Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Speaker Deck
PRO
Sign in
Sign up
for free
AWS Client VPNを試してみた
rvirus0817
February 22, 2019
Technology
0
330
AWS Client VPNを試してみた
rvirus0817
February 22, 2019
Tweet
Share
More Decks by rvirus0817
See All by rvirus0817
rvirus0817
1
1.9k
rvirus0817
2
1.1k
rvirus0817
1
1.1k
rvirus0817
1
1k
rvirus0817
2
2k
rvirus0817
0
570
rvirus0817
2
2.1k
rvirus0817
1
3.1k
rvirus0817
1
2.3k
Other Decks in Technology
See All in Technology
twada
PRO
6
2k
miyake
1
420
torisoup
11
5.5k
clustervr
0
220
110y
1
11k
eller86
1
210
go5paopao
4
440
hanacchi
0
150
udzura
2
250
soracom
0
140
yamamuteki
3
680
ippey
2
180
Featured
See All Featured
schacon
145
6.6k
swwweet
206
6.9k
akmur
252
19k
andyhume
63
3.7k
morganepeng
18
1.2k
jacobian
255
20k
mongodb
23
3.9k
addyosmani
1346
190k
roundedbygravity
84
7.9k
chriscoyier
683
180k
philhawksworth
192
8.8k
afnizarnur
176
14k
Transcript
2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ ϥϯαʔζגࣜձࣾ 43&ʗ҆ୡྋ ͋ͩͪΜ AWS Client VPNΛ ࢼͯ͠Έͨ
ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ɹΞδΣϯμ ɾࣗݾհ ɾAWS Client VPNͬͯͲ͏ͳͷΑʁ ɾΓ͍ͨ͜ͱ ɾߏ
ɾϨΠςϯγ ɾϩά ɾσϞ ɾϋϚͬͨͱ͜Ζ ɾ·ͱΊ
ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ࣗݾհ - name: Introduction me user: name:
adachin work: SRE/Hiring Recruitment detail: aws analytical base menta skill: ansible terraform shell etc blog: blog.adachin.me oss: Vuls https://www.wantedly.com/companies/lancers/post_articles/151653
ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ AWS Client VPNͬͯͲ͏ͳͷΑʁ https://blog.adachin.me/archives/9813
2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ Ϛωʔδυ ΊͪΌͪ͘Ό͍͍!!!
ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ Γ͍ͨ͜ͱ ɾΦϨΰϯʹVPC01ͱAWS Client VPNͷઃఆ ɾ౦ژϦʔδϣϯʹVPC02,VPC03Λ2ͭઃఆ
ɾVPC01(ΦϨΰϯ)ͱVPC02,03(౦ژ)ΛVPCϐΞϦϯάͰଓ ɾVPC01,VPC02,VPC03ͦΕͧΕʹEC2ͷߏங ɾAWS Client VPNͷϢʔβʔ࡞(ূ໌ॻɺ伴) ɾଓͨ͠ࡍͷϩάʢCloudWatch Logs)͕औಘͰ͖Δ͜ͱΛ֬ೝ ɾVPNܦ༝ͰEC2ʹSSHͰ͖Δ͔֬ೝ ɾϨΠςϯγͷ֬ೝ
ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ߏ
ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ߏ ɾVPC01/ΦϨΰϯ ɾeasy-rsa CIDR 10.0.0.0/16 OpenVPNͷϢʔςΟϦςΟ subnet
10.0.0.0/24 10.0.1.0/24 αʔόূ໌ॻɺ伴ͷ࡞ ɾVPC02,VPC03/౦ژ CIDR 10.10.0.0/16 10.20.0.0/16 Subnet 10.10.0.0/24 10.20.0.0/24 ɾTuunelblick
2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ ઃఆʹ͍ͭͯ… ϒϩάݟ͍ͯͩ͘͞!!!!
2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ ϨΠςϯγͱ͔Ͳ͏ͳΜʁ
ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ϨΠςϯγ $ ping 10.0.0.189 PING 10.0.0.189 (10.0.0.189):
56 data bytes 64 bytes from 10.0.0.189: icmp_seq=0 ttl=254 time=127.708 ms 64 bytes from 10.0.0.189: icmp_seq=1 ttl=254 time=127.965 ms 64 bytes from 10.0.0.189: icmp_seq=2 ttl=254 time=128.099 ms 64 bytes from 10.0.0.189: icmp_seq=3 ttl=254 time=127.861 ms 64 bytes from 10.0.0.189: icmp_seq=4 ttl=254 time=127.784 ms 64 bytes from 10.0.0.189: icmp_seq=5 ttl=254 time=127.855 ms ^C --- 10.0.0.189 ping statistics --- 6 packets transmitted, 6 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 127.708/127.879/128.099/0.126 ms $ ifconfig utun1 utun1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500 inet 10.110.1.98 --> 10.110.1.98 netmask 0xffffffe0
2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ VPNͷϩάͱ͔औΕΔΜʁ
ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ϩά CloudWatch LogsͰશ෦ݟΕΔʂ
2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ σϞΓ·͢
2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ ͜͜Ͱ͕!….
2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ ͱࢥ͍͖… Πϯλʔωοτ͕ܨ͕Βͳ͍ "
ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ϋϚͬͨͱ͜Ζ https://inamuu.com/aws-client-vpn ɾͦͦsshͰ͖Δ͕ɺΠϯλʔωοτ͕ଓͰ͖ͳ͍ ɾϧʔτՃ ɾauthorization ruleʹΠϯλʔωοτͷΞΫηεΛڐՄ ɾެࣜΛՇ!!
ϥϯαʔζΫϥγίϜϕʔγοΫ߹ಉษڧձ ɹ·ͱΊ ɾOpenVPNαʔόӡ༻͍Βͣ ɾΦϨΰϯ͕ͩेૣ͍ ɾϩάCloudWatch Logsʹ ɾαʔόূ໌ॻɺ伴Λཧ͢Δඞཁ͕͋Δ ɾϓϩΩγɺBastionEIPৼΒͳͯ͘ྑ͖
ɾطଘͷαʔόূ໌ॻΛͬͯVPN࡞Ͱ͖Δ ɾΞΧϯτআͱ͍͏֓೦Ͱͳ͘ূ໌ॻΛrevoke ɾϥϯαʔζಋೖ͢Δ༧ఆʂʂ
2019/2/22 ϥϯαʔζ&ΫϥγίϜ&ϕʔγοΫ ߹ಉษڧձ ͝ਗ਼ௌ͋Γ͕ͱ͏ ͍͟͝·ͨ͠ʂʂ