Setting Up a VPN on AWS EC2 with Ubuntu 14.04 LTS

Recently, a friend mentioned seeing an advertisement on http://aws.amazon.com for a one-year (12-month) free trial of EC2 instances. Unable to resist the temptation and armed with a VISA card, I signed up. However, I soon discovered some pitfalls. Although they deducted $1 USD to verify your personal information, that’s not all. While the annual subscription is free, you will be charged for data transfer exceeding the free tier, CPU usage, and disk I/O. For instructions on how to apply, please visit the link above and ensure you have a VISA card ready for billing.

Preparation:

1. A host running Ubuntu (I used AWS EC2 Ubuntu 14.04);

2. Configure firewalls (hardware and software) to allow all non-VPS controlled ports, specifically 1723 (PPTP) and 22 (SSH).

Getting Started:

1. Install VPN software: sudo apt-get install pptpd;
2. Edit internal IP configuration: sudo nano /etc/pptpd.conf;
3. Uncomment the #localip and #remoteip lines at the end of the configuration file (there are two sets of IPs; choose based on your preference);
4. Press Control+O to save, then Control+X to exit.
5. Edit options file: sudo nano /etc/ppp/pptpd-options;
6. Uncomment the #ms-dns line in the options file (default is internal IP; modify as preferred. I changed it to 8.8.8.8, 4.4.4.4);
7. Press Control+O to save, then Control+X to exit.
8. Edit the account file to add users: sudo nano /etc/ppp/chap-secrets;
9. Add or modify user information following this format: username server password authorized_IP_address (e.g., user pptpd password *);
10. Press Control+O to save, then Control+X to exit.
11. Restart pptpd: sudo /etc/init.d/pptpd restart

The PPTPD configuration is now complete, but we also need to configure ipv4.ip_forward.

1. Enter: sudo nano /etc/sysctl.conf
2. Uncomment #net.ipv4.ip_forward=1
3. Press Control+O to save, then Control+X to exit.
4. Enter: sudo sysctl -p

Enable system firewall iptables to allow VPN traffic:

1. Assuming iptables is already installed, view rules: sudo iptables -L -nv;
2. Check existing server rules to avoid locking yourself out. It is crucial to keep SSH firewall rules active;
3. Add firewall rule: sudo iptables -A INPUT -p tcp -i eth0 –dport ssh -j ACCEPT
4. Add firewall rule: sudo iptables -A INPUT -p tcp -i eth0 –dport 1723 -j ACCEPT
5. Add NAT rule: sudo iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE (Modify 192.168.0.0/24 according to the IP range assigned in step 1);
6. Start firewall: modprobe ip_tables.

If you are unfamiliar with AWS, here is how to open ports on AWS:

1. Login to the AWS Management Console: https://console.aws.amazon.com/console/home?nc2=h_m_mc
2. When creating an instance (Launcher Instances), there is a step to select a Security Group. You can add custom rules here via “Add Rule”. If not added during creation, perform the following steps.
3. After logging in, select “Security Groups” from the vertical menu on the left Dashboard;
4. Select the Security Group for your instance, right-click, and choose “Edit inbound rules”;
5. Add a rule by clicking “Add Rule”. Select Type based on your needs. If custom, select “Custom X X”, fill in Port Range and Source. I selected “Anywhere”;

The experience and speed of AWS EC2 are acceptable, but one thing requires careful attention: when selecting the Instance AMI, always choose “Free Tier Only” instances, otherwise, you will be charged. Additionally, while you can create multiple instances, the free outbound data transfer is limited to 15GB/month. Other rules can be found here: http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-free-tier.html. Those who do not wish to spend extra money must read this carefully.

Regarding Remote Control:

I will not elaborate extensively on SSH knowledge. Using xshell with a .pem file on Windows works without issues;

However, on Mac, neither ssh -i host.pem user@host nor ssh user@host allows login, resulting in a “Permission denied” error. Without delving into the cause, Mac users need specific tools to log in (Linux platforms may face similar issues). Terminal cannot be used directly. The tool I use is SecureCRT for Mac.