Atualizar crialab.sh

crialab.sh

@@ -13,6 +13,8 @@ main() {
   REGION="${REGION:-us-east-1}"
   LAB_NAME="${LAB_NAME:-modulo12-vpn}"
   INSTANCE_TYPE="${INSTANCE_TYPE:-t3.micro}"
+  LOCAL_CIDR="${LOCAL_CIDR:-172.17.0.0/24}"
+  VPN_CIDR="${VPN_CIDR:-10.8.0.0/24}"
   local create_key=false key_file='' run_id
   run_id="$(date -u +%Y%m%dT%H%M%SZ)-$$"
   if [[ -z "${KEY_NAME:-}" ]]; then
@@ -26,11 +28,19 @@ main() {
   [[ "$LAB_NAME" =~ ^[a-zA-Z][a-zA-Z0-9-]{0,39}$ ]] || { echo 'LAB_NAME invalido' >&2; return 2; }
 
   # Validar somente a origem do acesso administrativo por SSH.
-  python3 - "$ADMIN_CIDR" <<'PY'
+  python3 - "$ADMIN_CIDR" "$LOCAL_CIDR" "$VPN_CIDR" <<'PY'
 import ipaddress, sys
 admin = ipaddress.IPv4Network(sys.argv[1], strict=True)
 if admin.prefixlen != 32 or not admin.network_address.is_global:
     raise SystemExit('ADMIN_CIDR deve ser um IPv4 publico /32 real.')
+local, vpn = [ipaddress.IPv4Network(x, strict=True) for x in sys.argv[2:]]
+vpc = ipaddress.IPv4Network('10.20.0.0/16')
+private = [ipaddress.ip_network(x) for x in ['10.0.0.0/8','172.16.0.0/12','192.168.0.0/16']]
+for net in [local, vpn]:
+    if not any(net.subnet_of(x) for x in private):
+        raise SystemExit('Redes local e VPN devem usar faixas privadas RFC1918.')
+if local.overlaps(vpn) or local.overlaps(vpc) or vpn.overlaps(vpc):
+    raise SystemExit('As redes local, VPN e VPC nao podem se sobrepor.')
 PY
   aw() { aws --region "$REGION" "$@"; }
   local account existing ami root_device az
@@ -62,7 +72,9 @@ VPC: 10.20.0.0/16
 Gateway publico: 10.20.1.10 | Servidor privado: 10.20.2.10
 SSH publico permitido de: $ADMIN_CIDR
 Criar chave SSH automaticamente: $create_key
-VPN: configuracao, encaminhamento, rotas entre sites e porta UDP ficam para a aula.
+VPC 10.20.0.0/16: todos os protocolos liberados entre as maquinas.
+VPN: UDP/1194 aberto; rotas AWS, permissoes e encaminhamento IPv4 preparados.
+Rede local: $LOCAL_CIDR | Tunel: $VPN_CIDR | OpenVPN roteado sem NAT entre sites.
 Serao criados recursos que consomem o saldo do laboratorio: EC2, EBS e IPv4 publico.
 Aloca um Elastic IP fixo para o gateway. Nao cria NAT Gateway, IAM ou certificados VPN.
 EOF
@@ -82,6 +94,8 @@ EOF
   record() { printf '%s=%s\n' "$1" "$2" | tee -a "$STATE_FILE"; }
   tags() { printf 'ResourceType=%s,Tags=[{Key=Lab,Value=%s},{Key=Name,Value=%s-%s}]' "$1" "$LAB_NAME" "$LAB_NAME" "$2"; }
   record AdminCidr "$ADMIN_CIDR"
+  record LocalCidr "$LOCAL_CIDR"
+  record VpnCidr "$VPN_CIDR"
   record KeyName "$KEY_NAME"
   record KeyCreatedByScript "$create_key"
   if [[ "$create_key" == true ]]; then
@@ -120,18 +134,43 @@ EOF
   record ServicesSecurityGroupId "$services_sg"
   allow() { aw ec2 authorize-security-group-ingress --group-id "$1" --protocol "$2" --port "$3" --cidr "$4" >/dev/null; }
   allow "$gateway_sg" tcp 22 "$ADMIN_CIDR"
-  # Administracao do servidor privado via salto SSH, sem depender de VPN.
-  allow "$services_sg" tcp 22 10.20.1.10/32
+  allow "$gateway_sg" udp 1194 0.0.0.0/0
+  # Comunicacao interna irrestrita na VPC; saida padrao dos grupos ja permite tudo.
+  local internal_sg internal_cidr
+  for internal_sg in "$gateway_sg" "$services_sg"; do
+    for internal_cidr in 10.20.0.0/16 "$LOCAL_CIDR" "$VPN_CIDR"; do
+      aw ec2 authorize-security-group-ingress --group-id "$internal_sg" --ip-permissions \
+        "[{\"IpProtocol\":\"-1\",\"IpRanges\":[{\"CidrIp\":\"$internal_cidr\",\"Description\":\"Redes privadas do laboratorio\"}]}]" >/dev/null
+    done
+  done
+  # Encaminhamento persistente, sem depender de download de pacotes.
+  local gateway_user_data='#cloud-config
+write_files:
+  - path: /etc/sysctl.d/90-vpn-lab.conf
+    permissions: "0644"
+    content: |
+      net.ipv4.ip_forward=1
+runcmd:
+  - [sysctl, --system]
+'
   local disk="[{\"DeviceName\":\"$root_device\",\"Ebs\":{\"VolumeSize\":8,\"VolumeType\":\"gp3\",\"DeleteOnTermination\":true,\"Encrypted\":true}}]"
   gateway=$(aw ec2 run-instances --image-id "$ami" --instance-type "$INSTANCE_TYPE" --count 1 \
     --key-name "$KEY_NAME" --subnet-id "$public_subnet" --private-ip-address 10.20.1.10 \
     --security-group-ids "$gateway_sg" --no-associate-public-ip-address \
     --metadata-options HttpTokens=required,HttpEndpoint=enabled \
-    --block-device-mappings "$disk" \
+    --block-device-mappings "$disk" --user-data "$gateway_user_data" \
     --tag-specifications "$(tags instance gateway)" "$(tags volume gateway)" \
     --client-token "$vpc-gateway" --query 'Instances[0].InstanceId' --output text)
   record GatewayInstanceId "$gateway"
   aw ec2 wait instance-running --instance-ids "$gateway"
+  aw ec2 modify-instance-attribute --instance-id "$gateway" --no-source-dest-check
+  local return_rt return_cidr
+  for return_rt in "$public_rt" "$private_rt"; do
+    for return_cidr in "$LOCAL_CIDR" "$VPN_CIDR"; do
+      aw ec2 create-route --route-table-id "$return_rt" --destination-cidr-block "$return_cidr" \
+        --instance-id "$gateway" >/dev/null
+    done
+  done
   # Registrar a alocacao antes da associacao permite recuperar uma falha parcial.
   local eip_allocation eip_association eip_target public_ip
   eip_allocation=$(aw ec2 allocate-address --domain vpc --query AllocationId --output text)
@@ -181,6 +220,8 @@ Gateway: ubuntu@$public_ip | Servidor privado: ubuntu@10.20.2.10
 As EC2 estao running; cloud-init e SSH podem levar mais alguns minutos.
 Se usou KEY_NAME preexistente, configure a IdentityFile para ambos os hosts (veja README).
 OpenVPN, certificados, intranet e coleta de logs ainda precisam ser configurados.
+AWS pronta para rede local $LOCAL_CIDR e tunel $VPN_CIDR; use essas faixas no OpenVPN.
+No gateway, apos cloud-init: sysctl net.ipv4.ip_forward deve retornar 1.
 A sub-rede privada nao possui saida para Internet. Veja README para instalar pacotes.
 Elastic IP do gateway: $public_ip (alocacao: $eip_allocation).
 O endereco permanece ao parar/iniciar a instancia enquanto a alocacao e associacao forem mantidas.