Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I currently have servers at 4 locations, and even though this is really just me hobbying around I'd like to know what the "real-world" way of doing this is.

Basically I have certain services that are only running on one location and should only be accessible by my own servers at other locations. Is the usual approach just using firewall rules to restrict access (Possibly paired with authentication)?

Another idea that came to mind was hooking all servers into a VPN network, but that really sounds like a recipe for disaster (Single point of failure, even though you can set-up a redundant VPN).

The services I'm primarily talking about are:

  • Puppet
  • MCollective
  • Collectd

I've seen people suggest setting up a puppetmaster and MQ server per location, but my current budget doesn't have room to be hosting an instance at every location.

Edit: All locations are purely servers, and only 1 location is firewalled (As in LAN).

share|improve this question

1 Answer 1

First of all: Why would VPN be any more prone to SPOF than connecting servers together over the internet? It's the same transport!

It's not easy to answer the rest of the question, as it depends on what you use and how you use it. Are these servers only facing the internet, or are they behind firewalls with users on a LAN? If so I suggest that you either look into hardware firewalls (one at each location, with a tunnel to the other 3 locations) or a managed IP-VPN service. The latter provides SLA levels that usually are higher than regular internet access, but will also cost you more.

If they are internet-facing (like a coloed server) with no other networks, then why not just use simple ssh tunnels or similar to ensure encrypted communication between the servers.

share|improve this answer
    
It would be a SPOF if I only have 1 OpenVPN server so that would have to be redundant, and losing all connections with regards to "internal" services if the OpenVPN server drops sounds like something I'd like to avoid regardless of having a back-up OpenVPN server. I currently only have servers running on all the locations, and 1 location is firewalled, the others have all internet-facing machines. –  Xeross Oct 11 '11 at 14:04
    
Does all of your locations have redundant routers and redundant ISP feeds? I think you get my point.. –  pauska Oct 11 '11 at 14:09
    
No, but the VPN does add another possible point of failure I would think, though considering that the current host it's running on is pretty stable it shouldn't be that big of a problem. Not to forget it's nothing business critical most of the time either. –  Xeross Oct 11 '11 at 17:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.