OpenVPN Infrastructure SOP

From FedoraProject

(Difference between revisions)
Jump to: navigation, search
m (Add Category)
(redirect page to new infra-docs)
(10 intermediate revisions by 4 users not shown)
Line 1: Line 1:
= OpenVPN - SOP =
+
{{header|infra}}
 +
{{shortcut|ISOP:OPENVPN}}
  
== Contact Information ==
 
Owner: Fedora Infrastructure Team
 
  
Contact: #fedora-admin, sysadmin-main
+
This SOP has moved to the fedora Infrastructure SOP git repo. Please see the current document at: http://infrastructure.fedoraproject.org/infra/docs/openvpn.txt
  
Location: Phoenix
+
For changes, questions or comments, please contact anyone in the Fedora Infrastructure team.
  
Servers: bastion (vpn.fedoraproject.org)
 
 
Purpose: Provides vpn solution for our infrastructure.
 
 
== Description ==
 
 
OpenVPN is our server->server VPN solution.  It is deployed in a routeless manner and uses puppet managed keys for authentication.  All hosts should be given static IP's and a hostname.vpn.fedoraproject.org DNS address.
 
 
== Add a new host ==
 
 
=== Create the keys ===
 
From puppet1 check out the private repo:
 
 
<pre>
 
cvs -d /cvs/private co private
 
cd private/vpn/openvpn/
 
</pre>
 
 
Next prepare your environment and run the build-key script.  This example is for host "proxy4.fedora.phx.redhat.com"
 
 
<pre>
 
. ./vars
 
./build-key $FQDN
 
cvs add keys/$FQDN.*
 
cvs commit
 
cd ../../..
 
sudo make install
 
</pre>
 
 
=== Create Static IP ===
 
 
Giving static IP's out in openvpn is mostly painless.  Take a look at other examples but each host gets a file and 2 IP's.
 
 
<pre>
 
cvs -d /cvs co configs
 
cd configs
 
vi system/ccd/$FQDN
 
</pre>
 
 
The file format should look like this:
 
 
<pre>
 
ifconfig-push 192.168.1.314 192.168.0.314
 
</pre>
 
 
Basically the first IP is the IP that is contactable over the vpn and should always take the format "192.168.1.x" and the PtPIP is the same ip on a different network: "192.168.0.x"
 
 
Commit and install:
 
 
<pre>
 
cvs add system/ccd/$FQDN
 
cvs commit -m "What have you done?"
 
make install
 
</pre>
 
 
=== Create DNS entry ===
 
After you have your static IP ready, just add the entry to DNS:
 
 
From your "configs/" checkout, run:
 
 
<pre>
 
vi dns/master/vpn.fedoraproject.org
 
cvs commit -m "What have you done?"
 
make install
 
make push HOSTS=bastion
 
</pre>
 
 
Wait for bastion to get updated, then restart /sbin/service openvpn on the new machine.
 
 
 
== TODO ==
 
 
Deploy an additional VPN server outside of PHX.  OpenVPN does support failover automatically so if configured properly, when the primary VPN server goes down all hosts should connect to the next host in the list.
 
  
 
[[Category:Infrastructure SOPs]]
 
[[Category:Infrastructure SOPs]]

Revision as of 18:38, 19 December 2011

Infrastructure InfrastructureTeamN1.png
Shortcut:
ISOP:OPENVPN


This SOP has moved to the fedora Infrastructure SOP git repo. Please see the current document at: http://infrastructure.fedoraproject.org/infra/docs/openvpn.txt

For changes, questions or comments, please contact anyone in the Fedora Infrastructure team.