (size 1) for fault tolerance --along with the all the resources it typically needs:
The Auto-Scaling Group.
An EC2 Instance
An Elastic IP (EIP) address.
IAM Role and IAM instance profile.
Simple Queuing Services (SQS) Queues
An S3 Bucket for certificate backups
Security groups.
How do you use this module?
See the root README for instructions on using Terraform modules.
public_ip: The public IP address of the server (via its EIP)
How do I add custom security group rules?
One of the other important outputs of this module is the security_group_id, which is the id of the server's Security
Group. You can add custom rules to this Security Group using the aws_security_group_rule resource:
This module creates an IAM role for your EC2 instance and exports the id of that role as the output iam_role_id. You
can attach custom policies to this IAM role using the aws_iam_policy_attachment resource:
Build an AMI that has the duo_openvpn plugin installed. You can use install-openvpn to install the plugin
alongside openvpn by passing in the argument --duo-version. For example:
In the user_data script for the server, pass in the duo keys to init-openvpn using the arguments --duo-ikey,
--duo-skey, and --duo-host to configure the integration key, secret key, and API hostname respectively. You can
obtain these by following the Duo setup instructions for OpenVPN.
See the packer-duo and openvpn-host-duo examples for an
example configuration to deploy the OpenVPN server with Duo enabled.
Once the plugin is setup, all authentication for the client will result in a password prompt. To authenticate, you pass
in the MFA token in the password prompt, or push if you have push authentication enabled in duo. Note that in order
for 2FA to work, the certificate username (the value for --username when running openvpn-admin request) should
exactly match the duo username.
Questions? Ask away.
We're here to talk about our services, answer any questions, give advice, or just to chat.
{"treedata":{"name":"root","toggled":true,"children":[{"name":".circleci","children":[{"name":"config.yml","path":".circleci/config.yml","sha":"7325906c067b914420a41e6f3483f9e7b12eb5a1"}]},{"name":".github","children":[{"name":"ISSUE_TEMPLATE","children":[{"name":"bug_report.md","path":".github/ISSUE_TEMPLATE/bug_report.md","sha":"d2e87e27c601e423865ed660ec697082470ca60f"},{"name":"feature_request.md","path":".github/ISSUE_TEMPLATE/feature_request.md","sha":"023a33099be2336476930c96e17ff1ba5dc55348"}]},{"name":"pull_request_template.md","path":".github/pull_request_template.md","sha":"1ed18daca8d8613b91574ddd1641f2d129204f50"}]},{"name":".gitignore","path":".gitignore","sha":"62689e44269e66654abf7c8c08a0c419ab84f15e"},{"name":".pre-commit-config.yaml","path":".pre-commit-config.yaml","sha":"ef4c514168a04923df9033bb2ea77801b035eef5"},{"name":"CODEOWNERS","path":"CODEOWNERS","sha":"0616d223168080313c63eab2e7b9b66b90213052"},{"name":"LICENSE.txt","path":"LICENSE.txt","sha":"5ae97660cb6e3a07b61c971f1a25edf402e90f53"},{"name":"README.md","path":"README.md","sha":"677dc9e1781ef41c6e54364c91358044d5e3c055"},{"name":"examples","children":[{"name":"openvpn-host-duo","children":[{"name":"README.md","path":"examples/openvpn-host-duo/README.md","sha":"1a3065f058745f0f03fd74844ac4e872d52538de"},{"name":"main.tf","path":"examples/openvpn-host-duo/main.tf","sha":"0dcc6ba1a4b044a6ce120dc2068dc7a2f3b4f601"},{"name":"outputs.tf","path":"examples/openvpn-host-duo/outputs.tf","sha":"f527145f657a5a99d32c301c591f461f2230e3b9"},{"name":"user-data","children":[{"name":"user-data.sh","path":"examples/openvpn-host-duo/user-data/user-data.sh","sha":"607cd6c339af50b3c88b1c92c9c7e2ff03e01467"}]},{"name":"vars.tf","path":"examples/openvpn-host-duo/vars.tf","sha":"5d9d760ae9700c178ae6898e9e652b50ecfa92cc"}]},{"name":"openvpn-host","children":[{"name":"README.md","path":"examples/openvpn-host/README.md","sha":"851c84174ea25ce2dbf01aae7a3764a5208f553d"},{"name":"main.tf","path":"examples/openvpn-host/main.tf","sha":"b107adff7eab16176554fc7ff51719d6edc59e76"},{"name":"outputs.tf","path":"examples/openvpn-host/outputs.tf","sha":"f527145f657a5a99d32c301c591f461f2230e3b9"},{"name":"user-data","children":[{"name":"user-data.sh","path":"examples/openvpn-host/user-data/user-data.sh","sha":"efee4866142d928414e821e5bde470f5bdb1a2bf"}]},{"name":"vars.tf","path":"examples/openvpn-host/vars.tf","sha":"377921b5d6fb85a8151889d006fa54f990cfbd7d"}]},{"name":"packer-duo","children":[{"name":"README.md","path":"examples/packer-duo/README.md","sha":"d885b8114f2af50fb01d4707e56bb81ae79da798"},{"name":"build.json","path":"examples/packer-duo/build.json","sha":"3ba57df06d4fc7115ce6afaaaaf02eae2a53c857"}]},{"name":"packer","children":[{"name":"README.md","path":"examples/packer/README.md","sha":"7c3444a90e7bd6ffd8dd0d281439a03d01827d68"},{"name":"build.json","path":"examples/packer/build.json","sha":"0202c80862a2758391cb07b3753ffc6d76f20f38"}]}]},{"name":"modules","children":[{"name":"backup-openvpn-pki","children":[{"name":"README.md","path":"modules/backup-openvpn-pki/README.md","sha":"d271084a97e3ea953afb0e9e690fac951bb6be6d"},{"name":"bin","children":[{"name":"backup-openvpn-pki","path":"modules/backup-openvpn-pki/bin/backup-openvpn-pki","sha":"ac4b49684ea0dc776449f786473975fc98db79b5"}]},{"name":"install.sh","path":"modules/backup-openvpn-pki/install.sh","sha":"af225b1dcd43eaab802a9e8040b3d39e25dd46a0"}]},{"name":"init-openvpn","children":[{"name":"README.md","path":"modules/init-openvpn/README.md","sha":"3a55b2c92611085870730ea15d589723b31dc775"},{"name":"bin","children":[{"name":"init-openvpn","path":"modules/init-openvpn/bin/init-openvpn","sha":"9d37721e8910585a9259bb5209f6485669bd539b"}]},{"name":"install.sh","path":"modules/init-openvpn/install.sh","sha":"9a41f990f62b2a9b526edfa813075cff277e1312"}]},{"name":"install-openvpn","children":[{"name":"README.md","path":"modules/install-openvpn/README.md","sha":"6073ab56f3a3ca0a69ca949a8a1e6086d7797709"},{"name":"bin","children":[{"name":"install-openvpn","path":"modules/install-openvpn/bin/install-openvpn","sha":"21816693acc9c1d2d0024c0845629421afe8b780"}]},{"name":"files","children":[{"name":"before.rules","path":"modules/install-openvpn/files/before.rules","sha":"e9f11106dda0d258910a36d88b3cac05c0d85146"},{"name":"openvpn-client.ovpn","path":"modules/install-openvpn/files/openvpn-client.ovpn","sha":"3fe8af5d74c724399d2b2acaaac3e5d07889912f"},{"name":"ufw-default","path":"modules/install-openvpn/files/ufw-default","sha":"ff5e7f69b1f65a2760579d4aa7575b278273e56b"},{"name":"vars.local","path":"modules/install-openvpn/files/vars.local","sha":"b19ce7da2758a7792a05d7563201127f8b1542c9"}]},{"name":"install.sh","path":"modules/install-openvpn/install.sh","sha":"65c8ed227131e94e7db76f47093f05b953950d07"},{"name":"scripts","children":[{"name":"generate-wrapper.sh","path":"modules/install-openvpn/scripts/generate-wrapper.sh","sha":"34d49724be9c3555a886d3cf00cf9cdbcb2a43bf"},{"name":"revoke-wrapper.sh","path":"modules/install-openvpn/scripts/revoke-wrapper.sh","sha":"d158a871cdd70cfed92418b6618d81c6bef08bd7"}]}]},{"name":"openvpn-admin","children":[{"name":".dockerignore","path":"modules/openvpn-admin/.dockerignore","sha":"a725465aee245635a2bd129af54858ed32c84cb8"},{"name":"Dockerfile","path":"modules/openvpn-admin/Dockerfile","sha":"d8b2de7aeb782a31932157e3a4fb183333da4259"},{"name":"README.md","path":"modules/openvpn-admin/README.md","sha":"27e205afef3ce91fb229c359693de4a99c5651f7"},{"name":"_ci","children":[{"name":"build-and-test.sh","path":"modules/openvpn-admin/_ci/build-and-test.sh","sha":"7b57f49d2a5cbce5f3e833c6e3dac767a90a92fa"},{"name":"test.sh","path":"modules/openvpn-admin/_ci/test.sh","sha":"ba48b9b10f31ca3f2e41ee3ce85e04d6ae289657"}]},{"name":"docker-compose.yml","path":"modules/openvpn-admin/docker-compose.yml","sha":"9a1c04848275d1a302063301d55b811aa0d666ed"},{"name":"go.mod","path":"modules/openvpn-admin/go.mod","sha":"44e41500f5d20bfd3714531f7fb2c134bf11ddb4"},{"name":"go.sum","path":"modules/openvpn-admin/go.sum","sha":"570a198639c78d3f6489e37405d48ab31694adaf"},{"name":"openvpn-request-flow-diagram.svg","path":"modules/openvpn-admin/openvpn-request-flow-diagram.svg","sha":"4c170df3fd6cf76d4c8e0bed7e1f2dbd98c08942"},{"name":"openvpn-revoke-flow-diagram.png","path":"modules/openvpn-admin/openvpn-revoke-flow-diagram.png","sha":"ccf48d05e3a492188900dfe73ea2fbc4eb3a3e29"},{"name":"scripts","children":[{"name":"build-linux-binary.sh","path":"modules/openvpn-admin/scripts/build-linux-binary.sh","sha":"3dfe844499b28878ebbb177453887bc786aec4de"},{"name":"run.sh","path":"modules/openvpn-admin/scripts/run.sh","sha":"bbcb7f9bdf8578561226954669cdb3e886093fcb"}]},{"name":"src","children":[{"name":"app","children":[{"name":"app.go","path":"modules/openvpn-admin/src/app/app.go","sha":"993c9a33f89665465c5831a95854a211fff95f07"},{"name":"cert_helpers.go","path":"modules/openvpn-admin/src/app/cert_helpers.go","sha":"020446eb604694f4e7d96157147ca8a1889d72bb"},{"name":"cmd_process_certificate_requests.go","path":"modules/openvpn-admin/src/app/cmd_process_certificate_requests.go","sha":"f877a0fb09e0b6977c9a1c0a4478f9c632baea83"},{"name":"cmd_process_certificate_revocation_requests.go","path":"modules/openvpn-admin/src/app/cmd_process_certificate_revocation_requests.go","sha":"f2ec206f8fc9c95e59994ffe9af2a0b7ded5e851"},{"name":"cmd_request_new_certificate.go","path":"modules/openvpn-admin/src/app/cmd_request_new_certificate.go","sha":"9b915491d82a5a9a9c3f62eb02ce1965fb5f17b0"},{"name":"cmd_revoke_certificate.go","path":"modules/openvpn-admin/src/app/cmd_revoke_certificate.go","sha":"d9990767edf3b8a38e16f8bb693e600a5471c7b5"},{"name":"common.go","path":"modules/openvpn-admin/src/app/common.go","sha":"c4719d234436c76dee9950728e6654ec0227c187"},{"name":"common_test.go","path":"modules/openvpn-admin/src/app/common_test.go","sha":"95a41eb26136556b11fdcd1e5b731f6700b5dfc9"},{"name":"flags.go","path":"modules/openvpn-admin/src/app/flags.go","sha":"74ac1d6b6880488fe671168b9abe9c996835d833"}]},{"name":"aws_helpers","children":[{"name":"iam.go","path":"modules/openvpn-admin/src/aws_helpers/iam.go","sha":"2f9b35480c85953fb0c9de1039562eadf4b798be"},{"name":"imds.go","path":"modules/openvpn-admin/src/aws_helpers/imds.go","sha":"96b9d20847c8a3172b926b506b4ba4a02dc9d753"},{"name":"sqs.go","path":"modules/openvpn-admin/src/aws_helpers/sqs.go","sha":"16e133d97e6f28e470c44aad18870dfe8e4685c9"}]},{"name":"main.go","path":"modules/openvpn-admin/src/main.go","sha":"b3a10913aa75a4032e52a071f1b88033ef10a29c"},{"name":"ping_helpers","children":[{"name":"ping_darwin.go","path":"modules/openvpn-admin/src/ping_helpers/ping_darwin.go","sha":"2322b41ee20f31a9312d1f3fdff02c3f81bca38a"},{"name":"ping_linux.go","path":"modules/openvpn-admin/src/ping_helpers/ping_linux.go","sha":"2890ee14fcaf9360e6d800648e7b272b78ea1fed"},{"name":"ping_windows.go","path":"modules/openvpn-admin/src/ping_helpers/ping_windows.go","sha":"a61dc1671a7726907d77693e25e2679a0b8cc856"}]}]}]},{"name":"openvpn-server","children":[{"name":"README.md","path":"modules/openvpn-server/README.md","sha":"2b783ba0b817778cb304f4c30afaec0335b2b550","toggled":true},{"name":"main.tf","path":"modules/openvpn-server/main.tf","sha":"6c8370d9d619bd0f4b2bd32ff24c748fff156ad3"},{"name":"outputs.tf","path":"modules/openvpn-server/outputs.tf","sha":"47f8161b74e4e659bcaee4b985e246cae8dba8ba"},{"name":"vars.tf","path":"modules/openvpn-server/vars.tf","sha":"38550f0e31114097606cb588caf12807f3a6d973"}],"toggled":true},{"name":"start-openvpn-admin","children":[{"name":"README.md","path":"modules/start-openvpn-admin/README.md","sha":"0c9902a49939a60e80a57fa0f39bfbb50eafd40a"},{"name":"bin","children":[{"name":"run-process-requests","path":"modules/start-openvpn-admin/bin/run-process-requests","sha":"6c8c52b3a6b6d58fd9cedfa40212071a27cc703c"},{"name":"run-process-revokes","path":"modules/start-openvpn-admin/bin/run-process-revokes","sha":"28a93d013eebb6cea2101eb81629431d25b9523b"}]},{"name":"install.sh","path":"modules/start-openvpn-admin/install.sh","sha":"2af5af7f24c40136b22d50cb8cec47f7a9d2b2ac"}]}],"toggled":true},{"name":"terraform-cloud-enterprise-private-module-registry-placeholder.tf","path":"terraform-cloud-enterprise-private-module-registry-placeholder.tf","sha":"ae586c0fe830819580e1009d41a9074f16e65bed"},{"name":"test","children":[{"name":"README.md","path":"test/README.md","sha":"4b3181d73fbda21def58c97980d8710666d303c0"},{"name":"go.mod","path":"test/go.mod","sha":"428a622c865433781f54d3327e6710cb5068ce85"},{"name":"go.sum","path":"test/go.sum","sha":"fe6dca7eb505cd85cfbc9e3ca56e859cab8833ed"},{"name":"local-test","children":[{"name":"docker-compose.yml","path":"test/local-test/docker-compose.yml","sha":"e69de29bb2d1d6434b8b29ae775ad8c2e48c5391"}]},{"name":"openvpn_test.go","path":"test/openvpn_test.go","sha":"53b401203ad195d9b35c7c5ed88ac1245a77bf20"},{"name":"validation","children":[{"name":"validate_all_modules_and_examples_test.go","path":"test/validation/validate_all_modules_and_examples_test.go","sha":"33d73c385b64c4fc870033e99427e683c31dc45a"}]}]}]},"detailsContent":"<h1 class=\"preview__body--title\" id=\"open-vpn-server-module\">OpenVPN Server Module</h1><div class=\"preview__body--border\"></div><p>This module makes it easy to deploy an OpenVPN server in an auto-scaling group (size 1) for fault tolerance --along with the all the resources it typically needs:</p>\n<ol>\n<li>The Auto-Scaling Group.</li>\n<li>An EC2 Instance</li>\n<li>An Elastic IP (EIP) address.</li>\n<li>IAM Role and IAM instance profile.</li>\n<li>Simple Queuing Services (SQS) Queues</li>\n<li>An S3 Bucket for certificate backups</li>\n<li>Security groups.</li>\n</ol>\n<h2 class=\"preview__body--subtitle\" id=\"how-do-you-use-this-module\">How do you use this module?</h2>\n<ul>\n<li>See the <a href=\"/repos/v0.15.2/package-openvpn/README.md\" class=\"preview__body--description--blue\">root README</a> for instructions on using Terraform modules.</li>\n<li>See the <a href=\"/repos/v0.15.2/package-openvpn/examples\" class=\"preview__body--description--blue\">examples</a> folder for example usage.</li>\n<li>See <a href=\"/repos/v0.15.2/package-openvpn/modules/openvpn-server/vars.tf\" class=\"preview__body--description--blue\">vars.tf</a> for all the variables you can set on this module.</li>\n</ul>\n<h2 class=\"preview__body--subtitle\" id=\"how-do-i-access-the-server\">How do I access the server?</h2>\n<p>This module include several <a href=\"https://www.terraform.io/intro/getting-started/outputs.html\" class=\"preview__body--description--blue\" target=\"_blank\">Terraform outputs</a>,\nincluding:</p>\n<ol>\n<li><code>public_ip</code>: The public IP address of the server (via its EIP)</li>\n</ol>\n<h2 class=\"preview__body--subtitle\" id=\"how-do-i-add-custom-security-group-rules\">How do I add custom security group rules?</h2>\n<p>One of the other important outputs of this module is the <code>security_group_id</code>, which is the id of the server's Security\nGroup. You can add custom rules to this Security Group using the <code>aws_security_group_rule</code> resource:</p>\n<pre><span class=\"hljs-keyword\">module</span> <span class=\"hljs-string\">\"openvpn\"</span> {\n source = <span class=\"hljs-string\">\"git::git@github.com:gruntwork-io/terraform-aws-openvpn.git//modules/openvpn-server?ref=v0.0.40\"</span>\n\n <span class=\"hljs-comment\"># (... options omitted...)</span>\n}\n\n<span class=\"hljs-comment\"># Custom rule to allow inbound HTTPS traffic from anywhere</span>\n<span class=\"hljs-keyword\">resource</span> <span class=\"hljs-string\">\"aws_security_group_rule\"</span> <span class=\"hljs-string\">\"allow_inbound_https_all\"</span> {\n type = <span class=\"hljs-string\">\"ingress\"</span>\n from_port = <span class=\"hljs-number\">443</span>\n to_port = <span class=\"hljs-number\">443</span>\n protocol = <span class=\"hljs-string\">\"tcp\"</span>\n cidr_blocks = [<span class=\"hljs-string\">\"0.0.0.0/0\"</span>]\n security_group_id = <span class=\"hljs-string\">\"<span class=\"hljs-variable\">${module.openvpn.security_group_id}</span>\"</span>\n}\n</pre>\n<h2 class=\"preview__body--subtitle\" id=\"how-do-i-add-a-custom-iam-policy\">How do I add a custom IAM policy?</h2>\n<p>This module creates an IAM role for your EC2 instance and exports the id of that role as the output <code>iam_role_id</code>. You\ncan attach custom policies to this IAM role using the <code>aws_iam_policy_attachment</code> resource:</p>\n<pre>module <span class=\"hljs-string\">\"openvpn\"</span> {\n source = <span class=\"hljs-string\">\"git::git@github.com:gruntwork-io/terraform-aws-openvpn.git//modules/openvpn-server?ref=v0.0.40\"</span>\n\n # (<span class=\"hljs-built_in\">..</span>. options omitted<span class=\"hljs-built_in\">..</span>.)\n}\n<span class=\"hljs-built_in\">\nresource </span><span class=\"hljs-string\">\"aws_iam_policy\"</span> <span class=\"hljs-string\">\"my_custom_policy\"</span> {\n name = <span class=\"hljs-string\">\"my-custom-policy\"</span>\n <span class=\"hljs-built_in\"> policy </span>= <span class=\"hljs-string\">\" (... omitted ...) \"</span>\n}\n<span class=\"hljs-built_in\">\nresource </span><span class=\"hljs-string\">\"aws_iam_policy_attachment\"</span> <span class=\"hljs-string\">\"attachment\"</span> {\n name = <span class=\"hljs-string\">\"example-attachment\"</span>\n roles = [<span class=\"hljs-string\">\"<span class=\"hljs-variable\">${module.openvpn.iam_role_id}</span>\"</span>]\n policy_arn = <span class=\"hljs-string\">\"<span class=\"hljs-variable\">${aws_iam_policy.my_custom_policy.arn}</span>\"</span>\n}\n</pre>\n<h2 class=\"preview__body--subtitle\" id=\"what-if-i-want-to-enable-mfa\">What if I want to enable MFA?</h2>\n<p>The scripts <a href=\"/repos/v0.15.2/package-openvpn/modules/init-openvpn\" class=\"preview__body--description--blue\">init-openvpn</a> and <a href=\"/repos/v0.15.2/package-openvpn/modules/install-openvpn\" class=\"preview__body--description--blue\">install-openvpn</a> support setting up the\n<a href=\"https://github.com/duosecurity/duo_openvpn\" class=\"preview__body--description--blue\" target=\"_blank\">duo_openvpn</a> plugin for 2FA authentication. To enable the duo plugin, you\nneed to:</p>\n<ol>\n<li>\n<p>Build an AMI that has the <code>duo_openvpn</code> plugin installed. You can use <code>install-openvpn</code> to install the plugin\nalongside openvpn by passing in the argument <code>--duo-version</code>. For example:</p>\n<p>sudo /usr/local/bin/install-openvpn --duo-version 2.2</p>\n</li>\n<li>\n<p>In the <code>user_data</code> script for the server, pass in the duo keys to <code>init-openvpn</code> using the arguments <code>--duo-ikey</code>,\n<code>--duo-skey</code>, and <code>--duo-host</code> to configure the integration key, secret key, and API hostname respectively. You can\nobtain these by following <a href=\"https://duo.com/docs/openvpn\" class=\"preview__body--description--blue\" target=\"_blank\">the Duo setup instructions for OpenVPN</a>.</p>\n</li>\n</ol>\n<p>See the <a href=\"/repos/v0.15.2/package-openvpn/modules/examples/packer-duo\" class=\"preview__body--description--blue\">packer-duo</a> and <a href=\"/repos/v0.15.2/package-openvpn/modules/examples/openvpn-host-duo\" class=\"preview__body--description--blue\">openvpn-host-duo</a> examples for an\nexample configuration to deploy the OpenVPN server with Duo enabled.</p>\n<p>Once the plugin is setup, all authentication for the client will result in a password prompt. To authenticate, you pass\nin the MFA token in the password prompt, or <code>push</code> if you have push authentication enabled in duo. Note that in order\nfor 2FA to work, the certificate username (the value for <code>--username</code> when running <code>openvpn-admin request</code>) should\nexactly match the duo username.</p>\n","repoName":"package-openvpn","repoRef":"v0.17.1","serviceDescriptor":{"serviceName":"OpenVPN","serviceRepoName":"package-openvpn","serviceRepoOrg":"gruntwork-io","cloudProviders":["aws"],"description":"Deploy an OpenVPN server. Supports auto healing, public key infrastructure (PKI), cert backup, and managing user accounts using IAM groups.","imageUrl":"openvpn.png","licenseType":"subscriber","technologies":["Terraform","Bash","Go"],"compliance":[],"tags":[""]},"serviceCategoryName":"Client VPN access","fileName":"README.md","filePath":"/modules/openvpn-server","title":"Repo Browser: OpenVPN","description":"Browse the repos in the Gruntwork Infrastructure as Code Library."}
.circleci
main.tf
