如何从EC2 Windows实例连接公司VPN？需手动方案及Ruby SDK实现

Hey there! Great question—yes, you absolutely can connect your EC2 Windows instance to your company's VPN to access private URLs. Let's break this down step by step, starting with the manual setup, then moving to automating it with the AWS SDK for Ruby.

Short answer: Yes! An EC2 Windows instance acts just like a regular on-premises Windows server when it comes to network configurations. As long as your instance has outbound network access (allowed by default in most EC2 security groups), you can set up and connect to your company's VPN exactly as you would on a local Windows machine.

Follow these steps to manually set up the VPN connection:

• Remote into your EC2 Windows instance: Use RDP to log in with an administrator-level account.
• Navigate to VPN settings: Open Windows Settings → Network & Internet → VPN, then click "Add VPN connection".
• Fill in your company's VPN details:
  • VPN provider: Select "Windows (built-in)"
  • Connection name: Choose something descriptive (e.g., "Company Office VPN")
  • Server name or address: Enter your company's VPN server address (can be a domain name or public IP)
  • VPN type: Pick the type your company uses (common options: PPTP, L2TP/IPsec, SSTP, IKEv2)
  • Type of sign-in info: Select "User name and password", then input your company-provided VPN credentials
  • Check "Remember my sign-in info" (optional, but saves time for future connections)
• Save and connect: Click "Save", then find your new VPN connection in the list and click "Connect".
• Verify access: Once connected, test accessing your private URL to confirm it works. If you run into issues, double-check your EC2 security group allows outbound traffic for your VPN's required ports (e.g., 1723 for PPTP, 500/4500 for L2TP/IPsec) or reach out to your company's IT team for configuration tweaks.

The AWS SDK for Ruby doesn't directly manage VPN settings inside an EC2 instance, but you can use it to remotely execute scripts that handle the VPN setup. Here's how:

1. Create a PowerShell script for VPN setup
   First, write a PowerShell script that automates creating the VPN connection and connecting to it. Adjust the parameters to match your company's VPN configuration:

# Create the VPN connection profile
Add-VpnConnection -Name "Company VPN" -ServerAddress "vpn.yourcompany.com" -TunnelType L2tp -L2tpPsk "your-company-psk" -EncryptionLevel Required -AuthenticationMethod MSChapv2 -SplitTunneling $true

# Initiate the VPN connection
rasdial "Company VPN" "your-vpn-username" "your-vpn-password"

Note: If your company uses IKEv2 instead of L2TP, change -TunnelType to Ikev2 and remove the -L2tpPsk parameter.

2. Use AWS SDK for Ruby to run the script via SSM
   You'll use AWS Systems Manager (SSM) to send the script to your EC2 instance. Make sure your instance has the SSM Agent installed (default on Windows AMIs) and an IAM role with AmazonSSMManagedInstanceCore permissions to allow SSM interactions.

Here's a Ruby code example:

require 'aws-sdk-ec2'
require 'aws-sdk-ssm'

# Initialize AWS clients (update region to match your instance's region)
ec2_resource = Aws::EC2::Resource.new(region: 'us-east-1')
ssm_client = Aws::SSM::Client.new(region: 'us-east-1')

# Target your EC2 instance (replace with your instance ID)
target_instance = ec2_resource.instance('i-1234567890abcdef0')

# Define the PowerShell script content (update with your VPN details)
vpn_setup_script = <<-PS_SCRIPT
Add-VpnConnection -Name "Company VPN" -ServerAddress "vpn.yourcompany.com" -TunnelType L2tp -L2tpPsk "your-psk-here" -EncryptionLevel Required -AuthenticationMethod MSChapv2 -SplitTunneling $true
rasdial "Company VPN" "your-username" "your-password"
PS_SCRIPT

# Send the script to the instance via SSM Run Command
command_response = ssm_client.send_command({
  instance_ids: [target_instance.id],
  document_name: 'AWS-RunPowerShellScript',
  parameters: {
    commands: [vpn_setup_script]
  }
})

# Check the execution status
command_id = command_response.command.command_id
loop do
  invocation_status = ssm_client.get_command_invocation({
    command_id: command_id,
    instance_id: target_instance.id
  }).status

  puts "Current command status: #{invocation_status}"
  break if %w[Success Failed].include?(invocation_status)
  sleep 5
end

Pro tip: If you want the VPN to auto-connect when the instance starts, add Set-VpnConnection -Name "Company VPN" -AutoConnect $true to the PowerShell script.

• SSM command not working? Ensure the SSM Agent is running on your instance, and your instance can reach SSM endpoints (either via public internet or a VPC endpoint).
• VPN won't connect? Verify your EC2 security group allows outbound traffic for your VPN's ports/protocols, confirm your company's VPN server allows your instance's public IP, and double-check your VPN credentials.

内容的提问来源于stack exchange，提问作者Ravi Shrivastava