DIY: Free Self-Hosted VPN on AWS Using Terraform & OpenVPN

Watch the video demonstration here

Read the full documentation for this project on My Project Documentation website

Introduction

• Configure and customize the Terraform script to suit your needs.
• Deploy a fully functional VPN server in under 5 minutes.
• Maintain internet privacy and security without relying on subscription-based VPN services.

Prerequisites

• An AWS account (a free-tier account works).
• Terraform is installed on your local machine (How to Install Terraform).
• OpenVPN Connect Client installed (download here).
• Your AWS Access Key ID and Secret Access Key (learn how to get your AWS access keys here).
• AWS CLI installed and configured with your Access Key ID and Secret Access Key (AWS CLI Setup Guide).
• My OpenVPN-Terraform Setup Script (get the script here).

What the Terraform Configuration Script Does

• Creating a Ubuntu 22.04 EC2 instance and configuring OpenVPN Access Server on it.
• Using the t2.micro instance type to stay within AWS’ free-tier limits.
• Configuring the VPN server with an IP address in your selected AWS region.
• Generating and downloading an AWS keypair file for optional SSH access.
• Creating and downloading an OpenVPN User Profile file (*.ovpn) from the server to the local machine for establishing encrypted VPN connections.
• Enabling a one-command teardown to clean up all local and online resources that were created.

How the Script Works

1. Infrastructure Setup: The script provisions an EC2 instance with the necessary network configurations, including opening the required ports on the server through the security group settings.
2. OpenVPN Installation: A userdata script is executed to bootstrap, install and configure the OpenVPN Access Server on the instance after it has been provisioned by terraform.
3. User Profile Creation: An OpenVPN User Profile (*.ovpn) file is generated on the server and downloaded to the local machine for further connection to the server.
4. Resource Cleanup: With one command, all AWS resources are destroyed, and local files are also deleted.

Customizing the Script

• project_name: Used labeling resources (e.g., “My-VPN-Project”).
• OpenVPN_instance_type: Default is t2.micro for free-tier compatibility, but you can choose another type if needed.
• openvpn_user: Username for generating the *.ovpn profile file.
• selected_region: Choose the AWS region where the server will be hosted (e.g., us-east-1, eu-west-2).

How to Setup the OpenVPN Server

1. Set Up AWS CLI: First, ensure that AWS CLI is installed and configured with your AWS access key ID and Secret access key (learn more about AWS CLI here)
2. Install Terraform: Install Terraform on your local machine (How to Install Terraform)
3. Download the Script: Clone the script repository to your local machine using this command:

1. Edit Variables (optional): Open the terraform.tfvars file in the script and update the values for project_name, openvpn_user and selected_region.
2. Change Directory: Switch to the cloned directory and initialize the Terraform script

1. Apply: Apply the terraform script with this command:

• The script will prompt for a region where you want your VPN server to be hosted. Enter a suitable AWS region e.g. ca-central-1 for Canada Central.
• (See list of acceptable AWS regions here)
• Wait for the script to finish execution. The script will provision your OpenVPN Server and also download the OpenVPN user profile (*.ovpn) file to local computer along with the generated AWS keypair file into the terraform working directory (i.e. the directory from where the terraform script was executed).
• You can optionally use the keypair file to SSH into the server for additional maintenance

Connecting to your Server

1. Install OpenVPN Connect Client on your local machine (Download it here)
2. Create a new VPN connection using the OpenVPN user profile file and connect to your server.

• Once connected, your internet traffic should now be routed through your VPN server.

Cleanup Resources

1. First, disconnect from the VPN Server
2. To delete the server and clean up all resources that were created, use the command below:

• This will prompt you again for the AWS region that was entered earlier; type the region and press enter.
• This will delete all files that were created locally and also delete all resources that were created in your AWS account (the ec2 instance, the security group, etc

Use Cases

1. Secure Remote Access: Connect securely to corporate or on-premises resources
2. Privacy & Anonymity: Encrypt internet traffic, especially on public Wi-Fi.
3. Cost Efficiency: Avoid subscription costs of commercial VPNs.
4. Location Masking: Access location-restricted content.
5. Development & Testing: Simulate network environments for application testing.
6. Enhanced Security: Add another layer of protection to your network.

Conclusion