We are using Paid version of OpenVPN on AWS. Now we want to setup HA but we could not find any proper solution for OpenVPN HA on AWS. Tried OpenVPN document but it doesn't meet the requirement of HA on AWS. Can anyone share/suggest best solution for OpenVPN HA ON AWS
Start two OpenVPN Access Server instances, assign an Elastic IP to each of them. Configure them for LDAP authentication, so that you don't need to create all accounts twice and keep them sync'ed across the two instances.
Open the admin interface on
ip:443/admin and click LDAP -> Set LDAP:
You can deploy your own LDAP service or you can use:
Now you have to decide how you want clients to connect to these instances.
The easiest way is to add to the client config both OpenVPN Access Servers:
remote-random remote hostname-of-instance1 remote hostname-of-instance2
Alternatively you could create a round robin record in AWS Route53 with both IP addresses and have Route53 monitor the reachability of the nodes and remove the unreachable instance when needed:
In this case you only need:
in your OpenVPN clients config file.
Alternatively you could deploy an AWS ELB, choose the number of instances that you want in execution at any time and let the ELB spawn and retire instances as required, whenever they die or become unreachable.
In this case your OpenVPN clients would be connecting to the IP address/hostname of the ELB itself.
EDIT: When one of the OpenVPN servers goes down, your clients will get disconnected and most likely you want them to automatically reconnect to the surving OpenVPN server. You can achieve this by adding:
keepalive 10 120
to the OpenVPN config file. More info on: https://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html
With this setting, clients and servers will ping each other every 10 secs. If no traffic is seen by one party for longer than 120 secs, the tunnel is shutdown + restarted.
If you don't want OpenVPN to prompt the user to re-enter his login/password everytime he reconnects, ask him to add this to his OpenVPN client config file:
Then create a file called auth.txt in the same dir of the config file, with just two lines:
Make sure the file is adequately protected.