3

Recently I posted a question in SO, but so far I got no answers. I wonder if I'm asking the wrong question.

This is the problem:

We need to design an application which offers a public http web service, but at the same time it must consume some services through a VPN connection from other existing company. There is no other alternative but to use a VPN connection to access those services. We want to host our application in some cloud infrastructure like Heroku or Amazon EC2. But there is no direct way to access the VPN services of the other company from there.

The solution I'm thinking, but I don't like is to have a different server to expose the services from that VPN. But this will require the setup of another server which I prefer to avoid. In the case this is the solution, can I use an Amazon EC2 instance to connect to a VPN? This is what I was thinking, is it correct?

I don't have experience using VPNs, tunnels or those kind of networking stuff. I will really appreciate if you can propose me an alternative solution, or just give me a comment.

Improve this question
0

Are the services you're accessing Web Services, or something else?

If they are web services, then what you've described in your non-ideal setup would work quite well. You would set up a 3rd server that would act as a proxy for your web services, accepting requests from your "cloud" server, and tunneling them over the VPN to the corporate network (This is called a "reverse proxy").

Slapping on SSL (even self-signed would do as you only have to trust yourself) and only permitting the IP address of your "cloud" server through the firewall would even keep it pretty secure, but you're right in that its a lot of additional management overhead (although I've done similar things myself in the past, and once they're running you can usually just leave them alone for years at a time).

What I would suggest is finding a "cloud" provider (I use the term loosly, as a "cloud" server is really just a VPS bundled with a few other external technologies) where you have full administrator/root access to the machine and then create a VPN the way you would normally.

This will probably cost a small amount than other options, but is probably worth it in the long run.

Improve this answer
3
  • Yes, those are plain Web Services. Really helpful answer, I was not so wrong then. It didn't occur to me about the self-signed certificate, cool! Just other thing, just to confirm, then with that setup I can use any Amazon EC2 instance, for example, running Ubuntu or CentOS and have a VPN client, right? Are OpenVPN and Openswan the right tools to use? – Christian Jan 7 '11 at 2:07
  • @Christian - If you can get access to the console of your OS then you will need to match whatever technology is set up on the other side of the VPN. So if they are using OpenVPN then you will too. If they are using PPTP then you will need to use PPTP, etc. The best way to get help with that is to find out what technology the other end of the VPN is using and if you can't get it working on your server, then search here or ask another question. This is why administrative console access is absolutally critical in getting this to work most of the time. – Mark Henderson Jan 7 '11 at 3:02
  • I see, it's very clear now. Thankx a lot! – Christian Jan 7 '11 at 3:05
-1

Yes, I think anything that requires a VPN could not be considered a cloud service per se. Ideally you would want to be able to hit a URL and log in with your credentials and the service be presented to you, that would be a true cloud service.

Improve this answer
2
  • Being "in the cloud" doesn't preclude a VPN - in fact Mark already made an excellent case in his answer for a situation where a VPN backhaul from "The Cloud" is an entirely sensible configuration, which doesn't preclude the "Hit a URL with your credentials" scenario you're describing (it just changes where some of the data might be coming from).... – voretaq7 May 6 '13 at 22:09
  • needless to say, amazon VPC can help here. – Sirex May 6 '13 at 23:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.