Fast VPN setup with AWS Lightsail and Wireguard

2023-06-07 15:37:25

When shopper VPN’s hit the mainstream 8-10 years in the past (I’m speaking about issues like Mulvad/Nord/and so forth..) it amazed me how many individuals (together with some good folks I do know and work with) jumped on the bandwagon as a result of they didn’t need their ISP spying on their site visitors. After I requested them why they felt the nameless VPN operator was extra reliable than a regulated ISP in america the response was normally a protracted pause; They’d not thought of that it was potential for the VPN operator to do the very same factor. Anyhow, I digress.

So let’s say you need to tunnel site visitors by way of one other nation to check your service or disguise your site visitors by way of one other server for another motive. I’m assuming you’re doing authorized issues right here and never going to get into the extra rigorous particulars of OPSEC, dns leakage, or chained connections. I’m additionally not going to speak about alternate options like leveraging proxy servers by way of issues like Shadowsocks or reverse ssh tunnels. It will probably get advanced fast and every little thing is tradeoffs.

You want two issues. A distant server and a wireguard connection.

AWS has a service known as Lightsail. It’s a fast and simple method to rise up a server with out a number of the complexities (and choices) that EC2 gives. Comparable providers are supplied by the large cloud suppliers like Google’s GCP or Micrsoft’s Azure and a bunch of different platforms like DigitalOcean, Linode, Vultr, and Scaleway. Which one you utilize is as much as you and entails a lot of tradeoffs which can be past the scope of this text.

Wireguard has been round for just a few years now however continues to be comparatively “new” to lots of people. I heard about it again in 2018 and bear in mind the awe at how rapidly the connection established and the way performant it was with restricted assets. Manner higher than the IPSec / L2TP stuff I had been utilizing. Linus finally picked it up again in early 2020 and since then adoption has been slowly taking place with groups like Tailscale main the way in which and layering in consumer pleasant authentication/authorization that the wireguard protocol natively lacks. Pritunl and Zerotier have additionally added assist and it powers Cloudflare’s WARP.

There are lots of tutorials on the market on these items however I’m going to imagine you already know your means round a terminal and are pretty skilled. So right here’s are the fundamental steps and a few code I cobbled collectively (github repo here)

Necessities

Have an AWS Account, put in the aws cli and configured it with auth credentials.
Generate a pub/personal keypair

Obtain the wireguard client and configure a brand new Tunnel. You will want the general public key to repeat to the server you setup within the subsequent step. And you’ll need to swap out the server pub key and ip:port along with your servers as soon as it’s setup.

#!/bin/zsh
KEYPAIRFILE='~/.ssh/id_rsa.pub'
KEYPAIRNAME=$(basename -s '.pub' ${KEYPAIRFILE})
MACHINENAME='wg001'
OS='ubuntu_22_04'
PORT='41194'
REGION='ap-south-1'

# add keypair
aws lightsail import-key-pair 
    --region ${REGION} 
    --key-pair-name ${KEYPAIRNAME} 
    --public-key-base64 $(base64 -i ${KEYPAIRFILE})

# Get the most affordable bundle
CHEAPBUNDLE=$(echo `aws lightsail get-bundles --query 'bundles[0].bundleId' --region ${REGION} --output textual content` | tr -d '"')

# Create the occasion
aws lightsail create-instances 
    --instance-names ${MACHINENAME} 
    --availability-zone  "${REGION}" 
    --blueprint-id ${OS} 
    --bundle-id ${CHEAPBUNDLE} 
    --key-pair-name ${KEYPAIRNAME}

# Wait a minute then seize the IP
EXTERNALIP=$(aws lightsail get-instance-access-details --instance-name ${MACHINENAME} --query 'accessDetails.ipAddress' --output textual content)

# Configure Lightsail Firewall.
# May use `open-instance-public-ports --port-info` if you wish to add to the foundations not take away the defaults
aws lightsail put-instance-public-ports 
    --instance-name ${MACHINENAME} 
    --region ${REGION} 
    --port-infos '[{"fromPort": 41194, "toPort": 41194, "protocol": "udp"}, {"fromPort": 22, "toPort": 22, "protocol": "tcp"}]'

# Print out the IP so we are able to ssh to it
echo $EXTERNALIP

#!/bin/zsh
# ssh and configure wireguard
ssh ubuntu@$EXTERNALIP
sudo apt replace -y && sudo apt set up wireguard -y

sudo -i
mkdir -m 0700 /and so forth/wireguard/
cd /and so forth/wireguard/
umask 077; wg genkey | tee privatekey | wg pubkey > publickey

#You will want the general public key to your shopper setup
cat publickey

ETHINT="eth0"
SRVRIP="10.99.99.1"
ALLOWEDIPS="10.99.99.0/24"
PEERPUBKEY='GET THIS FROM YOUR WIREGUARD CLIENT'

tee  /and so forth/wireguard/wg0.conf <<EOF
[Interface]
Deal with = $SRVRIP/24
ListenPort = 41194
PrivateKey = $(cat privatekey)
PostUp = iptables -t nat -A POSTROUTING -o $ETHINT -j MASQUERADE; ip6tables -t nat -A POSTROUTING -o $ETHINT -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o $ETHINT -j MASQUERADE; ip6tables -t nat -D POSTROUTING -o $ETHINT -j MASQUERADE

[Peer]
PublicKey = $PEERPUBKEY
AllowedIPs = $ALLOWEDIPS
EOF

ufw enable 41194/udp
ufw standing
echo 'internet.ipv4.ip_forward=1' | sudo tee -a /and so forth/sysctl.d/10-wireguard.conf
echo 'internet.ipv6.conf.all.forwarding=1' | sudo tee -a /and so forth/sysctl.d/10-wireguard.conf
sysctl -p /and so forth/sysctl.d/10-wireguard.conf
systemctl allow wg-quick@wg0
systemctl begin wg-quick@wg0
systemctl standing wg-quick@wg0
wg
ip a present wg0

Deliver your native connection up and it’s best to have a full tunnel wireguard server tunneling your site visitors by way of a unique a part of the world.

Whereas the bundle I chosen as a part of the Lightsail setup was the most affordable (~$5 a month) you solely get charged when it’s operating. So don’t neglect to cease it or delete it. Might solely price you just a few cents per thirty days ($5/720 = $0.007/hr)

aws lightsail delete-instance --region ${REGION} --instance-name ${MACHINENAME}

aws lightsail stop-instance --region ${REGION} --instance-name ${MACHINENAME}

Clearly I glossed over lots of issues right here. Like perhaps transfer the port to a much less frequent one than 41194. Or perhaps add a firewall rule to solely enable site visitors out of your IP. And naturally ensure your pub/personal keys have a passphrase. And a complete lot of different stuff. Or streamlining all of it into some native instructions that do all of it automagically on the fly by piping values round between the assorted scripts. However hopefully it’s skeleton to launch from. Glad VPN’ing.

Source Link