RERobbins
I am considering rebuilding my VPN setup around OpenVPN Access Server and have some high level architecture questions.
My network is simple enough. LAN-A is fed by a residential cable internet service provider. I use a dynamic dns service pegged to the dynamically assigned address received from the ISP. The address almost never changes. LAN-A sits behind an Untangle firewall. When I'm on the road I use the Untangle OpenVPN module to connect to LAN-A. LAN-A has several physical machines plus an ESXi 6.0 setup.
LAN-B is an Amazon Web Services Virtual Private Cloud with a public subnet and a private subnet. One of the public instances in LAN-B is an Amazon Linux instance configured to provide NAT from the private to public subnets of LAN-B. I added the linux openvpn client to that instance and use it to connect LAN-B to LAN-A with the requisite static routes on the AWS VPC.
While this structure is running well, I am, at times, frustrated by some of the limitations in the Untangle OpenVPN implementation and suspect I'd be happier if I used the OpenVPN Access Server in its place. I'm not about to attempt to graft the OpenVPN Access Server on to the Untangle firewall.
So I could deploy the OpenVPN Access Server on an ESXi virtual machine inside LAN-A with port forwarding as need be from the Untangle Firewall.
On the other hand, I could deploy the OpenVPN Access Server in the public subnet of LAN-B. The would allow me to have the server sitting on a routable address at the edge of the network without the need to do port forwarding from a firewall device.
For these reasons, I'm leaning in the direction of putting the OpenVPN Access Server in LAN-B on the AWS VPC. If I do that then I need to consider what to do with LAN-A. It's not obvious to me how to use (of if I can use) the Untangle OpenVPN module as a client for the OpenVPN Access Server. The Untangle module seems geared for site-to-site connections with other Untangle OpenVPN devices and not necessarily the OpenVPN Access Server. I tried to upload an OpenVPN Access Server generated client configuration file into the Untangle client module and it failed. That leaves me wondering if I can use the Untangle as the openvpn client or if I should just disable the Untangle OpenVPN module and place an OpenVPN client somewhere else on LAN-A.
Finally, is it possible to have a site-to-site connection between a pair of OpenAPN Access Servers and if so, what are the considerations that would push me in that direction.
Thanks in advance for helping me sort these questions out or perhaps pointing me in the direction of some guiding principles to help design the setup.
RERobbins
Here's where I landed.
I deployed an OpenVPN Access Server instance in the AWS Virtual Private Cloud. Having a static public address for the server was too good to pass up.
I spent a little bit of time trying to get the Untangle firewall OpenVPN module to function as a client for a non-Untangle OpenVPN server. I was not able to prepare a zip file (as relied up by Untangle) to make it work. So I simply disabled the Untangle OpenVPN module.
I deployed a linux virtual machine on the network with OpenVPN as the client for the LAN-A to LAN-B site to site connection.
I have other individual clients set up in the OpenVPN Access Server and they are able to access all necessary LAN-A and LAN-B hosts.
The big trick was to realize that I needed to add not only a static route on the LAN-B gateway for the LAN-A network but another static route on the LAN-B gateway for the OpenVPN client private network.
wayneone
how were you able to put LAN-A IP addresses in a LAN-B route? did you do this on LAN-B aws servers, or did you use an AWS VPC Routes? Does AWS drop ip addresses in a subnet it doesnt know about (such as LAN-A's subnet?)
