2

I have a number of remote hosted servers for various purposes--web and application servers. I effectively want a "management network" of sorts so I can simplify tasks like log collection and package management, but this is difficult with the servers residing in third-party datacenters.

I am looking at setting up a dedicated OpenVPN server in our office and installing clients on each remote server in order to give the same function as a dedicated management network. However I have been unsuccessful looking for examples of other folks having done this. The idea:

  • Dedicated OpenVPN server on a VM in our office (separate from user VPN to connect to office network)
  • Remote servers configured as clients that auto connect at startup
  • Client-to-client disabled so if one server is compromised, damage is limited
  • Virtual IPs non-routable from office LAN

Is this a sane idea, or is there a better approach?

Edit: All servers (in office and remote) run various flavors of Linux. No Windows involved.

4
  • There are solutions out there which are tried and true. And generally reinventing the wheel isn't something you want to end up trying to do. That being said as long as you can make sure your VPN solution doesn't cause overhead on your app servers the idea itself is sane.
    – Reaces
    Feb 19, 2015 at 17:43
  • In case I'm not the only clueless one, can you elaborate on the tried and true solutions? I'm not interested in reinventing the wheel.
    – Mike S.
    Feb 19, 2015 at 19:31
  • 1
    My only experience with it is immediately a hard example to follow for smaller business, regardless where I work we monitor branch offices using nagios. Collecting logs from linux servers using stunnel and for some cases we have IPSec tunnels.
    – Reaces
    Feb 19, 2015 at 19:35
  • stunnel may be sufficient, I will investigate. Thanks!
    – Mike S.
    Feb 19, 2015 at 19:39

3 Answers 3

3

I have been unsuccessful looking for examples of other folks having done this.

I am doing something like above. I have a bunch of appliances I maintained deployed to customer's networks. They maintain an OpenVPN link so I can update, manage, and monitor them. IPsec, while good theoretically, often takes more work to get through firewalls.

Setting up a simple management network over OpenVPN should be very easy. There is nothing particularly wrong about using OpenVPN for this purpose.

1
  • Thanks for the experience-based feedback. I've also spent time looking at stunnel, but I haven't found anything that beats the simplicity of a single implementation for all communication back and forth to the servers (everything from administration, syslogs, and backups).
    – Mike S.
    Feb 20, 2015 at 14:08
2

I would use OpenVPN. IPSec is more mature than OpenVPN, but is heavier, have more overhead, and is a pain to configure and troubleshoot. L2TP and PPTP are other examples, but they are harder to make work and harder to cross firewalls and NAT.

Configure OpenVPN with all security options turned on, create separate certificates to each client, configure the firewall on the VPN server to drop all connections to OpenVPN port and only accept from the IP of your servers.

1

Can it be done? Sure.

Is it a good idea? No.

Instead, use IPSec. It's a very mature technology that is baked into all modern OSes, and is a much better choice for "infrastructure" type VPN connections.

OpenVPN is great, but IMO, should only be used for remote worker type use cases, not for infrastructure.

5
  • From what I understand, IPsec and its double encapsulation requires more overhead and thus doesn't perform as well as SSL tunnels like OpenVPN uses. The idea screams "Windows" to me (I may be wrong, but I'll clarify the question anyway).
    – Mike S.
    Feb 19, 2015 at 19:42
  • 1
    IPsec and its double encapsulation requires more overhead - Would that really matter all that much for a management network? An extra millisecond of latency, or having a few extra packets because of overhead is not likely to make that big of a difference in the long run.
    – Zoredache
    Feb 19, 2015 at 20:16
  • @MikeS. IPSec screams "Windows"? Well, I've only ever used it on Linux, BSD, and Cisco systems, never once on windows. I've not found it particularly difficult to configure, troubleshoot, etc. It Just Works (tm).
    – EEAA
    Feb 19, 2015 at 22:00
  • Zoredache, valid point. @EEAA, point also taken, still the merits of IPsec alone don't help me understand why OpenVPN isn't a good idea.
    – Mike S.
    Feb 20, 2015 at 14:01
  • "double encapsulation"? If this is AH+ESP, OpenVPN is more similar to the IPsec tunnel mode: IP/ESP/IP looks comparable to IP/OpenVPN/IP (or IP/TLS/OpenVPN/IP) in terms of number of layers.
    – ysdx
    Mar 10, 2015 at 12:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .