6

We are using Paid version of OpenVPN on AWS. Now we want to setup HA but we could not find any proper solution for OpenVPN HA on AWS. Tried OpenVPN document but it doesn't meet the requirement of HA on AWS. Can anyone share/suggest best solution for OpenVPN HA ON AWS

3
  • please specify if you need an active/active o active/passive deployment and what is the VPN used for: is it used to access EC2 instances inside a VPC on AWS or is it used for intra-client communication or to surf the Internet? Apr 18 '18 at 12:07
  • Yes. Need Active/Active. And it will be connect to Hybrid infrastructure. Apr 18 '18 at 12:32
  • @LucaGibelli , Could you please let me know best way to achieve HA. If you have any solution for active/passive please share. Apr 19 '18 at 12:14
5

Start two OpenVPN Access Server instances, assign an Elastic IP to each of them. Configure them for LDAP authentication, so that you don't need to create all accounts twice and keep them sync'ed across the two instances.

Open the admin interface on ip:443/admin and click LDAP -> Set LDAP:

https://openvpn.net/index.php/access-server/docs/admin-guides/190-how-to-authenticate-users-with-active-directory.html

You can deploy your own LDAP service or you can use:

https://aws.amazon.com/directoryservice

Now you have to decide how you want clients to connect to these instances.

The easiest way is to add to the client config both OpenVPN Access Servers:

remote-random
remote hostname-of-instance1
remote hostname-of-instance2

Alternatively you could create a round robin record in AWS Route53 with both IP addresses and have Route53 monitor the reachability of the nodes and remove the unreachable instance when needed:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html

In this case you only need:

remote round-robin-record

in your OpenVPN clients config file.

Alternatively you could deploy an AWS ELB, choose the number of instances that you want in execution at any time and let the ELB spawn and retire instances as required, whenever they die or become unreachable.

In this case your OpenVPN clients would be connecting to the IP address/hostname of the ELB itself.

EDIT: When one of the OpenVPN servers goes down, your clients will get disconnected and most likely you want them to automatically reconnect to the surving OpenVPN server. You can achieve this by adding:

keepalive 10 120

to the OpenVPN config file. More info on: https://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html

With this setting, clients and servers will ping each other every 10 secs. If no traffic is seen by one party for longer than 120 secs, the tunnel is shutdown + restarted.

EDIT2:

If you don't want OpenVPN to prompt the user to re-enter his login/password everytime he reconnects, ask him to add this to his OpenVPN client config file:

auth-user-pass auth.txt

Then create a file called auth.txt in the same dir of the config file, with just two lines:

mylogin
mypassword

Make sure the file is adequately protected.

10
  • Thanks for your well explained solution. Issue with session expiration. when you stop one server, user getting log out and then again need to manually login. can we do auto login ? Apr 20 '18 at 12:34
  • You're welcome. I updated the answer to explain also how to automatically restart tunnel when one server goes down Apr 20 '18 at 13:24
  • User not getting signin automatically. if connected one server goes down again asking for password for connected user. can we avoid this ? user should automatically switch to secondary server without asking password. Apr 20 '18 at 14:42
  • Sorry, I misunderstood your previous comment. Answer updated. Apr 20 '18 at 16:21
  • 1
    that's a bit trickier and I don't have an easy answer: if you want a site-to-site VPN between your AWS VPC and the subnets behind your VPN clients you would have to use the solution with the ELB and point the hosts in the AWS VPC to use the ELB as the gw to the subnets of the VPN clients. More details on community.openvpn.net/openvpn/wiki/RoutedLans Oct 3 '19 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.