From Fedora Project Wiki

Revision as of 14:13, 24 May 2008 by ImportUser (talk) (Imported from MoinMoin)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)


Contact Information

Owner: Fedora Infrastructure Team

Contact: #fedora-admin, sysadmin-main

Location: Phoenix

Servers: bastion (

Purpose: Provides vpn solution for our infrastructure.


OpenVPN is our server->server VPN solution. It is deployed in a routeless manner and uses puppet managed keys for authentication. All hosts should be given static IP's and a DNS address.

Add a new host

Create the keys

From puppet1 check out the private repo:

cvs -d /cvs/private co private
cd private/vpn/openvpn/

Next prepare your environment and run the build-key script. This example is for host ""

. ./vars
./build-key $FQDN
cvs add keys/$FQDN.*
cvs commit
cd ../../..
sudo make install

Create Static IP

Giving static IP's out in openvpn is mostly painless. Take a look at other examples but each host gets a file and 2 IP's.

cvs -d /cvs co configs
cd configs
vi system/ccd/$FQDN

The file format should look like this:


Basically the first IP is the IP that is contactable over the vpn and should always take the format "192.168.1.x" and the PtPIP is the same ip on a different network: "192.168.0.x"

Commit and install:

cvs add system/ccd/$FQDN
cvs commit -m "What have you done?"
make install

Create DNS entry

After you have your static IP ready, just add the entry to DNS:

From your "configs/" checkout, run:

vi dns/master/
cvs commit -m "What have you done?"
make install
make push HOSTS=bastion

Wait for bastion to get updated, then restart /sbin/service openvpn on the new machine.


Deploy an additional VPN server outside of PHX. OpenVPN does support failover automatically so if configured properly, when the primary VPN server goes down all hosts should connect to the next host in the list.