4

Is it possible to implement two OpenVPN with failover and replication capability? As in, if one is down/fails, the other one is avaliable for authentification, server/client configuration, etc. ?

Improve this question

2 Answers 2

Reset to default
5

I failed to understand why to shoot from cannon to the fly. IHMO there's a simpler way: To use build-in OpenVPN features and linux iproute2 for multipath redundancy. I'll be safer, more stable and less resource consuming.

Source: https://openvpn.net/index.php/open-source/documentation/howto.html

Implementing a load-balancing/failover configuration Client

The OpenVPN client configuration can refer to multiple servers for load balancing and failover. For example:

remote server1.mydomain
remote server2.mydomain
remote server3.mydomain

will direct the OpenVPN client to attempt a connection with server1, server2, and server3 in that order. If an existing connection is broken, the OpenVPN client will retry the most recently connected server, and if that fails, will move on to the next server in the list. You can also direct the OpenVPN client to randomize its server list on startup, so that the client load will be probabilistically spread across the server pool.

remote-random

If you would also like DNS resolution failures to cause the OpenVPN client to move to the next server in the list, add the following:

resolv-retry 60

The 60 parameter tells the OpenVPN client to try resolving each remote DNS name for 60 seconds before moving on to the next server in the list.

The server list can also refer to multiple OpenVPN server daemons running on the same machine, each listening for connections on a different port, for example:

remote smp-server1.mydomain 8000
remote smp-server1.mydomain 8001
remote smp-server2.mydomain 8000
remote smp-server2.mydomain 8001

If your servers are multi-processor machines, running multiple OpenVPN daemons on each server can be advantageous from a performance standpoint.

OpenVPN also supports the remote directive referring to a DNS name which has multiple A records in the zone configuration for the domain. In this case, the OpenVPN client will randomly choose one of the A records every time the domain is resolved. Server

The simplest approach to a load-balanced/failover configuration on the server is to use equivalent configuration files on each server in the cluster, except use a different virtual IP address pool for each server. For example:

server1

server 10.8.0.0 255.255.255.0

server2

server 10.8.1.0 255.255.255.0

server3

server 10.8.2.0 255.255.255.0
Improve this answer
3
  • The last paragraph is my issue: They would have to be all on the same address pool to be able to access resources and subnets. If not, on each server I would have to configure iroute and route pushing...not ideal IMO.
    – riahc3
    May 4, 2015 at 18:13
  • You can bypass it using; bridge, tap & dhcpd. Including pushing routes. Compatibility: everything excluding MacOS.
    – Michal Sokolowski
    May 4, 2015 at 19:33
  • For reference of dhcpd configuration please look @ my post: superuser.com/questions/874671/…
    – Michal Sokolowski
    May 4, 2015 at 19:46
0

Failover? Yes, I do it all the time, using heartbeat and CRM. It's not worth trying to replicate or preserve state; when the failover happens, all connected clients will reauthenticate anyway, and that's fine for road-warriors. It wouldn't be fine for site-to-site VPNs, but (imho) OpenVPN is the wrong tool for those, anyway.

Improve this answer
7
  • 1
    heartbeat is deprecated, corosync+crm is a good solution
    – c4f4t0r
    May 4, 2015 at 11:35
  • Excellent recommendation, I'm sure; mostly I was establishing that it can be done, and is in some quarters fairly normal practice. How you do it might be an OT question!
    – MadHatter
    May 4, 2015 at 11:37
  • Ive searched Google and Ive found some information but this is personally beyond my personal scope. Could you explain how exactly it works and how it is implemented?
    – riahc3
    May 4, 2015 at 12:13
  • No. That's way outside the scope of an SF question, and I'd've voted to close if you'd asked it (too broad). You need to do your own research and learning. When you've tried, and have specific questions resulting from that attempt, SF may well be a good place to ask them.
    – MadHatter
    May 4, 2015 at 12:32
  • Then really, your response helps 0. Michal Sokolowski not only gives a better solution, but also explains how to implement it.
    – riahc3
    May 4, 2015 at 18:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .