Controlling access to servers with public IPs

Question

I have servers that I wish to control access to. I have a firewall running pfSense between them and the public internet, but all machines have public IPs.

A remote client may or may not be on the same subnet as the servers and firewall. I wish to, based on authentication, allow the remote client full access to the servers behind the firewall.

I believe the best way to do this is through VPN.

Note that normally when people refer to VPN connecting the same subnet, they refer to two machines having the same private IP ranges. That is very different than what I am describing. I simply want to tunnel traffic for a subnet through VPN to bypass the firewall.

What is the best way to go about this? If you suggest OpenVPN, tun or tap?

Thank you!

Answer 1

I'm surprised no-one's picked up on this question, but I'll bite.

You're right to say that a VPN is often used to tunnel connections between two unroutable (RFC 1918) networks across the public internet, but it's not the only use for it. The clue's in the name - Virtual Private Network. Any time you want to connect two or more networks (where a network is one or more hosts), over the public internet, privately (that is, without any of the intermediate routing devices being able to see or interfere with the traffic), a VPN's suitable for the job.

So yes, I think OpenVPN would work very well for you here, and the fact that one end of the tunnel is a single host isn't a problem. I don't have any detailed knowledge about TUN vs. TAP, though I believe that in a routed situation TUN is generally more appropriate.

You could also use stunnel, or an ssh-based VPN (that's just one tutorial I found with google, I can't especially recommend it), or (if you want maximum cred as well as the largest headache you can remember having) full-blown IPSec.

All of these are appropriate for connecting one single-public-IP-address endpoint securely to another single-public-IP-address endpoint over the public internet.