0

I have one web application, that is deployed on cloud. Now, this web application needs to access 3 Postgres databases, located in 3 different location(Lets call them, client systems).

So one day, I met with this guy, who is very experienced and senior to me. He gave me following solution.

  1. Install OpenVPN on Raspberry Pi
  2. Put this Raspberry Pi in the network (behind the firewall, he said) where Postgres database server is installed.
  3. Access Postgres databases via VPN from cloud.

Now I am wondering why I need to do this when I can access all 3 databases by just doing port forwarding from client systems.

Am I missing something ?

Improve this question

1 Answer 1

Reset to default
3

A database connection is a very critical part of any infrastructure as it usually contains much more data than the clients can/should see. You want to protect this as much as possible, which means that you want to prevent anyone from even attempting to connect to it and also want to completely encrypt the traffic so no one can eavesdrop on it, and optimally you don't want anyone to know that the database is even there.

A VPN is a very good option to achieve all these goals, but it is not necessarily the only option, depending on the specific situation. Should you mean SSH port forwarding in your question, this is certainly another option but then you have take care to restablish the connection if it breaks for whatever reason, e.g. with something like autossh.

Also I think it's debatable if you would really want to use something as unreliable and slow (hardware wise) as a RasPi to protect your production network, but you can use any other VPN software/hardware combination anyway.

Improve this answer
10
  • 1
    If I understood you correctly, one of the many disadvantage of 'port forwarding' is that, connection between my application to postgres database will be un-encrypted. So it is insecure. Right ?
    – Bhushan
    Jul 6, 2016 at 11:45
  • How did you "port forward"? If you use something like ssh -L, it's encrypted, but if you use some firewall rule, it's likely unencrypted.
    – Sven
    Jul 6, 2016 at 11:51
  • @BhushanPatil Dont forget that if your cloud provider is like azure, you can now make site-to-site vpn tunnel from there too, so all 3 site could be linked in a secure mode. I don't know the raspberrypie, but it seem to me a non standard solution to the problem as for me a raspberry is a lowend device.
    – yagmoth555 ♦
    Jul 6, 2016 at 12:51
  • I completely agree about securing access to database part via VPN, AutoSSH seems to be quite bad idea though, while it's possible it's somehow misses it's purpose. But I cannot agree about RasPi part, version 3 has quadcore 1,2GHz ARM processor and 1 GB of RAM. It's hard to find router with similar specs so inexpensive like RasPi v3 (35$ sic!)... I do not have any experience regardless its stability, I've heard some good words about it.
    – Michal Sokolowski
    Jul 6, 2016 at 14:45
  • 2
    @MichalSokolowski: The main bottleneck on the Pi is the I/O speed with the single 100 MBit network and USB ports sharing the same slow USB 2.0 bus. I can get a RB2011 with 5 Gigabit ports (+SFP and 5 100MBit ports) from Mikrotik for $110 or any number of other devices in similar prince ranges that are much better suited for running a VPN (I would say even the ancient but trusty WRT54L is a better choice). Power supply and SD card/FS stability was an issue on earlier models, but this got better in my experience with the Pi2 and Pi3.
    – Sven
    Jul 6, 2016 at 15:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .