Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have servers that I wish to control access to. I have a firewall running pfSense between them and the public internet, but all machines have public IPs.

A remote client may or may not be on the same subnet as the servers and firewall. I wish to, based on authentication, allow the remote client full access to the servers behind the firewall.

I believe the best way to do this is through VPN.

Note that normally when people refer to VPN connecting the same subnet, they refer to two machines having the same private IP ranges. That is very different than what I am describing. I simply want to tunnel traffic for a subnet through VPN to bypass the firewall.

What is the best way to go about this? If you suggest OpenVPN, tun or tap?

Thank you!

share|improve this question
    
How many ip addresses do you have on your servers? If you have only the public interface it looks rather difficult to route the traffic to some kind of vpn tunnel. –  Olivier S Dec 7 '11 at 6:47
    
Trying to get by with just 1. I guess I could do 1:1 NATing. –  Craig Younkins Dec 7 '11 at 7:13
add comment

1 Answer 1

I'm surprised no-one's picked up on this question, but I'll bite.

You're right to say that a VPN is often used to tunnel connections between two unroutable (RFC 1918) networks across the public internet, but it's not the only use for it. The clue's in the name - Virtual Private Network. Any time you want to connect two or more networks (where a network is one or more hosts), over the public internet, privately (that is, without any of the intermediate routing devices being able to see or interfere with the traffic), a VPN's suitable for the job.

So yes, I think OpenVPN would work very well for you here, and the fact that one end of the tunnel is a single host isn't a problem. I don't have any detailed knowledge about TUN vs. TAP, though I believe that in a routed situation TUN is generally more appropriate.

You could also use stunnel, or an ssh-based VPN (that's just one tutorial I found with google, I can't especially recommend it), or (if you want maximum cred as well as the largest headache you can remember having) full-blown IPSec.

All of these are appropriate for connecting one single-public-IP-address endpoint securely to another single-public-IP-address endpoint over the public internet.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.