I have a little bit of experience with setting up a simple OpenVPN solution where a few clients connect to a central server and communicate altogether in one VPN.
However I am now about to set up an OpenVPN-Infrastructure from scratch and I am questioning my self if my considered approach is a reasonable one. The OpenVPN infrastructure has the following characteristics:
- There are N sites of two types:
- Mobile sites
- Stationary sites
- Logically, each mobile site has exactly one assigned stationary site
- Stationary clients of site A may only talk to mobile clients of site A and vice versa
- One or multiple mobile clients (linux) per site shall connect to a central server (linux) via a mobile network and thus have no fixed IP that can reached directly because of the provider's NAT.
- One or multiple stationary clients (windows) per site shall connect to one central server. Each of those clients should have the possibility to connect to one of the mobile clients or a subset of the mobile clients. However, the stationary client must not communicate with more than a single mobile client at a time.
- The communication between two connected clients should be isolated from all other possibly established connections.
- Mobile clients most likely try to always have a connection to the central server. But they might be configured to only connect upon request.
- Stationary clients may establish a connection to the central server at any time and shall be able to communicate instantly to the desired mobile client (when it is also connected, of course)
- A communication amongst all mobile clients of one mobile site or a communication amongst a subset of clients of one mobile site could be a requirement for the future. However even if that requirement would be given, the stationary clients may still only connect to one single mobile client.
- Stationary clients, even belonging to the same site do never have to talk to each other
- One administrative stationary client in charge of the infrastructure must have access to each mobile client (one at a time), no matter which site it belongs to. The administrative client never has to talk to one of the stationary clients.
- The whole infrastructure will (in the first place) have all mobile clients equipped with OpenVPN 2.1.3 which is quite old and might change with firmware updates (nothing that I am in charge of). Stationary clients and server will have far more recent versions of OpenVPN.
- The amount of data that is transferred regularly between stationary and mobile client is quite low (I expect it to be less than a few KiB/s) however this may increase a lot over time, depending which additional communication technologies we will use in the future.
After some reading and thinking I came up with the idea, that all of those requirements can be met by:
- Providing a single central OpenVPN server (Considering using a docker-contained solution like https://github.com/kylemanna/docker-openvpn)
- Providing a scripted infrastructure where an adminstrative authority can request a pair of staionary cert/pk and mobile cert/pk as well as performing a configuration change in the OpenVPN server, that sets some routing/ip configs based on the common names that are used.
- Providing a possibility in the stationary clients to select the desired mobile target to connect to by simply connecting to the server using a specific cert/pk pair.
Does this sound like a reasonable mechanism to meet the requirements? If looking at the approach with scalability and speed in mind, should I set up the things like that or should I do some research for alternatives (even other technologies than OpenVPN?)
Thank you for your input in advance