m (1 revision(s)) |
m (Add Category) |
||
| Line 81: | Line 81: | ||
Deploy an additional VPN server outside of PHX. OpenVPN does support failover automatically so if configured properly, when the primary VPN server goes down all hosts should connect to the next host in the list. | Deploy an additional VPN server outside of PHX. OpenVPN does support failover automatically so if configured properly, when the primary VPN server goes down all hosts should connect to the next host in the list. | ||
[[Category:Infrastructure SOPs]] | |||
Revision as of 04:55, 14 February 2009
OpenVPN - SOP
Contact Information
Owner: Fedora Infrastructure Team
Contact: #fedora-admin, sysadmin-main
Location: Phoenix
Servers: bastion (vpn.fedoraproject.org)
Purpose: Provides vpn solution for our infrastructure.
Description
OpenVPN is our server->server VPN solution. It is deployed in a routeless manner and uses puppet managed keys for authentication. All hosts should be given static IP's and a hostname.vpn.fedoraproject.org DNS address.
Add a new host
Create the keys
From puppet1 check out the private repo:
cvs -d /cvs/private co private cd private/vpn/openvpn/
Next prepare your environment and run the build-key script. This example is for host "proxy4.fedora.phx.redhat.com"
. ./vars ./build-key $FQDN cvs add keys/$FQDN.* cvs commit cd ../../.. sudo make install
Create Static IP
Giving static IP's out in openvpn is mostly painless. Take a look at other examples but each host gets a file and 2 IP's.
cvs -d /cvs co configs cd configs vi system/ccd/$FQDN
The file format should look like this:
ifconfig-push 192.168.1.314 192.168.0.314
Basically the first IP is the IP that is contactable over the vpn and should always take the format "192.168.1.x" and the PtPIP is the same ip on a different network: "192.168.0.x"
Commit and install:
cvs add system/ccd/$FQDN cvs commit -m "What have you done?" make install
Create DNS entry
After you have your static IP ready, just add the entry to DNS:
From your "configs/" checkout, run:
vi dns/master/vpn.fedoraproject.org cvs commit -m "What have you done?" make install make push HOSTS=bastion
Wait for bastion to get updated, then restart /sbin/service openvpn on the new machine.
TODO
Deploy an additional VPN server outside of PHX. OpenVPN does support failover automatically so if configured properly, when the primary VPN server goes down all hosts should connect to the next host in the list.