Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two physical machines (both Ubuntu Linux) located at different hosting companies. Now one machine runs virtual machines which clients can access through VPN (OpenVPN). What I need now is to connect the other physical server with its virtual machines in a way that VPN clients see it as well and can get their local IPs from the internal DNSMasq server.

Here is my current configuration:

+--------------------------------------+ 
|       Current VPN Server             |
|                                      |
|                                      |
|------+                               |
|      |      +-----------------+      |
| tun  |<====>|     DNSMasq     |      |
|      |      +-----------------+      |
|------+\        ^          ^          |
|   ||  \\      /            \         |
|   ||   \\    /              \        |
|   ||    \\  /                \       |
|  +---------------------------------+ |
|  | VH 1 | VH 2 | ...        | VN N | |
|  |      |      |            |      | |
|  |      |      |            |      | |
|  |      |      |            |      | |
|  +---------------------------------+ |
|                                      |
+--------------------------------------+ 

So VPN clients can communicate with the virtual machines by using the internal DNSMasq instance to resolve private names. Each virtual host (VH) instance retrieves it's IP address from DNSMasq. VPN Server routes access to this IP's with iptables NAT rule.

Now I would like to add an additional physical server so that all the stuff is transparent for the clients as well as virtual hosts:

+--------------------------------------+       +--------------------------------------+     
|       Current VPN Server             |       |           New Server                 |     
|    /============================================\                                   |     
|    v                                 |       |  v                                   |     
|------+                               |       |------+                               |     
|      |      +-----------------+      |       |      |                               |
| tun  |<====>|     DNSMasq     |<---------+   | tun  |                               |
|      |      +-----------------+      |   |   |      |                               |
|------+\        ^          ^          |   |   |------+\                              |  
|   ||  \\      /            \         |   |   |   ||  \\                             | 
|   ||   \\    /              \        |   |   |   ||   \\                            |  
|   ||    \\  /                \       |   |   |   ||    \\                           |  
|  +---------------------------------+ |   |   |  +---------------------------------+ |     
|  | VH 1 | VH 2 | ...        | VN N | |   |   |  | VH 1 | VH 2 | ...        | VN N | |     
|  |      |      |            |      | |   |   |  |      |      |            |      | |     
|  |      |      |            |      | |   |   |  |      |      |            |      | |     
|  |      |      |            |      | |   |   |  |      |      |            |      | |     
|  +---------------------------------+ |   |   |  +---------------------------------+ |     
|                                      |   |   |    |        |                   |    |     
+--------------------------------------+   |   +----|--------|-------------------|----+     
                                           |        |        |                   |
                                           +--------+--------+-------------------+

In other words:

  • virtual hosts on the new server must be on the same subnet with the virtual hosts on current vpn server
  • virtual hosts of the new server must use secure channel to communicate with Current VPN Server
  • DNSMasq should assign via DHCP IP addresses to virtual hosts of the new server
  • Clients of the OpenVPN server should be able access the virtual hosts on new server

Please point me either to a tutorial or provide some detailed explanation.

share|improve this question
3  
Is there a specific reason that everything has to be on the same subnet? You will be increasing your broadcast domain, and with that your failure domain. It would be a more straightforward design to connect the two locations with a layer 3 tunneled link. –  JelmerS Mar 23 '13 at 23:35

1 Answer 1

As JelmerS wrote, you should think about L3 VPN.

If you REALY need distributed L2 solution:

  • TUN interface creates L3 tunnel. You need TAP for L2
  • If you are running multiple virtual machines, that can see each other in one L2 segment, you probably already have bridge adapter, that connects all that machines and host together.
  • Create L2 VPN between first and second server OpenVPN Etherent bridging
  • Join created by OpenVPN TAP adapter to bridge on server1
  • Join created by OpenVPN TAP adapter to bridge on server2

Result: all virtual machines and both servers reside in one L2 subnet. Clients can gain access to virtuals by connecting to L3-VPN (TUN interface), first server acts for them like a router with NAT.

share|improve this answer
    
Many thanks for your answer... I can also have an L2 bridging... And I was probably evaluating that. I will give it a try ;) Thanks for your answer. –  ovanes Mar 24 '13 at 19:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.