Setting Up “Internal” Network Between Multiple Servers?

So I have a few servers who handle different things. One is for a forward-facing website, one is an internally used website, as well as a few servers that host DB’s.

I am in the process of writing a micro-service who will be used from both the front-facing and internally-facing website. Any traffic between either server and this micro-service will need to be encrypted, and the micro-service shouldn’t be accessible from the outside world.

Not knowing how this is normally done, it would seem that setting up a VPN would be the correct move on how to secure this sort of cross-server traffic. (If this assumption is wrong and there are better solutions, please let me know.) Setting this sort of thing up would also have the benefit of having the DB’s accessible only to those who have access to the VPN (currently handled by the DB’s authentication strategy).

After researching VPN solutions, OpenVPN seemed to have came out on top. It seems to offer the best security and seems to work on Linux servers without too much hassle.

My question is how are most OpenVPN’s setup when it comes to a group of servers, one main authentication server and the network’s members? Or would you have to have multiple servers and set them up to use the same certificate? Once you authenticate to the VPN, can you make direct connections to other servers that are on the network?

I’m imagining a situation like this:

server1 = VPNServer
server2 = VPNClient - Website
server3 = VPNClient - Service
server4 = VPNClient - DB

Say server2 and server4 need to transmit data, will that connection go directly from server2 > server4, or will the actual traffic look like server2 > server1 > server4? Or is it set up so that once you authenticate to the VPN, all the members of the VPN are then directly accessible?

I have a vague understanding of how VPN’s work, but this understanding obviously breaks down when it comes to having multiple members on the network.

How I’m envisioning setting up the VPN currently (sorry for the low quality):

VPN Setup

Your diagram is almost spot on for some of the more common methods. The server 3 and 4 are in what is referred to as a DMZ or protected private network. Server 2 is redundant but depending on your situation and level of security you have to enforce might have a role. For this explanation, i’ll remove it as it will create complications when trying to administer server #2.

One method you might consider to make this work:

Make server2 a ‘multi-home’ server. It’s primary nic is connected to the public address or public network behind a firewall. Then, a second NIC which is homed to an internal private network. (ie: public nic 205.205.205.3, private nice, 192.168.2.3)
Your vpn device is also multi-homed (typically out of the box they come this way) and can be used to connect the public network into the private network by way of some VPN technology like IPSEC or PPTP (old microsoft vpn technology) from the public network and allow you to control who has access to this private network. This can be completely independent of server2 but would allow you to connect to the second nic of server2 as well. (ie: public nic 205.205.205.2, private nic 192.168.2.2)
Servers 3 and 4 are private nic only like 192.168.2.4 and 192.168.2.5
firewall/router at public before server 2 from the ISP might be 205.205.205.1
Adding your own public internal network like 10.1.1.0/24 behind a firewall allows you a lot of control over how ports are mapped to servers in case you have more public facing machines in the future. Again a large topic but a starting point to consider.

On server #2, most software allows you to control which IP the service responds too or you can configure a firewall on server2 to only allow certain traffic from the public network like port 80 and no filters on the internal nic as an example. I would recommend at least a hardware firewall to sit between server 2 and the public network. This way, even a compromised server still cannot answer to a public port unless the hardware firewall allows it.

Also, for clarity, database and other service calls from server #2 go directly from nic#2 (the private network nic) to the target machines. In a high security environment, this may involve other firewalls between these machines but that gets into a level of protection beyond the scope of this answer. Unless you are working with bank data or hippa data, its’ probably overkill. However, it depends on your client’s data security policies.

I can add more details based on feedback. This can be a huge subject but hopefully this will help you get started.

Filed under: softwareengineering - @ 18:23

Thẻ: architecture, networking

Setting Up “Internal” Network Between Multiple Servers?

So I have a few servers who handle different things. One is for a forward-facing website, one is an internally used website, as well as a few servers that host DB’s.

After researching VPN solutions, OpenVPN seemed to have came out on top. It seems to offer the best security and seems to work on Linux servers without too much hassle.

I’m imagining a situation like this:

server1 = VPNServer
server2 = VPNClient - Website
server3 = VPNClient - Service
server4 = VPNClient - DB

I have a vague understanding of how VPN’s work, but this understanding obviously breaks down when it comes to having multiple members on the network.

How I’m envisioning setting up the VPN currently (sorry for the low quality):

VPN Setup

One method you might consider to make this work:

Make server2 a ‘multi-home’ server. It’s primary nic is connected to the public address or public network behind a firewall. Then, a second NIC which is homed to an internal private network. (ie: public nic 205.205.205.3, private nice, 192.168.2.3)
Your vpn device is also multi-homed (typically out of the box they come this way) and can be used to connect the public network into the private network by way of some VPN technology like IPSEC or PPTP (old microsoft vpn technology) from the public network and allow you to control who has access to this private network. This can be completely independent of server2 but would allow you to connect to the second nic of server2 as well. (ie: public nic 205.205.205.2, private nic 192.168.2.2)
Servers 3 and 4 are private nic only like 192.168.2.4 and 192.168.2.5
firewall/router at public before server 2 from the ISP might be 205.205.205.1
Adding your own public internal network like 10.1.1.0/24 behind a firewall allows you a lot of control over how ports are mapped to servers in case you have more public facing machines in the future. Again a large topic but a starting point to consider.

I can add more details based on feedback. This can be a huge subject but hopefully this will help you get started.

Filed under: softwareengineering - @ 18:23

Thẻ: architecture, networking

Setting Up “Internal” Network Between Multiple Servers?

So I have a few servers who handle different things. One is for a forward-facing website, one is an internally used website, as well as a few servers that host DB’s.

After researching VPN solutions, OpenVPN seemed to have came out on top. It seems to offer the best security and seems to work on Linux servers without too much hassle.

I’m imagining a situation like this:

server1 = VPNServer
server2 = VPNClient - Website
server3 = VPNClient - Service
server4 = VPNClient - DB

I have a vague understanding of how VPN’s work, but this understanding obviously breaks down when it comes to having multiple members on the network.

How I’m envisioning setting up the VPN currently (sorry for the low quality):

VPN Setup

One method you might consider to make this work:

Make server2 a ‘multi-home’ server. It’s primary nic is connected to the public address or public network behind a firewall. Then, a second NIC which is homed to an internal private network. (ie: public nic 205.205.205.3, private nice, 192.168.2.3)
Your vpn device is also multi-homed (typically out of the box they come this way) and can be used to connect the public network into the private network by way of some VPN technology like IPSEC or PPTP (old microsoft vpn technology) from the public network and allow you to control who has access to this private network. This can be completely independent of server2 but would allow you to connect to the second nic of server2 as well. (ie: public nic 205.205.205.2, private nic 192.168.2.2)
Servers 3 and 4 are private nic only like 192.168.2.4 and 192.168.2.5
firewall/router at public before server 2 from the ISP might be 205.205.205.1
Adding your own public internal network like 10.1.1.0/24 behind a firewall allows you a lot of control over how ports are mapped to servers in case you have more public facing machines in the future. Again a large topic but a starting point to consider.

I can add more details based on feedback. This can be a huge subject but hopefully this will help you get started.

Filed under: softwareengineering - @ 18:23

Thẻ: architecture, networking

Setting Up “Internal” Network Between Multiple Servers?

So I have a few servers who handle different things. One is for a forward-facing website, one is an internally used website, as well as a few servers that host DB’s.

After researching VPN solutions, OpenVPN seemed to have came out on top. It seems to offer the best security and seems to work on Linux servers without too much hassle.

I’m imagining a situation like this:

server1 = VPNServer
server2 = VPNClient - Website
server3 = VPNClient - Service
server4 = VPNClient - DB

I have a vague understanding of how VPN’s work, but this understanding obviously breaks down when it comes to having multiple members on the network.

How I’m envisioning setting up the VPN currently (sorry for the low quality):

VPN Setup

One method you might consider to make this work:

Make server2 a ‘multi-home’ server. It’s primary nic is connected to the public address or public network behind a firewall. Then, a second NIC which is homed to an internal private network. (ie: public nic 205.205.205.3, private nice, 192.168.2.3)
Your vpn device is also multi-homed (typically out of the box they come this way) and can be used to connect the public network into the private network by way of some VPN technology like IPSEC or PPTP (old microsoft vpn technology) from the public network and allow you to control who has access to this private network. This can be completely independent of server2 but would allow you to connect to the second nic of server2 as well. (ie: public nic 205.205.205.2, private nic 192.168.2.2)
Servers 3 and 4 are private nic only like 192.168.2.4 and 192.168.2.5
firewall/router at public before server 2 from the ISP might be 205.205.205.1
Adding your own public internal network like 10.1.1.0/24 behind a firewall allows you a lot of control over how ports are mapped to servers in case you have more public facing machines in the future. Again a large topic but a starting point to consider.

I can add more details based on feedback. This can be a huge subject but hopefully this will help you get started.

Filed under: softwareengineering - @ 18:23

Thẻ: architecture, networking

Thiết kế website giá rẻ

Danh mục

Setting Up “Internal” Network Between Multiple Servers?

Setting Up “Internal” Network Between Multiple Servers?

Setting Up “Internal” Network Between Multiple Servers?

Setting Up “Internal” Network Between Multiple Servers?