I am using a rackspace cloud environment to host a server farm. The problem i've run into is that Rackspace shares all internal network traffic on a single subnet (or rather, all the servers in what they call a 'huddle'). This is not ideal, as I need to pass some sensitive information between servers and do not want to take the risk of being sniffed. We could use ssl, but that would require a great deal of re-architecting the application.

Rackspace suggested creatinga VPN between servers. This seems like the easiest solution at this point, however, i'm looking for a vpn solution that is stable and works well in a backend server environment with lots of traffic.

The servers are a mix of Windows and Linux servers. Keep in mind that the vpn has to work without an interactive user logged in. As such, it has to be something that is service friendly. So, client-side vpn's like Hamachi aren't really viable, nor do I want a solution that requires an outside server.

Any suggestions?


I'd like to avoid any options that require a great deal of configuration to make work. This leaves out IPSec and OpenVPN (both of which give you very powerful low-level control, but require a lot of configuration)


I thought it was relatively obvious from my requirements, but I cannot have a point-to-point solution, it needs to be a private subnet not clients connecting to a single server. And I definitely don't want to create configurations to connect to the entire set of permutations of servers.

closed as off-topic by Jenny D says Reinstate Monica, Andrew Schulman, Kenny Rasschaert, Khaled, colealtdelete Jun 6 '18 at 18:48

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Requests for product, service, or learning material recommendations are off-topic because they attract low quality, opinionated and spam answers, and the answers become obsolete quickly. Instead, describe the business problem you are working on, the research you have done, and the steps taken so far to solve it." – Jenny D says Reinstate Monica, Andrew Schulman, Kenny Rasschaert, Khaled, colealtdelete
If this question can be reworded to fit the rules in the help center, please edit the question.

  • What distro of Linux? – hobodave Sep 25 '10 at 19:04
  • It is Centos 5.5 – Erik Funkenbusch Sep 25 '10 at 19:47
  • Well I was going to say it isn't that complicated to setup L2TP/Ipsec with Openswan on CentOS, but you edited your question to exclude IPSec. – hobodave Sep 25 '10 at 20:50
  • Don't they offer VLANs? That should have no impact on resources and stable. Alternatively, OpenVPN is definitively not complicated nor does it require a great deal of configuration to make it work. – Unreason Sep 27 '10 at 16:09
  • No, they don't offer vlans. OpenVPN is simple only if you have a single point to point configuration, it gets very complex after that. – Erik Funkenbusch Sep 28 '10 at 16:59

tinc does exactly what you want; although automated deployment would require extra scripting.

Edit: highlights:

  • User space tun/tap daemon, runs at least on win + lin, without user interaction
  • Creates a single virtual nic on a hub/switch (layer 2) or router (layer 3) (depending on config) for your entire cloud, so no N^2 cross-tunnels or gateways required for a full any-to-any
  • ipv6 compatible (in fact in use at some pops on ipv6 tunnel system sixxs)
  • Smaller community, but very knowledgeable and helpful
  • This looks promising. Yes, i'm looking at about 20 servers, so i don't want to have to have point to point systems. – Erik Funkenbusch Sep 25 '10 at 19:51

Most stable decision OpenVPN and IPsec. Stunnel is very easy, try it first.

  • Nice, listing the hardest solution on every level. – Joris Sep 25 '10 at 19:07
  • +1 for Stunnel. Simplest to set up without having to really touch your app. – JustinShoffstall Sep 25 '10 at 20:09
  • 4
    OpenVPN just isn't hard, in any way. – tomfanning Sep 25 '10 at 20:10
  • No, it's not hard at all.. that's why their mailing list is inundated with people trying to make it work. OpenVPN is easy if you have a simple configuration. It gets very complicated very quickly. – Erik Funkenbusch Sep 25 '10 at 20:15
  • 1
    thumbs up for openvpn. but ipsec - i would not go that way - standard-based - yes, but setting this up - no, thanks. – pQd Sep 25 '10 at 20:19

Can you configure IPSec to encrypt the network traffic? This wouldn't require any changes to the application code, just a quick config change on your servers.

  • IPsec between Windows and Linux are not very quick decision – bindbn Sep 25 '10 at 19:18
  • Yeah, i've alrady wasted a lot of time trying to get windows and linux to talk to each other via IPSec. I'm sure it can be done, but wow... – Erik Funkenbusch Sep 25 '10 at 19:53
  • I've never done a Windows to Linux IPSec. Getting it setup for Windows to Windows should be pretty easy. Then it's just the linux part. – mrdenny Sep 25 '10 at 20:41

You didn't say if you wanted a mesh or single server to multiple client setup. For a single server setup, OpenVPN is easy and works. Never tried a mesh setup with OpenVPN.

  • It's not a single server multiple client setup. Some clients talk to each other, some talk to the database server. At some point we will have to cluster the database servers, etc.. Point to point just doesn't work. And I don't want all traffic going through a central server (that's a single point of failure) – Erik Funkenbusch Sep 26 '10 at 17:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.