WireGuard VPN Server

Features

• Web UI for administration and to download the WireGuard configuration files
• SAML Support
• OIDC Support
• SCIM Support for provisioning
• EFS to persist configuration

Usage

Make sure to subscribe first to the Marketplace product at https://aws.amazon.com/marketplace/pp/prodview-dymnyb6a2pq72

module "vpn-server" {
	source             = "github.com/in4it/wireguard-vpn-server-terraform"
	instance_type      = "t3.small"
	vpc_id             = module.vpc.vpc_id
	instance_subnet_id = module.vpc.public_subnets[0]
	efs_subnet_ids     = [module.vpc.public_subnets[0]]
}

# example from https://github.com/terraform-aws-modules/terraform-aws-vpc
module "vpc" {
  source = "terraform-aws-modules/vpc/aws"

  name = "my-vpc"
  cidr = "10.0.0.0/16"

  azs             = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]

  enable_nat_gateway = true

  tags = {
    Terraform = "true"
    Environment = "dev"
  }
}

Requirements

No requirements.

Providers

Name	Version
aws	n/a

Modules

No modules.

Resources

Name	Type
aws_efs_file_system.vpn-server-config	resource
aws_efs_mount_target.vpn-server-config	resource
aws_eip.vpn-server	resource
aws_iam_instance_profile.vpn-server	resource
aws_iam_role.vpn-server-iam-role	resource
aws_iam_role_policy_attachment.vpn-iam-policy-attachment	resource
aws_instance.vpn-server	resource
aws_security_group.vpn-efs	resource
aws_security_group.vpn-server	resource
aws_ami.vpn-server	data source
aws_caller_identity.current	data source
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
efs_subnet_ids	subnets to create the efs mountpoints in	any	n/a	yes
env	n/a	string	"prod"	no
instance_profile_name	use a custom instance profile	string	""	no
instance_subnet_id	subnet to launch the VPN Server in	any	n/a	yes
instance_type	n/a	string	"t3.small"	no
listeners	n/a	list(object({ port = string protocol = string cidr_blocks = list(string) }))	[ { "cidr_blocks": [ "0.0.0.0/0" ], "port": "51820", "protocol": "udp" }, { "cidr_blocks": [ "0.0.0.0/0" ], "port": "80", "protocol": "tcp" }, { "cidr_blocks": [ "0.0.0.0/0" ], "port": "443", "protocol": "tcp" } ]	no
tags	n/a	map(string)	{}	no
vpc_id	VPC id to launch the VPN Server in	any	n/a	yes

Outputs

Name	Description
vpn-ip	n/a
vpn-sg	n/a