Steps:
Step 1: Create EC2 Instance in AWS.
We need launch new instance with “Ubuntu Server 22.04 LTS Free tier eligible”
Step2: Connect EC2 Instance.
Connect to EC2 Instance with EC2 Instance Connect or SSH.
Step3: Install OpenVPN Server.
After successfully logging into the Ubuntu server, we can now start setting up OpenVPN. We will use the OpenVPN script available on Github (angristan script). We first need to update the default DNS of the Ubuntu instance. To update the DNS configuration, you must first switch the user account from “ubuntu” to “root” by running the following command:
sudo su
Once, you have the root user account, change default DNS to google DNS (8.8.8.8) in /run/systemd/resolve/stub-resolv.conf directory.
nano /run/systemd/resolve/stub-resolv.conf
Then set the nameserver to Google DNS
nameserver 8.8.8.8
options edns0 trust-ad
search .
To save the changes, press the CTRL+X+Y then Enter.
Installation using the OpenVPN script is quite easy. It is recommended that when you install a Linux service or module is to make sure that the system is up-to-date. Execute below command to check for updates of the libraries and modules.
apt-get update
apt-get upgrade
curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh
Then run it:
./openvpn-install.sh
You need to run the script as root and have the TUN module enabled.
Enter network interface IP address. By default, EC2 will give you a local IP address and the OpenVPN script will ask you for your Public IPv4 address or hostname. Copy the Public IP address of EC2 Instance, then press enter enter to proceed.
I need to know the IPv4 address of the network interface you want OpenVPN listening to.
Unless your server is behind NAT, it should be your public IPv4 address.
IP address: 1.1.1.1
It seems this server is behind NAT. What is its public IPv4 address or hostname?
We need it for the clients to connect to the server.
Public IPv4 address or hostname: 2.2.2.2
Then, disable the IPv6 support by entering “n” on the input field.
Enter default OpenVPN port by choosing 1.
What port do you want OpenVPN to listen to?
1) Default: 1194
2) Custom
3) Random [49152-65535]
Port choice [1-3]: 1
It is recommended to use UDP protocol for faster connection. Choose number 1 option.
What protocol do you want OpenVPN to use?
UDP is faster. Unless it is not available, you shouldn't use TCP.
1) UDP
2) TCP
Protocol [1-2]: 1
For this tutorial, you will use your current system resolver. Choose number 1 option.
What DNS resolvers do you want to use with the VPN?
1) Current system resolvers (from /etc/resolv.conf)
2) Self-hosted DNS Resolver (Unbound)
3) Cloudflare (Anycast: worldwide)
4) Quad9 (Anycast: worldwide)
5) Quad9 uncensored (Anycast: worldwide)
6) FDN (France)
7) DNS.WATCH (Germany)
8) OpenDNS (Anycast: worldwide)
9) Google (Anycast: worldwide)
10) Yandex Basic (Russia)
11) AdGuard DNS (Anycast: worldwide)
12) NextDNS (Anycast: worldwide)
13) Custom
DNS [1-12]: 1
Choose the default n option.
Do you want to use compression? It is not recommended since the VORACLE attack makes use of it.
Enable compression? [y/n]: n
Do Do you want to customize encryption settings?
Unless you know what you're doing, you should stick with the default parameters provided by the script.
Note that whatever you choose, all the choices presented in the script are safe. (Unlike OpenVPN's defaults)
See https://github.com/angristan/openvpn-install#security-and-encryption to learn more.
Customize encryption settings? [y/n]: n
Finally, your OpenVPN settings are now ready.
Okay, that was all I needed. We are ready to setup your OpenVPN server now.
You will be able to generate a client at the end of the installation.
Press any key to continue...
OpenVPN will start installing the required configurations and services. At the end of installation, OpenVPN will ask to enter client name to generate a client certificate. Then choose a passwordless client for your client certificate.
Follow the instruction on how to download the client certificate.
Now that you have successfully install the OpenVPN, start the OpenVPN service by executing the below command.
openvpn /etc/openvpn/server.conf
Check for tun0 interface if exist.
ip a
There you have it. Your OpenVPN server is now ready.
Step4: Configure EC2 Instance Security group
In order for the OpenVPN client to connect to the OpenVPN server, you need to configure the EC2 Security Group of Ubuntu instance. OpenVPN commonly uses UDP 1194 as a default port to which you need to add in EC2 Security group inbound rules.
Go to the EC2 dashboard and navigate to the Network & Security menu. Choose the Security Groups option, then choose the Security group name that was configured before.
In the bottom EC2 panel, go to the Security group rules menu, then choose the Inbound rules option. Choose Edit inbound rules button to add new inbound rules.
Choose Add rule then fill out the required input fields.
Save the new added rule.
Congratulations! You have successfully setup an OpenVPN server in AWS EC2 on Ubuntu 22:04 LTS instance.
Prerequisites:
AWS Account
Ubuntu 22.04 LTS EC2 Instance
Link: https://cytoolz.com/blog/openvpn-server-on-ubuntu22-04-ec2-instance