Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I manage several CentOS and Fedora VMs, and our setup is getting sufficiently sophisticated that it's time to move several resources on a single back-end VM, and serve those out to our Web VM, QA VM, Dev VM, etc. We trust our VM provider, but we don't trust every random stranger who can buy a VM on the same subnet for a few cents per hour. We need to encrypt traffic between the client servers and the back-end server. We have enough CPU headroom that symmetric encryption is no problem, but SSL handshake on each request would add too much latency, so application-level encryption is out of the question. We need some sort of VPN, but there are a lot of different ways to do it, and the numerous well-documented VPN configurations that are fine for attended client systems really don't make sense in this setup.

Which Linux VPN packages are best suited for this use case?

Which package-agnostic design principles should I keep in mind?

share|improve this question
    
I must be missing something, why do you need to set up VPNs because of the other users on the same subnet? –  blankabout Jun 8 '11 at 0:25
    
Because other VMs on the same subnet could sniff traffic. –  Chris Jun 8 '11 at 0:42
    
Sorry, I am still mystified, how would another host on the same subnet sniff your traffic without the collusion of your hosting company? –  blankabout Jun 8 '11 at 1:21
    
@chris: are you sure you're on the same broadcast domain? i.e. can you see any ARP traffic from other hosts you don't control? –  gravyface Jun 8 '11 at 1:38
    
@blankabout If (and only if) there are other clients on the same broadcast domain, the other clients could ARP poison to man-in-the-middle traffic between other hosts on a switched network. –  Shane Madden Jun 8 '11 at 1:51

1 Answer 1

I'm not sure about your exact requirements, but OpenVPN (http://openvpn.net/) is easy to configure, available as a package in most distributions, works over either tcp or udp, has flexible routing options, and otherwise seems to meet your needs. I use it regularly as an "unattended" solution (comes up when the server boots, does not require human intervention).

An added bonus is the cross-platform (OS X, Windows, Linux, *BSD), which makes it convenient if you need to extend your VPN to your laptop/desktop/etc platform of choice.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.