Client VPN setup

Steps to setting up the Client VPN with Jenkins.

Overview:

Instead of having an application load balancer that's 'internet-facing' with a public IPv4 address, this design uses an 'internal' application load balancer that's in the private subnet, without a public IPv4 address.

The client VPN that's deployed into the account's public subnets is what allows you to to communicate with the Jenkins' instance, via the internal application load balancer.

Steps:

1. First, we need to generate some certificates and keys. These also need to be imported into AWS Certificate Manager. Follow steps 1-9 here.

2. If you already haven't, deploy the foundation of this stack: steps 1-4 here

3. Since there won't be any hosted zone names, the command to deploy the Jenkins application should include the server certificate ARN and and the client certificate ARN:

sceptre --var "servercertarn=arn:aws:acm:eu-central-1:123412341234:certificate/aa1a1aa1-a1a1-1a11-aaaa-1111111a1a11" \
--var "clientrootcertarn=arn:aws:acm:eu-central-1:123412341234:certificate/111a1a11-1111-1a1a-a1a1-1a111a1111a1" \
create prod/jenkinsapplication.yaml

4. Download the client VPN configuration

5. If you wish to keep internet connection alive through the VPN add the line route-nopull to the .ovpn file.

6. Add your routes to the .ovpn file.

   $VPC_CIDR $NETMASK
   $CLIENT_VPN_CIDR $NETMASK
   

   For example, if my VPC CIDR was: 10.0.0.0/16 and my client VPN's cidr was: 10.8.0.0/22, I would have:

   route 10.0.0.0 255.255.0.0
   route 10.8.0.0 255.255.252.0
   

   This tool will help.

7. Add the key and and cert section.
   If you followed the guide for generating keys from step 1, you will need to copy the contents of the client.domain.tld.key and paste it between <key> and </key> in the .ovpn config file.

   Also, the contents of client.domain.tld.crt needs to be pasted in between <cert> and </cert>.

   Example .ovpn config file here

8. Import your .ovpn config file into your VPN client and access your Jenkins via it's load balancer DNS name. sceptre list outputs prod/jenkinsapplication and follow the steps here to unlock your Jenkins.