From d68067b0173da0f9b71bd98fc66f906d1701956b Mon Sep 17 00:00:00 2001 From: "tiago.ferreira" Date: Wed, 16 Sep 2026 19:33:14 +0000 Subject: [PATCH] Atualizar crialab.sh --- crialab.sh | 51 ++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 46 insertions(+), 5 deletions(-) diff --git a/crialab.sh b/crialab.sh index 8fdcffc..680fc80 100644 --- a/crialab.sh +++ b/crialab.sh @@ -13,6 +13,8 @@ main() { REGION="${REGION:-us-east-1}" LAB_NAME="${LAB_NAME:-modulo12-vpn}" INSTANCE_TYPE="${INSTANCE_TYPE:-t3.micro}" + LOCAL_CIDR="${LOCAL_CIDR:-172.17.0.0/24}" + VPN_CIDR="${VPN_CIDR:-10.8.0.0/24}" local create_key=false key_file='' run_id run_id="$(date -u +%Y%m%dT%H%M%SZ)-$$" if [[ -z "${KEY_NAME:-}" ]]; then @@ -26,11 +28,19 @@ main() { [[ "$LAB_NAME" =~ ^[a-zA-Z][a-zA-Z0-9-]{0,39}$ ]] || { echo 'LAB_NAME invalido' >&2; return 2; } # Validar somente a origem do acesso administrativo por SSH. - python3 - "$ADMIN_CIDR" <<'PY' + python3 - "$ADMIN_CIDR" "$LOCAL_CIDR" "$VPN_CIDR" <<'PY' import ipaddress, sys admin = ipaddress.IPv4Network(sys.argv[1], strict=True) if admin.prefixlen != 32 or not admin.network_address.is_global: raise SystemExit('ADMIN_CIDR deve ser um IPv4 publico /32 real.') +local, vpn = [ipaddress.IPv4Network(x, strict=True) for x in sys.argv[2:]] +vpc = ipaddress.IPv4Network('10.20.0.0/16') +private = [ipaddress.ip_network(x) for x in ['10.0.0.0/8','172.16.0.0/12','192.168.0.0/16']] +for net in [local, vpn]: + if not any(net.subnet_of(x) for x in private): + raise SystemExit('Redes local e VPN devem usar faixas privadas RFC1918.') +if local.overlaps(vpn) or local.overlaps(vpc) or vpn.overlaps(vpc): + raise SystemExit('As redes local, VPN e VPC nao podem se sobrepor.') PY aw() { aws --region "$REGION" "$@"; } local account existing ami root_device az @@ -62,7 +72,9 @@ VPC: 10.20.0.0/16 Gateway publico: 10.20.1.10 | Servidor privado: 10.20.2.10 SSH publico permitido de: $ADMIN_CIDR Criar chave SSH automaticamente: $create_key -VPN: configuracao, encaminhamento, rotas entre sites e porta UDP ficam para a aula. +VPC 10.20.0.0/16: todos os protocolos liberados entre as maquinas. +VPN: UDP/1194 aberto; rotas AWS, permissoes e encaminhamento IPv4 preparados. +Rede local: $LOCAL_CIDR | Tunel: $VPN_CIDR | OpenVPN roteado sem NAT entre sites. Serao criados recursos que consomem o saldo do laboratorio: EC2, EBS e IPv4 publico. Aloca um Elastic IP fixo para o gateway. Nao cria NAT Gateway, IAM ou certificados VPN. EOF @@ -82,6 +94,8 @@ EOF record() { printf '%s=%s\n' "$1" "$2" | tee -a "$STATE_FILE"; } tags() { printf 'ResourceType=%s,Tags=[{Key=Lab,Value=%s},{Key=Name,Value=%s-%s}]' "$1" "$LAB_NAME" "$LAB_NAME" "$2"; } record AdminCidr "$ADMIN_CIDR" + record LocalCidr "$LOCAL_CIDR" + record VpnCidr "$VPN_CIDR" record KeyName "$KEY_NAME" record KeyCreatedByScript "$create_key" if [[ "$create_key" == true ]]; then @@ -120,18 +134,43 @@ EOF record ServicesSecurityGroupId "$services_sg" allow() { aw ec2 authorize-security-group-ingress --group-id "$1" --protocol "$2" --port "$3" --cidr "$4" >/dev/null; } allow "$gateway_sg" tcp 22 "$ADMIN_CIDR" - # Administracao do servidor privado via salto SSH, sem depender de VPN. - allow "$services_sg" tcp 22 10.20.1.10/32 + allow "$gateway_sg" udp 1194 0.0.0.0/0 + # Comunicacao interna irrestrita na VPC; saida padrao dos grupos ja permite tudo. + local internal_sg internal_cidr + for internal_sg in "$gateway_sg" "$services_sg"; do + for internal_cidr in 10.20.0.0/16 "$LOCAL_CIDR" "$VPN_CIDR"; do + aw ec2 authorize-security-group-ingress --group-id "$internal_sg" --ip-permissions \ + "[{\"IpProtocol\":\"-1\",\"IpRanges\":[{\"CidrIp\":\"$internal_cidr\",\"Description\":\"Redes privadas do laboratorio\"}]}]" >/dev/null + done + done + # Encaminhamento persistente, sem depender de download de pacotes. + local gateway_user_data='#cloud-config +write_files: + - path: /etc/sysctl.d/90-vpn-lab.conf + permissions: "0644" + content: | + net.ipv4.ip_forward=1 +runcmd: + - [sysctl, --system] +' local disk="[{\"DeviceName\":\"$root_device\",\"Ebs\":{\"VolumeSize\":8,\"VolumeType\":\"gp3\",\"DeleteOnTermination\":true,\"Encrypted\":true}}]" gateway=$(aw ec2 run-instances --image-id "$ami" --instance-type "$INSTANCE_TYPE" --count 1 \ --key-name "$KEY_NAME" --subnet-id "$public_subnet" --private-ip-address 10.20.1.10 \ --security-group-ids "$gateway_sg" --no-associate-public-ip-address \ --metadata-options HttpTokens=required,HttpEndpoint=enabled \ - --block-device-mappings "$disk" \ + --block-device-mappings "$disk" --user-data "$gateway_user_data" \ --tag-specifications "$(tags instance gateway)" "$(tags volume gateway)" \ --client-token "$vpc-gateway" --query 'Instances[0].InstanceId' --output text) record GatewayInstanceId "$gateway" aw ec2 wait instance-running --instance-ids "$gateway" + aw ec2 modify-instance-attribute --instance-id "$gateway" --no-source-dest-check + local return_rt return_cidr + for return_rt in "$public_rt" "$private_rt"; do + for return_cidr in "$LOCAL_CIDR" "$VPN_CIDR"; do + aw ec2 create-route --route-table-id "$return_rt" --destination-cidr-block "$return_cidr" \ + --instance-id "$gateway" >/dev/null + done + done # Registrar a alocacao antes da associacao permite recuperar uma falha parcial. local eip_allocation eip_association eip_target public_ip eip_allocation=$(aw ec2 allocate-address --domain vpc --query AllocationId --output text) @@ -181,6 +220,8 @@ Gateway: ubuntu@$public_ip | Servidor privado: ubuntu@10.20.2.10 As EC2 estao running; cloud-init e SSH podem levar mais alguns minutos. Se usou KEY_NAME preexistente, configure a IdentityFile para ambos os hosts (veja README). OpenVPN, certificados, intranet e coleta de logs ainda precisam ser configurados. +AWS pronta para rede local $LOCAL_CIDR e tunel $VPN_CIDR; use essas faixas no OpenVPN. +No gateway, apos cloud-init: sysctl net.ipv4.ip_forward deve retornar 1. A sub-rede privada nao possui saida para Internet. Veja README para instalar pacotes. Elastic IP do gateway: $public_ip (alocacao: $eip_allocation). O endereco permanece ao parar/iniciar a instancia enquanto a alocacao e associacao forem mantidas.