I have a somewhat unique situation that is making managing my vpns a bit of a pain, so I am trying to make it easier on me and my users, hope somenone can give me some ideas and/or alternatives.
The situation right now is that I have around 600 clients that connect to around 6 servers on my network, for mysql database replication.
MySQL slaves connect to the master, so the connection comes from my network to the clients network, we used to do this without VPNs, but thats far from secure, so we've been moving everyone to VPNs.
Right now they connect with openvpn straight to the server they are assigned.
Thing is, most of the users are not technical, so my team has to connect to them (teamviewer and similars) and do the setup for them, and sometimes we have to move these guys from one server to another.
The way it is right now it involves someone from my really small team connecting to the clients server and changing the setup on the server, sometimes their firewall, and that takes way too much time for a team of 3 to manage 600.
Now: CLIENT --- VPN/MYSQL SERVER
So I wanted to make my life easier and I am setting up the 6 servers in a private network, with an extra virtual machine do be the gateway.
In that VM I am runnin openvpn with 3 instances, so that would be around 200 clients per instance.
Mind that MySQL replication in our case does not use huge ammounts of bandwidth, around 40KBps each user, cause ADSL upload speeds (most clients use adsl) are terrrrrrible.
Now, I was reading over the interwebs and most people said this isnt possible, so I figured this would be the place to double check.
I could have each client connecting to their vpn instance, but I wanted to make it easier and use something like a reverse proxy so I have only one external address and port for connection, and depending on which address they connect to redirect them to the correct port on the openvpn server.
Intended: CLIENT --- FIREWALL --- NGINX ---- CORRECT PORT ON VPN SERVER
Is this possible? If not with nginx with something else?
If its not possible what would you do in this situation? I am dying for some ideas here 🙂
So far I tried setting up nginx to redirect to the vpn server as a fastcgi gateway, no luck, ovpn gets to nginx but doesnt redirect anything. If I try with a browser I get a bad gateway error and only them the ovpn server shows some life signs on the log.
the vpn server instances are as follow (3 of them, different ports and ip pools.)
port 4001
proto tcp
dev tun
ca vpnkeys/keys-vpn1/ca.crt
cert vpnkeys/keys-vpn1/vpn1.crt
key vpnkeys/keys-vpn1/vpn1.key # This file should be kept secret
dh vpnkeys/keys-vpn1/dh1024.pem
server 172.16.101.0 255.255.255.0
ifconfig-pool-persist ipp-vpn1.txt
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status-vpn1.log
verb 3
push "10.0.100.11 255.255.255.255"
the client conf is
client
dev tun
proto tcp
remote vpn-001.myserver.com 80 # firewall throws to nginx on port 4000
resolv-retry infinite
nobind
# comentar as duas linhas abaixo em maquinas windows
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert cliente-xxxxx.crt
key cliente-xxxxx.key
ns-cert-type server
comp-lzo
verb 3
mute-replay-warnings
and on nginx I have the following config for each vpn hostname
server {
listen 4000;
server_name vpn-001.myserver.com;
location / {
fastcgi_pass 10.0.0.137:4001;
}
}
When ovpn client tries to connect I get this garbage on nginx error log. 10.0.0.4 is my firewall.
10.0.0.4 - - [25/Jun/2014:17:45:06 -0300] "\x00\x0E8\x84\xF1\xEB\xF2\x14>Z\xF2\x00\x00\x00\x00\x00" 400 173 "-" "-"
10.0.0.4 - - [25/Jun/2014:17:45:12 -0300] "\x00\x0E8\xC1\xE0(A\xD8\xAC\x16\xB2\x00\x00\x00\x00\x00" 400 173 "-" "-"
10.0.0.4 - - [25/Jun/2014:17:45:18 -0300] "\x00\x0E8\x95\xB4\x18[\x03@\xCA\xFC\x00\x00\x00\x00\x00" 400 173 "-" "-"
10.0.0.4 - - [25/Jun/2014:17:45:24 -0300] "\x00\x0E8\xE4{\xEE<\x98\x1B\x97K\x00\x00\x00\x00\x00" 400 173 "-" "-"
10.0.0.4 - - [25/Jun/2014:17:45:30 -0300] "\x00\x0E8\xE0'\x1Fr?\x06\xE33\x00\x00\x00\x00\x00" 400 173 "-" "-"
10.0.0.4 - - [25/Jun/2014:17:45:36 -0300] "\x00\x0E8g\xC8\xD8w8VH2\x00\x00\x00\x00\x00" 400 173 "-" "-"
10.0.0.4 - - [25/Jun/2014:17:45:42 -0300] "\x00\x0E8N\xFC\xCA\xE4\xC58\xD63\x00\x00\x00\x00\x00" 400 173 "-" "-"
10.0.0.4 - - [25/Jun/2014:17:45:48 -0300] "\x00\x0E8TL\x85=\x15\xE4\xF2\xD6\x00\x00\x00\x00\x00" 400 173 "-" "-"
10.0.0.4 - - [25/Jun/2014:17:45:54 -0300] "\x00\x0E8\xB0\x9A\x8D\x8Dq\xBE\xCD3\x00\x00\x00\x00\x00" 400 173 "-" "-"
and nothing gets to the ovpn server log. ( i know it does redirect cause when i use a browser to connect to the same address i get a bad gateway error from nginx and some response on ovpn log )
thoughts? ideas?
