The process of setting up a Private Endpoint within Amazon AWS will depend to a certain extent on your current AWS configuration if any. A Private Endpoint runs as a service on a virtual machine instance, which in AWS must be placed within a Virtual Private Cloud (VPC). The VPC is essentially an isolated container that can host VMs, but you can create VPCs in various regions and apply security policies to them.

There are various reasons you might want to use a new or non-default VPC. Some examples include:

• If you want to host private endpoints in a different region or country
• If you already have a VPCin which you host organizational resources
  • You can create a Private Endpoint inside the VPC to provide a secure tunnel into that VPC and block off nearly all other network access
• If you have specific security configurations you want to apply to the VPN for Private Endpoints

If you are new to Amazon AWS, or don't have a specific reason to create a new VPC, using the default VPC is appropriate. 

Step 1 - Create a Key Pair

The following steps assume you will be using the default VPC and that you have already set up a local SSH client.

1. Log in to your Amazon AWS console as a root user
2. Under Services, navigate to the EC2 service
3. Generate a key pair so that you can use SSH to log in to the console of the VM you will be creating
4. On the EC2 dashboard, select Network Security, then Key Pairs at left
   • If you don't already have a key pair you want to use, select Create Key Pair in the top left
5. Give the key pair a name, leaving the default pem format selected 

Creating key pairs

1. Select Create key pair 
   • A PEM file should download automatically; this can be imported into your SSH client so that you can transparently log in to your VMs

Step 2 - Virtual Machine Setup

1. On the EC2 dashboard, click the Region drop-down at the top
2. Select the region in which you want to deploy your VM

   VIPRE Recommends

   As of the time of this writing, we recommend deploying a CentOS 7 image. The steps below reflect that recommendation.

    
3. Open a new browser tab and visit https://centos.org/download/aws-images/
4. Find an image for your selected region and click on Deploy Link to the right
5. This should bring you back to your EC2 console, with the appropriate region and image selected
   •  If this doesn't work as expected, you may need to switch regions (at top)
   • You can also back out to the EC2 dashboard, select Create Instance, select your region, then search for the AMI ID listed on the CentOS images page
6. Select the appropriate VMType (size)
   • As this is a network service, you'll probably want something in the t3* range, but there aren't many other requirements—even the t3a.nano instance type will work in most circumstances
   • If you have a lot of MacOS or Android clients (which use OpenVPN), or just an extremely large number of clients in general, you may need to increase the CPU/RAM 
7. Select Next: Configure Instance Details
8. Under Instance Details, most settings can be left at their default, but here is where you might select (or create) a different VPC to put the VM in
9. Select Next: Add Storage
10. Under Add Storage, configure a size of 16GB to allow for the additional software you will be installing and possibly advanced features
11. Select Next: Add Tags
12. Under Add Tags, add descriptive tags to the VM such as the resource it will be protecting, or any other descriptive information that will help people figure out later why this instance was created
13. Select Next: Configure Security Group
14. Under Configure Security Group, select Create a new security group
15. Give the new profile a name and description
16. Add the following ports; you will see warnings about your ports being accessible to anyone but this is the purpose of the service and one reason it might make sense to create a separate VPCspecifically for these PEPs:
    • If you can restrict the set of IPs from which administrators can access this VM for maintenance, we recommend you do so (SSH is availably by default, so a new Security Group is pre-populated with that entry—modify the Source column to restrict the source IPs allowed).
    • Add Rule, select HTTP as the Type, TCP as the Protocol, 80 as the Port Range, and leave the Source as-is. Put 'Let's Encrypt certificates' in the Description.
      • Let's Encrypt is a service that allows services to dynamically create encryption certificates on the fly. The service requires that port 80 be available on the server for which the certificates will be created.
    • Add Rule, select 'Custom UDP Rule' as Type, UDP as Protocol, 443 as the Port Range, and set the Source to '0.0.0.0/0, ::/0'. Put 'OpenVPN' in the Description.
      • OpenVPN, one of the protocols used by the Encrypt.team clients, uses UDP port 443 for its encrypted connection.
    • Add Rule, select 'Custom UDP Rule' as Type, TCP as Protocol, 443 as the Port Range, and set the Source to '0.0.0.0/0, ::/0'. Put 'OpenVPN' in the Description.
      • OpenVPN, one of the protocols used by the Encrypt.team clients, uses TCP port 443 for its encrypted connection.
    • Add Rule, select 'Custom UDP Rule' as Type, UDP as Protocol, 500 as the Port Range, and set the Source to '0.0.0.0/0, ::/0'. Put 'IPSec' in the Description.
      • IPSec, one of the protocols used by the Encrypt.team clients, uses UDP port 500 for its encrypted connection.
    • Add Rule, select 'Custom UDP Rule' as Type, UDP as Protocol, 4500 as the Port Range, and set the Source to '0.0.0.0/0, ::/0'. Put 'IPSec' in the Description.
      • IPSec, one of the protocols used by the Encrypt.team clients, uses UDP port 4500 for its encrypted connection.
17. Select Review and Launch

Step 3 - Start your VM

1. Select Launch to start your VM.
2. On Launch, you'll be asked to create or select a Key Pair; select the Key Pair you created above
   • You will need to have the corresponding PEM file downloaded for OpenSSH to access the Instance
3. After a few minutes, go back into EC2 > Instances > Instances screen and you should see your new VM listed as Running in the list
4. In your list, find your PEP VMs and scroll to the right to find the public IP of your new VM
5. Switch to a terminal window, and SSH in to the new VM
   • The precise steps may vary slightly depending on the VMand how you have SSH configured, but here's an example:
     • mv Downloads/PEPs.pem .ssh
       • PEPs.pem is the Key Pair file downloaded earlier.
     • chmod og-rw .ssh/PEPs.pem
       • Most SSH clients will not allow you to use a PEM file that has permissions that are too lax
     • ssh -i .ssh/PEPs.pem centos@34.201.129.59
       • The PEM file is specified for use in this connection
       • 'centos' is the user you will log in as; if this fails you can try user 'root' and the login may give you a hint as to the correct username
       • The IP address here is the one associated with the Instance, as in step 5a.
6. If you have logged in successfully, you are done with this phase!

Team networks group private endpoints into a shared security group or common locality. You can either allow all users to automatically access endpoints within a network or restrict access to networks for specific users.

 

To create a team network:

1. Log in to the Encrypt.team Team Manager web console
2. In the Team networks row, click Manage
3. On the Networks screen, click Create Network
4. A window will pop up to name your network
   • VIPRE recommends thinking of this as naming the access role
5. If you want to add all of your team users into this network, add a check next to Add all users to this network
   • If you only want to add some users, leave this unchecked; you'll be able to add individual users in the next step
6. Click the Create button

To add individual users:

1. From the Networks screen, click the name of your network
2. In the Users row, click Manage
3. Click View all users
4. Add a check next to the desired users then click the Bulk Actions drop-down menu in the header row
5. Click Set Permissions
6. Add a check next to your network and click the Save button

To add target to your network:

1. In the Team networks row, click Manage
2. On the Networks screen, click the name of your network
3. Click Add Target (Self-Hosted)
4. A window will pop up to create a new target
   1. Name your target
      •  - This is the name the end user will see; VIPRE recommends using the name of the resources the end users will be accessing when connected to this target
   2. Add a check next to Is Enabled
   3. Add the domain name that points to the Private Endpoint VM
      • e.g. If you are using Amazon AWS, this could be the Instance "Public IPv4 DNS"; you could also use your own DNS name here that points to the public IP address of the VM - this name will be used by Let's Encrypt for certificate verification
   4. Click the Create button
5. Click Create Server
6. A window will pop up to create a new server
   1. Add a nickname for your server
      • This can be the same as your target name, if desired
   2. Click the Create button

For this example, we will be assuming that you have a vanilla VM set up with CentOS 7.8, a Red Hat-based Linux distribution. Other Linux distributions, like Ubuntu which are Debian-based, may have slightly different setup instructions and commands. We also assume that you can connect to the console (SSH or similar) of the VM.

 

We'll be installing various pre-requisites and then the Private Endpoint service itself.

 

Updating CentOS

1. Connect to the VMconsole and log in as a user with access to root-level privileges 
   • If you are running as root, you can leave sudo off the beginning of each command below
2. Ensure that you are running the most recent OS version by typing the following into the command line: 

% sudo yum update

This may take a long time—possibly hours—as there are hundreds of packages on the system that may need to be updated. If you see any errors, try again until all installations succeed.

Installing Pre-requisites

Next, we will install a couple standard optional packages that are required. Again, we'll use sudo to execute the commands as root, and yum to manage the installation.

 

1. At the command line, type:

% sudo yum install -y python git yum-utils device-mapper-persistent-data lvm2

1. This installs each of the packages listed:
   • python: a scripting language used by Private Endpoints
   • git: a remote repository utility that we will use to bring in additional non-standard packages
   • yum-utils: a set of additional package management utilities
   • device-mapper-persistent-data: provides thin-provisioning tools for the filesystem
   • lvm2: a filesystem volume management tool

This may take a while as each package is downloaded and installed. If you see any errors, try again until all installations succeed.

 

Install and Run Docker (Container Management)

1. At the command line, type:

% sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo

2. When the command line prompt returns, type:

% sudo yum install -y docker-ce

then

% sudo systemctl enable docker

then

% sudo systemctl enable docker

then

% sudo systemctl start docker

Install and Start Private Endpoint Service

1. At the command line, type:

% sudo git clone https://github.com/encryptme/private-end-points-docker /opt/pep

then

 

% sudo chown -R centos:centos /opt/pep
% sudo usermod -a -G docker centos

2. And then start it by typing the following at the command prompt: 

% cd /opt/pep

then

 

% ./go.sh init --pull-image

then

 

./go.sh run

3. Once the images have been downloaded, you will be prompted to enter an email address. This will be used for notifications in case the Let's Encrypt certificate process doesn't work automatically (as it should). You should use your email address or whoever should be notified if things go wrong.
4. Next, you will be prompted for your server registration key. This is the unique key that was created when you set up the Server within the Encrypt.team management console, that you copied somewhere safe. Grab that key and paste it into this dialog.