High availability OpenVPN service

Question

I am currently designing an OpenVPN service to provide internet users with enhanced privacy.

So far I intend to use dedicated servers running CentOS and Xen to provide multiple domains each an OpenVPN server for high availability and load balancing.

1. If one domU goes down, I want to automatically bring up a second domU on the same host. Is this type of failover possible?

2. Are there any solutions for load balancing VPN connections to domU servers?

Answer 1

1. Yes, it's possible to monitor the status of a Xen DomU, and to run some arbitrary command if the DomU fails. You could run an instance of the Monit daemon on a third host (DomU or physical) that checks the primary OpenVPN DomU, and tells the Dom0 to fire up the secondary DomU if the primary has failed. The Monit documentation has a lot of examples that can show you how to implement this:

   • http://mmonit.com/monit/

2. Yes, OpenVPN has some high-availability and/or load-sharing capabilities built in, and it's pretty simple to set up.

First, you'll be running multiple OpenVPN servers, in parallel, with each server listening on its own IP address. The servers don't share state, and they don't know anything about each other.

Then, you specify multiple '--remote' options, either on the command line or in the OpenVPN client's config file. When the client has multiple remote server options available to it, it'll randomly choose one and make a connection to it. If that server fails, it will re-try the connection, and then randomly choose a different server if it fails to connect. See the OpenVPN docs, here, for more information:

• http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html

You may want to see my answer to a similar question, here:

• http://serverfault.com/questions/110105/redundant-openvpn-configuration/111264#111264

As noted in my other answer, you'll probably want to pay attention to these client options, in particular:

• connect-retry
• connect-retry-max
• remote-random
• ifconfig-pool-persist

Of course, this isn't true load-balancing, because the OpenVPN client doesn't select the server with the lowest load, or the least clients--it just randomly picks a server. If you need true load balancing to ensure that the server loads stay equalized, you'll need to find some kind of dedicated load balancing solution, either hardware or software.

Answer 2

1. Maybe you could configure the two domU VM like two nodes of a normal Linux HA cluster. But I think that this configuration can work only if the second node is in stand by, not switched off. If you want the backup domU node to start up if the first doesn't work, I think you have to write a script at dom0 level that run forever checking the health of the first node and in case of fault forcing its complete shut down and the start up of the backup (I don't think that such shell script should be too much difficult or maybe you can use some good software for linux that can make the job, but it could be more intrusive).

2. Also for this, you could considere the two VM, like regular Linux machine and install and use load balancing standard Linux solution.

Answer 3

For your OpenVPN HA cluster setup you may use combination of OpenVPN, WAN Load Balancing and OSPF. There is a fresh HOWTO here: http://www.vyatta4people.org/highly-available-openvpn-connection-between-two-offices/ Enjoy!