Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Hey everyone. Let me start by saying that my Linux experience isn't super awesome but I can usually find my way around things easily.

Over at work we have an OpenVPN setup that's been due for some improvement for a while now. The main server (tap mode) runs in our office, behind a rather slow DSL connection. The main problem is that, since I'm usually out of the office, every time I want to access something on the virtual network I have to go through that server to get anywhere else.

We have two servers up on 100 Mbit connections that we use for development and production purposes, about 3 more servers in the office (one of them behind a different T1 line for VOIP) and about two dozen clients who use the network on a daily basis from various locations.

We've had situations where network routing (outside of our control) would not allow people to reach our main OpenVPN server whilst the other locations were connectable. Also any time someone outside the office wants to fetch something from any of the servers (say, a 500 MB code repository), a whopping 20 KB/s download speed is just unacceptable these days (did I mention slow DSL? ok). We had to implement traffic shaping on this server since maxing out this connection was fairly trivial.

I had the thought of running two (or more) OpenVPN servers in the network. These would have to have the same subnet though, as our application relies on virtual network's IP addresses for some of its core functionality. The clients would also preferably retain the same IP addresses but that's not vital.

For simplicity, lets call the current server office and the second server I'm setting up, cloud. Call the server on the T1 phone.

This proved to be rather complex because as soon as I connect to cloud, I cannot see office. Any routes to a server that would go through office also do not work while I'm connected to cloud (no ping, nothing) and vice-versa. There's no rules for iptables that would be blocking the traffic either.

Recently I came across this article on linuxjournal but the solution they provide seems to only cover the use of two servers and somewhat outdated (can't even find much documentation, their wiki is offline). They also state that adding more servers would be a complex task.

Ideally I would like to keep the existing server office running the virtual network and also run the OpenVPN daemon on the cloud and phone servers (100 Mbit and very reliable connection, respectively) so that we're on safe ground in case of a hardware failure, DSL failure, etc.

So, in essence, I'm looking for a highly available OpenVPN solution (fix, patch, hack, tweak, whatever you want to call it) that will accept connections on multiple hosts (2 or more) whilst keeping the same IP address subnet regardless of the server to which you connect to.

Thanks for reading and sorry for the long post, I hope it gets the point across :P

EDIT:

Another important part I forgot to mention is that the 3 servers need to have consistent IP addresses on the virtual network because our application logic relies directly on these. The clients are irrelevant, they can have any address but the servers need to communicate between themselves. If you know of a different solution (some sort of dns for the entries within 10.8.0.* perhaps) please include it. Thanks again.

EDIT 2:

Added a network map, it's not great but should get the point across. Note that for any server to communicate with any other server, it must always go through the Office server. This is intended although I would like to change that functionality to Cloud.

Network Map

share|improve this question
    
Just to make it easier can you add a network diagram, your description is somewhat difficult to follow. Building a quick diagram in Google docs is pretty easy. docs.google.com –  Zoredache Dec 27 '10 at 22:52
    
Added. It was indeed pretty easy although I'm not sure how good it ended up :) –  andre Dec 28 '10 at 0:08
add comment

3 Answers 3

up vote 2 down vote accepted
+25

I played with networking and openvpn quite a lot (10+ years sysadmin in ISP) so how about this simple solution.

Create entry in dns that will have n ip addresses for one host (round-robin way)

In Openvpn client put remote name of host so round robin is achieved

On vpn server have two network cards, one is connected to public ip (round robin address 1), other one is connected to private class. Second server, different public address (round robin address 2), same private class.

Create tap0 interface that will bridge addresses to private interface, have single dhcp that will manage addressing to your clients.

This way i think you can achieve as much redundance you want..

share|improve this answer
    
+1 for DNS RR. probably the simpliest way to load-balance. –  petrus Dec 29 '10 at 23:34
add comment

If it's acceptable for clients to get different addresses depending on the server to which they're connected, this is pretty easy to set up. You haven't directly addressed the number of clients you have connected nor the size of your address space (nor whether your VPN is on a dedicated network or whether it shares the same address space as the rest of your office), so I'm making a bunch of assumptions that may very well not be correct. Feel free to reply with corrections.

I'm going to assume:

  • You want to set up three OpenVPN servers, all on the 192.168.1.0/24 network.
  • The OpenVPN servers are the only servers using this address space.
  • Your "internal" network is 10.10.10.0/24.
  • You want at least 20 clients to be able to connect simultaneously to any single server.

You split your VPN network into multiple /27 networks, each associated with a single server. This gives you:

  • Server 1
    • Network: 192.168.1.0/27
    • Server IP: 192.168.1.1
  • Server 2
    • Network: 192.168.1.32/27
    • Server IP: 192.168.1.33
  • Server 3
    • Network: 192.168.1.64/27
    • Server IP: 192.168.1.65

An OpenVPN configuration for the first of these servers would include the following:

server 192.168.1.0 255.255.255.224
push "route 192.168.1.0 255.255.255.0"
push "route 10.10.10.0 255.255.255.0"

For the second, it would include:

server 192.168.1.32 255.255.255.224

..and so forth.

Your network infrastructure will need to have routes to all three servers. That would be something along the lines of:

route add 192.168.1.0/27 gw 192.168.1.1
route add 192.168.1.32/27 gw 192.168.1.33
route add 192.168.1.64/27 gw 192.168.1.65

From the point of view of your applications, any connected client is on the same /24 network. You get three OpenVPN servers (with room for adding more since you're only using addresses up to 192.168.1.95 with this arrangement), or with room for more clients per server.

This is a brief overview of how you would set things up. If something here doesn't make sense or if you want me to go into more detail in a particular area let me know.

NB: written after too much glögg, so may need some syntax and/or fact checking.


share|improve this answer
    
I edited my original question, your solution would have been viable if I am able to, somehow, preserve the addresses of the servers themselves. +1 for the good idea. Thanks! –  andre Dec 26 '10 at 3:09
    
I'm not really sure I understand your configuration -- are the servers currently communicating using the OpenVPN network? –  larsks Dec 26 '10 at 3:22
    
That is correct, between the office, phone and the cloud, they all communicate using VPN addresses (10.8.0.*), the clients communicate with these servers too. This would be a big problem to change without a good alternative. –  andre Dec 26 '10 at 15:49
add comment

You might want to take a peek at n2n

http://www.ntop.org/products/n2n/

You can have every client on the same subnet. You should be able to keep the same address space and just chuck in some routes via the new vpn route to get it all working.

share|improve this answer
    
I don't suppose there's something exactly like this but for OpenVPN? This is what I am looking for. –  andre Dec 29 '10 at 5:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.