The situation is this:
- I have a Debian server which acts as a web/mail server as well as an Internet gateway for a small office. All the externally available services run on OpenVZ virtual environments.
- I have a requirement to provide external access to a directory (for a designer) shared with the employees inside the office. The directory must be accessible via SMB, so I've set up OpenVPN to provide secure access to Samba over the internet.
- For additional security, I don't want to give OpenVPN remote users (which there might be more of in the future) full access to the company network, so I plan to set up a Samba daemon on one Virtual Environment, listening only on the OpenVPN virtual interface, and a separate Samba daemon on the physical machine, listening only on the internal network interface. The daemons would serve the same directory located inside the VE's root tree (and accessible to the physical machine's OS).
The main question is this: Won't there be conflicts (file locking issues, etc) when the files are accessed simultaneously from the internal network and the outside (which is likely as this setup is for Adobe InDesign/InCopy collaboration)? If so, what would be a better setup in this situation? Another alternative i'm thinking of is making the internal Samba daemon accessible on the OpenVPN interface through port forwarding. Again, I don't want OpenVPN clients to have actual full access to company network, i just want Samba shares working across the Internet (which the planned workflow requires).
If somebody has any experience with a similar setup, I would be very grateful if you shared your insights.
Edit - clarifications: I use OpenVPN with a bridged VPN (a tap interface) as I understand that is the right choice for Samba (would it even work on a routed VPN? Wouldn't it require elaborate forwarding/routing setup?) However, I don't want to bridge the VPN with the physical server's interface for 3 reasons: Avoid disturbing the company network while bringing the interface up&down; Avoid granting external clients access to the whole internal network; As a policy rule, avoid running public services on the physical machine.
Currently, I plan to use option 1:
- option 1: running OpenVPN and Samba on a VE for the external clients and a second Samba instance on the main server for the employees (who don't need VPN). However I worry about two instances of Samba serving the same files and clashing (hence the original question formulation).
- Option 2 would be to run just OpenVPN on in the VE and forward the Samba ports to the physical machine (or Hardware Node in OpenVZ terms).
- Option 3 would be to not bother with VEs for this service (as it's essentialy non-public) and just run OpenVPN on the Hardware Node with a tap (bridge) interface but NOT actually bridge it with a physical interface, then make the single Samba instance listen on the internal network interface & the tap interface (for VPN clients), and NOT listen on the external interface.
So, the updated question would be: would option 3 be any less secure than the first two? If not, I would implement it as it seems to be the simplest and most robust.
Sorry I couldn't express it in less words :) Thanks for reading and answers.