I have a HTTP/HAProxy server. It also is the OpenVPN server for my network (all my servers are connected to it). I expect my website to grow dramatically soon, so I am worried if this single point of failure for my VPN is a problem.

Should I move the VPN off to another server? If I do that, how do I configure the OpenVPN server to redirect traffic to the HTTP/HAProxy servers? Is it possible to configure my HTTP/HAProxy servers to redirect traffic to a pool of VPN servers inside my network?

I tried Googling this topic, but could not come to a conclusion.

  • Why are your servers connected to a VPN? What are they connecting to that's not on the same local network as them? – Xiong Chiamiov Apr 8 '16 at 22:49
  • My VPS only gave me public IP addresses, but I would like local IP addresses and the privacy aspect between servers connected via VPN. – rg3 Apr 8 '16 at 23:47

You could continue down this path, but I'm going to suggest taking a step back and trying a rather different approach.

You have a bunch of servers. You want them to be able to talk to each other, but you want to make sure that those connections are secure, and (I think) also block external connections to all servers other than a bastion host or two. Rather than operating all these servers on a public network, and connect them with a VPN, I think you'd be much better off utilizing a private network. In particular, I'd recommend moving to Amazon VPC.

You can create a VPC and put all of your servers in it. Server-to-server connections all go over the local network, and use a security group to poke a hole for ports 80 and 443 to your load balancer. For your own access, you can either set up a tunnel into your local network, or run a VPN server that you connect to. And yes, I'd recommend having this be on its own server - with virtualized servers, there's really no reason to combine multiple things onto one machine, and it helps reduce the number of things you have to think about on each one, from a security and dependency perspective.

This will be a much cleaner, performant, and well-supported setup than what you're creating now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.