【带图操作指南】使用 AWS Client VPN 实现从 AWS 到客户端设备的通信方法

#!/bin/bash

VPN_CONFIG="/etc/openvpn/client/client.ovpn"

# Check if OpenVPN process is running
if ! pgrep -f "openvpn --config $VPN_CONFIG" > /dev/null; then
    echo "$(date): OpenVPN process is not running. Attempting to reconnect..."
    sudo openvpn --config $VPN_CONFIG --daemon
else
    echo "$(date): OpenVPN process is already running. No action taken."
fi

* * * * * /usr/local/bin/check_vpn.sh >> /var/log/vpn_check.log 2>&1

import boto3
import json

def lambda_handler(event, context):
    
    # Resource information
    directory = '<Your Active Directory ID>'
    hostedzone = '<Your Route 53 Hosted Zone ID>'
    domain = 'user.workspaces'
    
    # Get username from event
    username = event.get('username')
    
    if not username:
        return {
            "allow": True,
            "error-msg-on-failed-posture-compliance": "Username not provided",
            "posture-compliance-statuses": [],
            "schema-version": "v2"
        }
    
    # Create WorkSpaces client
    workspaces_client = boto3.client('workspaces')
    
    # Get the user's WorkSpaces
    response = workspaces_client.describe_workspaces(
        DirectoryId=directory,
        UserName=username
    )
    workspaces = response.get('Workspaces', [])

    if not workspaces:

        lambda_client = boto3.client('lambda')
        payload = {
            "endpoint-id": event.get('endpoint-id'),
            "connection-id": event.get('connection-id'),
            "username": username,
            "domain": domain,
            "hostedzone-id": hostedzone
        }
        
        try:
            response = lambda_client.invoke(
                FunctionName="AWSClientVPN-CreateClientRecord",
                InvocationType='Event',
                Payload=json.dumps(payload)
            )
            print("Invoking Lambda for creating record")
            
        except Exception as e:
            print("Error invoking target Lambda:", e)
            raise

        return {
            "allow": True,
            "error-msg-on-failed-posture-compliance": f'No WorkSpaces found for user {username}',
            "posture-compliance-statuses": [],
            "schema-version": "v2"
        }
    
    # Start WorkSpaces
    workspace_id = workspaces[0]['WorkspaceId']
    workspaces_client.start_workspaces(
        StartWorkspaceRequests=[
            {'WorkspaceId': workspace_id}
        ]
    )
    
    # Get the IP address of the WorkSpaces
    workspace_ip = workspaces[0]['IpAddress']
    
    # Create a Route 53 client
    route53_client = boto3.client('route53')
    
    # Create a subdomain name
    subdomain = f"{username}.{domain}”
    
    # Create a record
   try:
        route53_client.change_resource_record_sets(
            HostedZoneId=hostedzone,
            ChangeBatch={
                'Changes': [
                    {
                        'Action': 'CREATE',
                        'ResourceRecordSet': {
                            'Name': subdomain,
                            'Type': 'A',
                            'TTL': 300,
                            'ResourceRecords': [{'Value': workspace_ip}]
                        }
                    }
                ]
            }
        )
        
    except Exception as ex:
        route53_client.change_resource_record_sets(
            HostedZoneId=hostedzone,
            ChangeBatch={
                'Changes': [
                    {
                        'Action': 'UPSERT',
                        'ResourceRecordSet': {
                            'Name': subdomain,
                            'Type': 'A',
                            'TTL': 300,
                            'ResourceRecords': [{'Value': workspace_ip}]
                        }
                    }
                ]
            }
        )    
    
    return {
        "allow": True,
        "error-msg-on-failed-posture-compliance": f'Successfully started WorkSpaces for user {username}',
        "posture-compliance-statuses": [],
        "schema-version": "v2"
    }

aws iam put-role-policy \
    --role-name LambdaRole-WorkSpaces \
    --policy-name DescribeVpnAndInvokeLambda \
    --policy-document '{
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": "ec2:DescribeClientVpnConnections",
                "Resource": "*"
            },
            {
                "Effect": "Allow",
                "Action": "lambda:InvokeFunction",
                "Resource": "*"
            }
        ]
    }'

import boto3
import time

def lambda_handler(event, context):
    
    print("Start processing")
    time.sleep(60)
    print("Finished processing after delay")

    # Received event
    print("Received event:", event)

    # Getting client IP address
    endpoint_id = event.get('endpoint-id')
    connection_id = event.get('connection-id')
    ec2_client = boto3.client('ec2')
    try:
        connection_info = ec2_client.describe_client_vpn_connections(
            ClientVpnEndpointId=endpoint_id,
            Filters=[
                {
                    'Name': 'connection-id', 
                    'Values': [connection_id]
                }
            ],
        )
        client_ip = connection_info['Connections'][0]['ClientIp']
    except Exception as e:
        print("Error retrieving connection info:", e)
        return {
            "status": "error",
            "message": f"Failed to retrieve client IP for connection {connection_id}",
            "error": str(e)
        }

    # Getting client IP address
    username = event.get('username')
    hostedzone = event.get('hostedzone-id')
    domain = event.get('domain')
    subdomain = f"{username}.{domain}"
    route53_client = boto3.client('route53')
    try:
        route53_client.change_resource_record_sets(
            HostedZoneId=hostedzone,
            ChangeBatch={
                'Changes': [
                    {
                        'Action': 'CREATE',
                        'ResourceRecordSet': {
                            'Name': subdomain,
                            'Type': 'A',
                            'TTL': 300,
                            'ResourceRecords': [{'Value': client_ip}]
                        }
                    }
                ]
            }
        )
        
    except Exception as ex:
        route53_client.change_resource_record_sets(
            HostedZoneId=hostedzone,
            ChangeBatch={
                'Changes': [
                    {
                        'Action': 'UPSERT',
                        'ResourceRecordSet': {
                            'Name': subdomain,
                            'Type': 'A',
                            'TTL': 300,
                            'ResourceRecords': [{'Value': client_ip}]
                        }
                    }
                ]
            }
        )  
    
    return {
        "status": "success",
        "message": f"Route 53 record created/updated for {subdomain} with IP {client_ip}",
        "record": {
            "name": subdomain,
            "type": "A",
            "value": client_ip
        }
    }

Onpre1
P@ssW0rd

client
dev tun
proto udp
remote cvpn-endpoint-0123456abcd123456.prod.clientvpn.us-east-1.amazonaws.com 443
remote-random-hostname
resolv-retry infinite
nobind
remote-cert-tls server
cipher AES-256-GCM
verb 3
<ca>
-----BEGIN CERTIFICATE-----
MIIDfzCCAmegAwIBAgIJAOA5PQH+hP7rMA0GCSqGSIb3DQEBCwUAMF8xCzAJBgNV
BAYTAkpQMQswCQYDVQQIDAJUTzEPMA0GA1UEBwwGVE9LT1lPMRMwEQYDVQQKDApU
ZXN0IENvbXBhbnkxEDAOBgNVBAMMB0NhIFJvb3QwHhcNMjAwMTAxMDAwMDAwWhcN
MzAwMTAxMDAwMDAwWjBfMQswCQYDVQQGEwJKUDELMAkGA1UECAwCVE8xDzANBgNV
BAcMBlRPS09ZTzETMBEGA1UECgwKVGVzdCBDb21wYW55MRAwDgYDVQQDDAdDYXIg
Um9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALcU5uHP+WOrBaY2
yz3s1cHL3AOPl0RxCZDLu5rDZbBvlk39awQJKIF7CxZECt/DzOMm0eQzImsnOUxp
ciTV0D9+H/Q+dBxQnnMeJ/yf9lC0ESYBCJhzXPEzZs8zNcAbGMBofFPKOP1P1bYh
oxvBqYw0vukPEXMCAwEAAaNTMFEwHQYDVR0OBBYEFHX6P8hUt9j2ZZe6ED69Czfq
Xm0uMB8GA1UdIwQYMBaAFHX6P8hUt9j2ZZe6ED69CzfqXm0uMA8GA1UdEwEB/wQF
MAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFxAjswEUOgW4uz5Bj5ViX3gWpF98UXg
3yY1P32PzVgOhKw==
-----END CERTIFICATE-----
</ca>
auth-user-pass /auth.txt

reneg-sec 0

verify-x509-name server name

client
dev tun
proto udp
remote cvpn-endpoint-0123456abcd123456.prod.clientvpn.us-east-1.amazonaws.com 443
remote-random-hostname
resolv-retry infinite
nobind
remote-cert-tls server
cipher AES-256-GCM
verb 3
<ca>
-----BEGIN CERTIFICATE-----
MIIDfzCCAmegAwIBAgIJAOA5PQH+hP7rMA0GCSqGSIb3DQEBCwUAMF8xCzAJBgNV
BAYTAkpQMQswCQYDVQQIDAJUTzEPMA0GA1UEBwwGVE9LT1lPMRMwEQYDVQQKDApU
ZXN0IENvbXBhbnkxEDAOBgNVBAMMB0NhIFJvb3QwHhcNMjAwMTAxMDAwMDAwWhcN
MzAwMTAxMDAwMDAwWjBfMQswCQYDVQQGEwJKUDELMAkGA1UECAwCVE8xDzANBgNV
BAcMBlRPS09ZTzETMBEGA1UECgwKVGVzdCBDb21wYW55MRAwDgYDVQQDDAdDYXIg
Um9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALcU5uHP+WOrBaY2
yz3s1cHL3AOPl0RxCZDLu5rDZbBvlk39awQJKIF7CxZECt/DzOMm0eQzImsnOUxp
ciTV0D9+H/Q+dBxQnnMeJ/yf9lC0ESYBCJhzXPEzZs8zNcAbGMBofFPKOP1P1bYh
oxvBqYw0vukPEXMCAwEAAaNTMFEwHQYDVR0OBBYEFHX6P8hUt9j2ZZe6ED69Czfq
Xm0uMB8GA1UdIwQYMBaAFHX6P8hUt9j2ZZe6ED69CzfqXm0uMA8GA1UdEwEB/wQF
MAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFxAjswEUOgW4uz5Bj5ViX3gWpF98UXg
3yY1P32PzVgOhKw==
-----END CERTIFICATE-----
</ca>
auth-user-pass C:\\Users\\user1\\Desktop\\auth.txt

reneg-sec 0

verify-x509-name server name

#!/bin/bash

VPN_CONFIG="client.ovpn"

# Check if OpenVPN process is running
if ! pgrep -f "openvpn --config $VPN_CONFIG" > /dev/null; then
    echo "$(date): OpenVPN process is not running. Attempting to reconnect..."
    sudo openvpn --config $VPN_CONFIG --daemon
else
    echo "$(date): OpenVPN process is already running. No action taken."
fi

@echo off
:: Path to the OpenVPN executable
set OPENVPN_PATH="C:\Program Files\OpenVPN\bin\openvpn.exe"

:: Configuration file name (the .ovpn extension can be omitted)
set CONFIG_FILE=client

:: Check the connection status
tasklist | find /I "openvpn.exe" >nul
if %ERRORLEVEL%==0 (
    echo [%date% %time%] OpenVPN is already running.
    exit /b
)

:: Start the OpenVPN connection
echo [%date% %time%] Starting OpenVPN connection...
%OPENVPN_PATH% --config "C:\Program Files\OpenVPN\config\%CONFIG_FILE%.ovpn" --log "C:\Program Files\OpenVPN\log\%CONFIG_FILE%.log"

:: Verify connection (optional)
if %ERRORLEVEL%==0 (
    echo [%date% %time%] OpenVPN connected successfully.
) else (
    echo [%date% %time%] OpenVPN connection failed. Check log for details.
)

exit /b