Share conection information between openvpn servers

Adrian

Hello,

I'm thinking about configure 20 openvpn servers with the same configuration and use load balancer (IPVS) for balance the client connections. According than I readed in internet this is viable.

The next thing that I want to achieve is to share the information of the clients that are connected to each server with the other servers. This information I can find in "status.log" file. By this way, I could be able comunicate with any client indifferently of which server is it using.

Do you know how can I achieve this?

I think in two solutions:

1)
Use one independent server (directory) for registry wich server is the client connected.
When one client connect to the server, send the status.log entries to directory server. Then, when I want connect to one client, first of all I would ask to directory in wich server is the client connected and then connect to client throught this server.

2)
Utilize some protocol (I don't know which) to share status.log entries with all servers. Then, when I want connect with client, I go to random server and this server would forward me the connection throught the good server.

Thank you a lot ! :lol:

janjust

I would not use the status file for this , but set up the management interface on each server; then write a plugin or script so that one server can query the management interface of the other servers.

Other people have set up systems where all client connections are logged in a central database; the advantage of this is that you can give the same IP address to a client regardless of the server to which it connects; this requires some trickery however, which I don't have access to 😉

Adrian

Thank you for the advices,

I think the management interface could be the best way for obtain actual client list and their information (IP).

For give the same IP to clients, I thought in share the same "ccd". So, the servers will always give the same ip to a client.

I don't have clear how can I know in which server is connected one client.
For example, if I want to connect via telnet with one client, first of all I'd have to ask to all servers (via management) about this client and then modify my routing table according the response, adding one entry like this:

route add -host "clientIP"/32 gw "openvpnserver".

Do you think that this is a good solution?

Thanks ! :lol:

janjust

that would be the rough idea, yes.

Mimiko

See this topic for working solution: https://forums.openvpn.net/topic8966.html

Adrian

Thank You Mimiko.

I readed It, but it isn't the exact thing that I want to achieve.
I put a diagram for help what I want to do.

The goal is connect from "My computer" to any client via ssh. The clients can connect to any server "randomly" because they connect throught an IPVS server

Thanks.

Adrian

This is the image again.

http://img717.imageshack.us/img717/9655/diagramaloadbalancing.png

Mimiko

You will have to use a router between your computer and OpenVPN servers, which will dinamically route to desired client by IP. You will have to configure each OpenVPN server to push same IP to clients by it's common name. Also, on client connect, OpenVPN server must send a command to the router to update the routing table, so the router knows to which OpenVPN server particular client connected.

Adrian

Thanks !

I'm deploying something like you've said. The openvpn servers record in a DB the clients location. Then, anybody knows where is each clients.
This is a "homemade" solution but I thought that existed any other solution using routing protocols or something like that.
:idea:
Thank you !