OpenVPN Infrastructure SOP

From FedoraProject

(Difference between revisions)
Jump to: navigation, search
(Update for new openvpn module)
(Fix typo.)
Line 23: Line 23:
 
git clone /git/private
 
git clone /git/private
 
chmod 700 private
 
chmod 700 private
cd private/t
+
cd private/
 
</pre>
 
</pre>
  

Revision as of 21:36, 8 July 2009

Infrastructure InfrastructureTeamN1.png
Shortcut:
ISOP:OPENVPN

OpenVPN is our server->server VPN solution. It is deployed in a routeless manner and uses puppet managed keys for authentication. All hosts should be given static IP's and a hostname.vpn.fedoraproject.org DNS address.

Contents

Contact Information

Owner: Fedora Infrastructure Team

Contact: #fedora-admin, sysadmin-main

Location: Phoenix

Servers: bastion (vpn.fedoraproject.org)

Purpose: Provides vpn solution for our infrastructure.

Add a new host

Create the keys

From puppet1 check out the private repo:

git clone /git/private
chmod 700 private
cd private/

Next prepare your environment and run the build-key script. This example is for host "proxy4.fedora.phx.redhat.com"

. ./vars
./build-key $FQDN
git add .
git commit -a
git push

Create Static IP

Giving static IP's out in openvpn is mostly painless. Take a look at other examples but each host gets a file and 2 IP's.

git clone /git/puppet
vi puppet/modules/openvpn/files/ccd/$FQDN

The file format should look like this:

ifconfig-push 192.168.1.314 192.168.0.314

Basically the first IP is the IP that is contactable over the vpn and should always take the format "192.168.1.x" and the PtPIP is the same ip on a different network: "192.168.0.x"

Commit and install:

git add .
git commit -m "What have you done?"
git push

Create DNS entry

After you have your static IP ready, just add the entry to DNS:

From your puppet checkout, run:

vi modules/bind/files/master/vpn.fedoraproject.org
git commit -m "What have you done?"
git push

Wait for bastion and ns1/2 to get updated, then restart /sbin/service openvpn on the new machine.

TODO

Deploy an additional VPN server outside of PHX. OpenVPN does support failover automatically so if configured properly, when the primary VPN server goes down all hosts should connect to the next host in the list.