AWS Client VPNを試してみた

Slide 1

Slide 1 text

2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ ϥϯαʔζגࣜձࣾ  43&ʗ҆ୡྋ ͋ͩͪΜ AWS Client VPNΛ ࢼͯ͠Έͨ

Slide 2

Slide 2 text

ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ɹΞδΣϯμ ɾࣗݾ঺հ ɾAWS Client VPNͬͯͲ͏ͳͷΑʁ ɾ΍Γ͍ͨ͜ͱ ɾߏ੒ ɾϨΠςϯγ ɾϩά ɾσϞ ɾϋϚͬͨͱ͜Ζ ɾ·ͱΊ

Slide 3

Slide 3 text

ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ࣗݾ঺հ - name: Introduction me user: name: adachin work: SRE/Hiring Recruitment detail: aws analytical base menta  skill: ansible terraform shell etc  blog: blog.adachin.me  oss: Vuls https://www.wantedly.com/companies/lancers/post_articles/151653

Slide 4

Slide 4 text

ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ AWS Client VPNͬͯͲ͏ͳͷΑʁ https://blog.adachin.me/archives/9813

Slide 5

Slide 5 text

2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ Ϛωʔδυ ΊͪΌͪ͘Ό͍͍!!!

Slide 6

Slide 6 text

ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ΍Γ͍ͨ͜ͱ ɾΦϨΰϯʹVPC01ͱAWS Client VPNͷઃఆ   ɾ౦ژϦʔδϣϯʹVPC02,VPC03Λ2ͭઃఆ   ɾVPC01(ΦϨΰϯ)ͱVPC02,03(౦ژ)ΛVPCϐΞϦϯάͰ઀ଓ   ɾVPC01,VPC02,VPC03ͦΕͧΕʹEC2ͷߏங   ɾAWS Client VPNͷϢʔβʔ࡞੒(ূ໌ॻɺ伴)   ɾ઀ଓͨ͠ࡍͷϩάʢCloudWatch Logs)͕औಘͰ͖Δ͜ͱΛ֬ೝ   ɾVPNܦ༝ͰEC2ʹSSHͰ͖Δ͔֬ೝ   ɾϨΠςϯγͷ֬ೝ

Slide 7

Slide 7 text

ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ߏ੒

Slide 8

Slide 8 text

ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ߏ੒ ɾVPC01/ΦϨΰϯ ɾeasy-rsa  CIDR 10.0.0.0/16 OpenVPNͷϢʔςΟϦςΟ  subnet 10.0.0.0/24 10.0.1.0/24 αʔόূ໌ॻɺ伴ͷ࡞੒    ɾVPC02,VPC03/౦ژ   CIDR 10.10.0.0/16 10.20.0.0/16 Subnet 10.10.0.0/24 10.20.0.0/24 ɾTuunelblick 

Slide 9

Slide 9 text

2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ ઃఆʹ͍ͭͯ͸… ϒϩάݟ͍ͯͩ͘͞!!!!

Slide 10

Slide 10 text

2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ ϨΠςϯγͱ͔Ͳ͏ͳΜʁ

Slide 11

Slide 11 text

ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ϨΠςϯγ $ ping 10.0.0.189 PING 10.0.0.189 (10.0.0.189): 56 data bytes 64 bytes from 10.0.0.189: icmp_seq=0 ttl=254 time=127.708 ms 64 bytes from 10.0.0.189: icmp_seq=1 ttl=254 time=127.965 ms 64 bytes from 10.0.0.189: icmp_seq=2 ttl=254 time=128.099 ms 64 bytes from 10.0.0.189: icmp_seq=3 ttl=254 time=127.861 ms 64 bytes from 10.0.0.189: icmp_seq=4 ttl=254 time=127.784 ms 64 bytes from 10.0.0.189: icmp_seq=5 ttl=254 time=127.855 ms ^C --- 10.0.0.189 ping statistics --- 6 packets transmitted, 6 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 127.708/127.879/128.099/0.126 ms  $ ifconfig utun1 utun1: flags=8051 mtu 1500 inet 10.110.1.98 --> 10.110.1.98 netmask 0xffffffe0

Slide 12

Slide 12 text

2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ VPNͷϩάͱ͔औΕΔΜʁ

Slide 13

Slide 13 text

ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ϩά CloudWatch LogsͰશ෦ݟΕΔʂ

Slide 14

Slide 14 text

2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ σϞ΍Γ·͢

Slide 15

Slide 15 text

2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ ͜͜Ͱ໰୊͕!….

Slide 16

Slide 16 text

2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ ͱࢥ͍͖΍…  Πϯλʔωοτ͕ܨ͕Βͳ͍ "

Slide 17

Slide 17 text

ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ϋϚͬͨͱ͜Ζ https://inamuu.com/aws-client-vpn ɾͦ΋ͦ΋ssh͸Ͱ͖Δ͕ɺΠϯλʔωοτ͕઀ଓͰ͖ͳ͍ ɾϧʔτ௥Ճ ɾauthorization ruleʹΠϯλʔωοτ΁ͷΞΫηεΛڐՄ  ɾެࣜΛՇ!!

Slide 18

Slide 18 text

ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ɹ·ͱΊ ɾOpenVPNαʔόӡ༻͍Βͣ ɾΦϨΰϯ͕ͩे෼ૣ͍ ɾϩά͸CloudWatch Logsʹ ɾαʔόূ໌ॻɺ伴Λ؅ཧ͢Δඞཁ͕͋Δ ɾϓϩΩγɺBastion΋EIP΋ৼΒͳͯ͘ྑ͖ ɾطଘͷαʔόূ໌ॻΛ࢖ͬͯVPN͸࡞੒Ͱ͖Δ ɾΞΧ΢ϯτ࡟আͱ͍͏֓೦Ͱ͸ͳ͘ূ໌ॻΛrevoke ɾϥϯαʔζ΋ಋೖ͢Δ༧ఆʂʂ

Slide 19

Slide 19 text

2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ ͝ਗ਼ௌ͋Γ͕ͱ͏  ͍͟͝·ͨ͠ʂʂ