1

I have a somewhat unique situation that is making managing my vpns a bit of a pain, so I am trying to make it easier on me and my users, hope somenone can give me some ideas and/or alternatives.

The situation right now is that I have around 600 clients that connect to around 6 servers on my network, for mysql database replication. MySQL slaves connect to the master, so the connection comes from my network to the clients network, we used to do this without VPNs, but thats far from secure, so we've been moving everyone to VPNs.

Right now they connect with openvpn straight to the server they are assigned. Thing is, most of the users are not technical, so my team has to connect to them (teamviewer and similars) and do the setup for them, and sometimes we have to move these guys from one server to another. The way it is right now it involves someone from my really small team connecting to the clients server and changing the setup on the server, sometimes their firewall, and that takes way too much time for a team of 3 to manage 600.

Now: CLIENT --- VPN/MYSQL SERVER

So I wanted to make my life easier and I am setting up the 6 servers in a private network, with an extra virtual machine do be the gateway. In that VM I am runnin openvpn with 3 instances, so that would be around 200 clients per instance. Mind that MySQL replication in our case does not use huge ammounts of bandwidth, around 40KBps each user, cause ADSL upload speeds (most clients use adsl) are terrrrrrible.

Now, I was reading over the interwebs and most people said this isnt possible, so I figured this would be the place to double check.

I could have each client connecting to their vpn instance, but I wanted to make it easier and use something like a reverse proxy so I have only one external address and port for connection, and depending on which address they connect to redirect them to the correct port on the openvpn server.

Intended: CLIENT --- FIREWALL --- NGINX ---- CORRECT PORT ON VPN SERVER

Is this possible? If not with nginx with something else? If its not possible what would you do in this situation? I am dying for some ideas here :)

So far I tried setting up nginx to redirect to the vpn server as a fastcgi gateway, no luck, ovpn gets to nginx but doesnt redirect anything. If I try with a browser I get a bad gateway error and only them the ovpn server shows some life signs on the log.

the vpn server instances are as follow (3 of them, different ports and ip pools.)

port 4001
proto tcp
dev tun
ca vpnkeys/keys-vpn1/ca.crt
cert vpnkeys/keys-vpn1/vpn1.crt
key vpnkeys/keys-vpn1/vpn1.key  # This file should be kept secret
dh vpnkeys/keys-vpn1/dh1024.pem
server 172.16.101.0 255.255.255.0
ifconfig-pool-persist ipp-vpn1.txt
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status-vpn1.log
verb 3
push "10.0.100.11 255.255.255.255"

the client conf is

client
dev tun
proto tcp
remote vpn-001.myserver.com 80 # firewall throws to nginx on port 4000
resolv-retry infinite
nobind
# comentar as duas linhas abaixo em maquinas windows
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert cliente-xxxxx.crt
key cliente-xxxxx.key
ns-cert-type server
comp-lzo
verb 3
mute-replay-warnings

and on nginx I have the following config for each vpn hostname

server {
   listen 4000;
   server_name vpn-001.myserver.com;

   location / {
   fastcgi_pass 10.0.0.137:4001;
   }
}

When ovpn client tries to connect I get this garbage on nginx error log. 10.0.0.4 is my firewall.

10.0.0.4 - - [25/Jun/2014:17:45:06 -0300] "\x00\x0E8\x84\xF1\xEB\xF2\x14>Z\xF2\x00\x00\x00\x00\x00" 400 173 "-" "-"
10.0.0.4 - - [25/Jun/2014:17:45:12 -0300] "\x00\x0E8\xC1\xE0(A\xD8\xAC\x16\xB2\x00\x00\x00\x00\x00" 400 173 "-" "-"
10.0.0.4 - - [25/Jun/2014:17:45:18 -0300] "\x00\x0E8\x95\xB4\x18[\x03@\xCA\xFC\x00\x00\x00\x00\x00" 400 173 "-" "-"
10.0.0.4 - - [25/Jun/2014:17:45:24 -0300] "\x00\x0E8\xE4{\xEE<\x98\x1B\x97K\x00\x00\x00\x00\x00" 400 173 "-" "-"
10.0.0.4 - - [25/Jun/2014:17:45:30 -0300] "\x00\x0E8\xE0'\x1Fr?\x06\xE33\x00\x00\x00\x00\x00" 400 173 "-" "-"
10.0.0.4 - - [25/Jun/2014:17:45:36 -0300] "\x00\x0E8g\xC8\xD8w8VH2\x00\x00\x00\x00\x00" 400 173 "-" "-"
10.0.0.4 - - [25/Jun/2014:17:45:42 -0300] "\x00\x0E8N\xFC\xCA\xE4\xC58\xD63\x00\x00\x00\x00\x00" 400 173 "-" "-"
10.0.0.4 - - [25/Jun/2014:17:45:48 -0300] "\x00\x0E8TL\x85=\x15\xE4\xF2\xD6\x00\x00\x00\x00\x00" 400 173 "-" "-"
10.0.0.4 - - [25/Jun/2014:17:45:54 -0300] "\x00\x0E8\xB0\x9A\x8D\x8Dq\xBE\xCD3\x00\x00\x00\x00\x00" 400 173 "-" "-"

and nothing gets to the ovpn server log. ( i know it does redirect cause when i use a browser to connect to the same address i get a bad gateway error from nginx and some response on ovpn log )

thoughts? ideas?

2
  • Another option is port forwarding over a SSH session. This is the method I use to remotely access MySQL databases. – Brian Jun 27 '14 at 12:51
  • thats not really what i need but thanks anyway :) – Argais Jun 27 '14 at 17:12
0

Maybe you can just create a DNS CNAME for every client, for example:

clientname.mysql.myserver.com. CNAME mysql1.myserver.com.

Instead of connecting to it's own VPN connect all clients to a single VPN and then they'd just connect to mysql server clientname.mysql.myserver.com. Moving a client database between servers would be as easy as changing this CNAME to

clientname.mysql.myserver.com. CNAME mysql2.myserver.com.

This is much simpler. But I'm not sure if I understand correctly what do you want to achieve.

5
  • cant have 600 people connecting to the same vpn server can I? wouldnt I run out of IPs on the subnet? or i could simply change the subnet mask to 255.255.0.0 and openvpn would use all of the /16 possible ips? (i feel dumb for not thinking about this before.) – Argais Jun 27 '14 at 14:30
  • I'm not a VPN expert but I suppose you can configure it even to use class A (10.0.0.0/8) private network, which would allow 16M of IP addresses. It's just a matter of how many concurrent VPN connections your server can handle reasonably well. You can also use private class B (172.16.0.0/16..172.31.0.0/16). – Tometzky Jun 27 '14 at 14:36
  • OpenVPN HOWTO recommends seldom used private networks for this purpose, which means something like 172.27.0.0/16. This is to avoid conflict with internal networks of your clients, as majority of them use 192.168.0.0/24 or 10.0.0.0/8. – Tometzky Jun 27 '14 at 14:57
  • I will try to get that confirmed, and double check the docs. – Argais Jun 27 '14 at 17:11
  • I was aware of the recomendation on the howto, thanks, guess i just didnt connect the docs. – Argais Jun 27 '14 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.