I have servers that I wish to control access to. I have a firewall running pfSense between them and the public internet, but all machines have public IPs.

A remote client may or may not be on the same subnet as the servers and firewall. I wish to, based on authentication, allow the remote client full access to the servers behind the firewall.

I believe the best way to do this is through VPN.

Note that normally when people refer to VPN connecting the same subnet, they refer to two machines having the same private IP ranges. That is very different than what I am describing. I simply want to tunnel traffic for a subnet through VPN to bypass the firewall.

What is the best way to go about this? If you suggest OpenVPN, tun or tap?

Thank you!

  • How many ip addresses do you have on your servers? If you have only the public interface it looks rather difficult to route the traffic to some kind of vpn tunnel. – Olivier S Dec 7 '11 at 6:47
  • Trying to get by with just 1. I guess I could do 1:1 NATing. – Craig Younkins Dec 7 '11 at 7:13

I'm surprised no-one's picked up on this question, but I'll bite.

You're right to say that a VPN is often used to tunnel connections between two unroutable (RFC 1918) networks across the public internet, but it's not the only use for it. The clue's in the name - Virtual Private Network. Any time you want to connect two or more networks (where a network is one or more hosts), over the public internet, privately (that is, without any of the intermediate routing devices being able to see or interfere with the traffic), a VPN's suitable for the job.

So yes, I think OpenVPN would work very well for you here, and the fact that one end of the tunnel is a single host isn't a problem. I don't have any detailed knowledge about TUN vs. TAP, though I believe that in a routed situation TUN is generally more appropriate.

You could also use stunnel, or an ssh-based VPN (that's just one tutorial I found with google, I can't especially recommend it), or (if you want maximum cred as well as the largest headache you can remember having) full-blown IPSec.

All of these are appropriate for connecting one single-public-IP-address endpoint securely to another single-public-IP-address endpoint over the public internet.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.