|
|
| Line 2: |
Line 2: |
| {{shortcut|ISOP:OPENVPN}} | | {{shortcut|ISOP:OPENVPN}} |
|
| |
|
| OpenVPN is our server->server VPN solution. It is deployed in a routeless manner and uses puppet managed keys for authentication. All hosts should be given static IP's and a hostname.vpn.fedoraproject.org DNS address.
| |
|
| |
|
| == Contact Information ==
| | This SOP has moved to the fedora Infrastructure SOP git repo. Please see the current document at: http://infrastructure.fedoraproject.org/infra/docs/openvpn.txt |
| Owner: Fedora Infrastructure Team
| |
|
| |
|
| Contact: #fedora-admin, sysadmin-main
| | For changes, questions or comments, please contact anyone in the Fedora Infrastructure team. |
|
| |
|
| Location: Phoenix
| |
|
| |
| Servers: bastion (vpn.fedoraproject.org)
| |
|
| |
| Purpose: Provides vpn solution for our infrastructure.
| |
|
| |
| == Add a new host ==
| |
|
| |
| === Create/sign the keys ===
| |
| From puppet01 check out the private repo:
| |
|
| |
| <pre>
| |
| # This is to ensure that the clone is not world-readable at any point.
| |
| RESTORE_UMASK=$(umask -p)
| |
| umask 0077
| |
| git clone /git/private
| |
| $RESTORE_UMASK
| |
| cd private/vpn/openvpn
| |
| </pre>
| |
|
| |
| Next prepare your environment and run the build-key script. This example is for host "proxy4.fedora.phx.redhat.com"
| |
|
| |
| <pre>
| |
| . ./vars
| |
| ./build-key $FQDN # ./revoke-full $FQDN to revoke keys that are no longer used.
| |
| git add .
| |
| git commit -a
| |
| git push
| |
| </pre>
| |
|
| |
| === Create Static IP ===
| |
|
| |
| Giving static IP's out in openvpn is mostly painless. Take a look at other examples but each host gets a file and 2 IP's. Also make sure to restart puppet on bastion *before* pushing changes out to hour new node.
| |
|
| |
| <pre>
| |
| git clone /git/puppet
| |
| vi puppet/modules/openvpn/files/ccd/$FQDN
| |
| </pre>
| |
|
| |
| The file format should look like this:
| |
|
| |
| <pre>
| |
| ifconfig-push 192.168.1.314 192.168.0.314
| |
| </pre>
| |
|
| |
| Basically the first IP is the IP that is contactable over the vpn and should always take the format "192.168.1.x" and the PtPIP is the same ip on a different network: "192.168.0.x"
| |
|
| |
| Commit and install:
| |
|
| |
| <pre>
| |
| git add .
| |
| git commit -m "What have you done?"
| |
| git push
| |
| </pre>
| |
|
| |
| === Create DNS entry ===
| |
| After you have your static IP ready, just add the entry to DNS:
| |
|
| |
| From your puppet checkout, run:
| |
|
| |
| <pre>
| |
| vi modules/bind/files/master/vpn.fedoraproject.org
| |
| git commit -m "What have you done?"
| |
| git push
| |
| </pre>
| |
|
| |
| Wait for bastion and ns01/02 to get updated, then restart /sbin/service openvpn on the new machine.
| |
|
| |
| === Update resolv.conf on the client ===
| |
| To make sure traffic actually goes over the VPN, make sure the search line in /etc/resolv.conf looks like:
| |
| <pre>
| |
| search vpn.fedoraproject.org fedoraproject.org
| |
| </pre>
| |
| for external hosts and
| |
| <pre>
| |
| search phx2.fedoraproject.org vpn.fedoraproject.org fedoraproject.org
| |
| </pre>
| |
| for PHX2 hosts.
| |
|
| |
| == TODO ==
| |
|
| |
| Deploy an additional VPN server outside of PHX. OpenVPN does support failover automatically so if configured properly, when the primary VPN server goes down all hosts should connect to the next host in the list.
| |
|
| |
|
| [[Category:Infrastructure SOPs]] | | [[Category:Infrastructure SOPs]] |
