Re: [gentoo-user] Re: Recommended VPN Tunnel client?

[Mick <michaelkintzios@gmail.com>]

[-- Attachment #1: Type: Text/Plain, Size: 2442 bytes --]

On Friday 10 Feb 2012 04:42:51 Pandu Poluan wrote:
> On Fri, Feb 10, 2012 at 10:48, Pandu Poluan <pandu@poluan.info> wrote:
> > Scenario: I have a server in the cloud that needs to connect to an
> > internal server in the office. There are 2 incoming connections into my
> > office, ISP "A" and ISP "B". The primary connection is A, but if A goes
> > down, we can use B. The app running on the cloud server has no automatic
> > failover ability (i.e., if A goes down, someone must change the app's
> > conf to point to B).
> > 
> > My thought: If I can make a tunnel from the server to the FortiGate
> > firewall currently guarding the HQ, the cloud app can simply be
> > configured to connect to the internal IP address of the internal server.
> > No need to manually change the app's conf.
> > 
> > The need: a VPN client that:
> > + can selectively send packets fulfilling a criteria (in this case, dest=
> > IP address of internal server)*

As far as I know typical VPNs require the IP address (or FQDN) of the VPN 
gateway.  If yours changes because ISP A goes down then the tunnel will fail 
and be torn down.


> > + has automatic failover and failback ability

Right, I don't know if one exists with this functionality - because this is 
not a typical VPN function but one offered by load balancers/fall back servers 
or routers.


> > *solutions involving iptables and iproute2 are also acceptable

I am convinced that you can do that by clever enough routing on a linux box, 
but cannot recall where I last read about it.


> > Can anyone point me to the right direction re: what package and the
> > relevant howto?
> > 
> > Thanks in advance.
> 
> I have been doing some research, and...
> 
> Do you think I can do that using HAProxy running in tcp mode?
> 
> My thought goes like this: Have the cloud app connect the IP:port of
> HAProxy, and let HAProxy perform a TCP proxy (NAT?) to connect to the
> internal server via A or B according to the "server checks".

I haven't used HAProxy, but would consider setting up a fallback route at the 
HQ router end.  This is also called a failover configuration.  The router 
pings one address, say ISP A and if that fails more than x times over y pings 
then it switches over the connection to ISP B.

This keeps it at a lower level in the OSI model, which is less complicated and 
therefore easier to manage.
-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]