- If there is a better forum for this question, please let me know.
- Apologies if this is tl;dr (1300 words) but the problem seems somewhat complex (at least to me)
How to fix? Alternatively,
- what else do I need to learn/discover before a fix can be applied?
- where else should I go for help?
- is there a better way to do what I need?
This seems pretty complicated (to me, anyway), and I'm hoping to make whatever I discover available for others, so I'm maintaining my code/configs as project=linode_jumpbox_config and documenting @ that project's wiki (which has a glossary which may clarify terms used below).
The details on what I'm trying to do are hopefully summarized by this ASCII art:
Code: Select all
<-MY CONTROL AGENCY CONTROLLED->
firewall
+----------+ +-----------+ +---------------+ | +---------+
| laptop + | | linode + | | remote-access | | | cluster |
| F5NAP + | <--> | OpenVPN + | <--> | website + | <-|-> | node(s) |
| OpenVPN | | security | | F5VPN | | | |
+----------+ +-----------+ +---------------+ | +---------+To accommodate the new policies, I'm trying to tunnel through a linode jumpbox, such that the linode satisfies all the new requirements (notably, static IP#). Most of the linode's pre-OpenVPN networking is configured by this bash script, which (hopefully) automates this manual procedure. (Details on the entire networking+OpenVPN install+configuration starts here, and is mostly automated. The automating scripts unfortunately need more structure and commenting, but should be relatively readable. Questions are welcomed; pull requests even more so.)
My implementation of my design works only for the following sequence (details here), after which it fails:
1. I can start an OpenVPN server on my linode (via SSH from my laptop) apparently successfully.
2. On my laptop, if I browse to (e.g.) http://www.whatismyip.com , I see a "normal" (for my ISP) IP#.
3. I can then start an OpenVPN client on my laptop (in a bash shell/terminal), again apparently successfully.
4. On my laptop, if I browse to http://www.whatismyip.com (using my normal, Debian-packaged browser=Firefox), as expected I now see the IP# of my linode. This is essential, since that IP# is on the agency's whitelist.
5. On my laptop, I can start my F5NAP'ed Firefox, and with that browse to http://www.whatismyip.com/ , and still see my linode's IP#.
6. Using the F5NAP'ed Firefox (on my laptop), I can browse to the agency's remote-access website and login normally.
7. Using (from the F5NAP'ed Firefox on my laptop) the web GUI provided (post-authentication) by the remote-access website, I can start the F5VPN, and see status==Connected in the F5VPN UI. This is what I expect from "the good old days" when I could run the F5VPN directly from my laptop.
At this point, in "the good old days," I could go to any shell/gnome-terminal on my laptop, utter `ssh fqdn.for.a.cluster.login.node.at.epa.gov`, and get to work. But not now :-(
Currently I am broken at this point in the sequence, as detailed here. Specifically, I lose DNS, which
- (immediately) causes SSH to fail, preventing me from running SSH to any cluster login node (which is the whole point of this exercise).
- (eventually) breaks the OpenVPN tunnel, which means the F5VPN no longer sees the registered/whitelisted IP#, causing it to drop my connection.
1. F5 (the agency's VPN vendor) is completely proprietary, and barely supports Linux. My attempts to get support from them have been mostly ignored.
2. The agency barely supports Linux internally, for users. (Of course the scientific-research clusters which we seek to use are all Linux, but they're supported by separate contractors who only support the clusters themselves, not access to the clusters.) The agency barely tolerates Linux for remote access, and especially by non-employees like me. (I'm a student.)
Net: I suspect I can get answers to some direct, specific questions from agency support, but I know (from bitter experience) that I cannot get support if I just say to them (as I am to you now) "this isn't working--what should I do?" I know especially that I cannot get help with anything related to a Linux client: agency client-side support is (AFAICS) strictly limited to Windows XP (no lie!)
How to fix this problem? (FWIW, I will document the fix @ project wiki, and my effusive praise for anyone who provides any assistance will last ... as long as its git repo does :-) Alternatively,
- what else do I need to learn/discover before a fix can be applied?
- where else should I go for help?
- is there a better way to do what I need?
