OpenVPN - IPTables DNAT to-port <port-range> load bala

saffy · n00b Joined: 31 Jan 2004 Posts: 14 Location: London, UK

I have an interesting scenario on which I need some help...

I have built an OpenVPN server which is to be placed in the DMZ of our corporate firewall, the person in charge of the firewall will only allow udp traffic on a single port number to reach my VPN server, unfortunately OpenVPN will only allow one connection per port and I need four people to use this VPN server.

I can run four OpenVPN deamons on four different udp ports, however I need a method of accepting connections on the port number allowed through the firewall and then somehow load-balancing this connection over the four OpenVPN daemons. As each daemon will only accept one connection, I need to make sure new connections are sent to a daemon which does not have an already established connection.

I read some info on the IPTables DNAT to-port option but from what I read this will not load balance properly in this situation. Does anyone out there have any experience with a similar situation??
_________________
===============================>
saffy

meyerm · Posted: Sat Jan 31, 2004 6:50 pm Post subject:

Are you're clients coming from different IPs (from the view of the server)?

saffy · n00b Joined: 31 Jan 2004 Posts: 14 Location: London, UK

Yes, the clients will be connecting from their homes, therefore should all have different source IP addresses. These addresses are not always static.
_________________
===============================>
saffy

meyerm · Posted: Sat Jan 31, 2004 10:04 pm Post subject:

Your clients are 100.100.100.1 to 100.100.100.4, your server 200.200.200.1. Then do something like this on the server side:

Derringer · n00b Joined: 06 Jan 2004 Posts: 53 Location: Detroit, MI

saffy · n00b Joined: 31 Jan 2004 Posts: 14 Location: London, UK

Thanks for your help guys...

I really don't want to use a rule based on source address if I can help it, as this takes flexibility away from home users and also means I need to be mindful of changes on the user side. Two of the users also use the same ISP which makes things a bit more difficult.

The users will be using PKI authentication for their VPN connections therefore I am less concerned on limiting who can establish connection to the port (as I understand it, openvpn will not reply to a connection attempt unless a valid certificate is presented)

I was hoping that the DNAT to-port <port-range> option would load-balance new connections in a round-robin fashion which would give me what I need, but I've read two posts on the internet where people found that using this option resulted in the first listening port being used which was always the first-port regardless of whether it already had a connection.

Looks like I might have to beat-up the firewall admin......

Thanks
_________________
===============================>
saffy

meyerm · Posted: Mon Feb 02, 2004 10:14 am Post subject:

Hmm, just a question (I don't have the time to test any further - my train is parting - will have another look later):

Are you sure openvpn only accept one connection?

saffy · n00b Joined: 31 Jan 2004 Posts: 14 Location: London, UK

Interesting.... the OpenVPN website mentions in several places that you need to run multiple daemons to support multiple connections.... but I will be testing this sometime in the next few days.

I'll post info on my test results....
_________________
===============================>
saffy

saffy · n00b Joined: 31 Jan 2004 Posts: 14 Location: London, UK

I have now tested the VPN server and it works very well with a single connection at a time. When a second connection comes in it successfully authenticates but the first connection is rendered inactive.

I have done some more reading on the internet and there are two things I would like to try:-

1) run 5 OpenVPN instances listening on different udp port numbers and use the nth match IPTables module to load balance incoming udp connections over the 5 instances. i.e.

The only problem is how do you match the initial udp packet? would !related,established work?? also if I can match and DNAT the initial udp packet would the remaining packets automatically pick up the appropriate DNAT setting

OR

2) create 5 alias IP addresses on the external interface and use DNAT to <ip-range> which as I understand performs round-robin load balancing.

Any ideas and comments on these would be much appreciated.
_________________
===============================>
saffy

fleed · l33t Joined: 28 Aug 2002 Posts: 756 Location: London

I think using the 5 alias IP addresses with a DNS round robin is the best solution, at least it's the cleanest so it's less likely to give you trouble. I wonder how big companies handle this sort of stuff when they have loads of roadwarriors connecting to a central vpn server...

meyerm · Posted: Fri Feb 06, 2004 12:07 pm Post subject:

I don't think they use OpenVPN... :-)

For these fields that Cisco crap or the FreeSwan patches are suitable. But OpenVPN has other advantages (tunneling through a proxy is simply awesome! :-)

).

saffy · n00b Joined: 31 Jan 2004 Posts: 14 Location: London, UK

I've got it working!

Using the following IPTables command, I was able to run 10 openvpn daemons on ports 5001 to 5011, run the command ten times each time increasing the --packet and --to-ports number by one.

I now have an OpenVPN server able to accept 10 simultaneous connections.

tdb · Posted: Sat Feb 14, 2004 1:30 am Post subject:

Yeah, that's from the openvpn users list. I was just gonna post that.
_________________
Do you know what a usufruct is?

Derringer · n00b Joined: 06 Jan 2004 Posts: 53 Location: Detroit, MI

That is a cool IPTABLES line. Bookmarking this for later use. Grats on getting it working =)