Setting up a VPN using FOSS (OpenVPN)

[JerryMungo]

.

 

[SauRoNZA]

Why would you need a VPN for security of cloud services when you could just be connecting directly to them with their own security protocols and related management? Specifically for administration I mean.

Obviously anyone else would connect directly to what you are hosting.

Just seems an odd thing to link it to cloud services that need it least as they aren’t on premises which is where you need this most, and already have a multitude of security protocols in place with user management and MFW for authentication etc.

For access to a remote LAN obviously there is no better choice.

****

Note I’ve seen this done numerous times before so I know it’s a common practise, I’m just questioning the why.

 

[SauRoNZA]

Step 5 - Install and configure OpenVPN on your server

Why put it on your server?

Why not run it on its own server, or better yet inside Docker.

If you are already talking about a cloud environment spinning it up in a redundant and scalable docker (or kubernetes) instance makes more sense.

 

[Rocket-Boy]

Ewww OpenVPN on a windows host :/
But yeah OpenVPN is great, I ran it for years in my previous company for a whole lot of sites and it never skipped a beat.

 

[SauRoNZA]

You'll have to be more specific - if you're advocating for exposing SSH, RDP, SQL Server, etc. on the web, then I'd recommend against that. Those are huge targets. If you have other ways of securing your stuff, then by all means, use it. This is one. Do your other methods allow public key infrastructure, do they allow 2 factor authentication? Those are the kind of things you can make available at the pointy end of your box/network in one easy solution with OpenVPN instead of securing every service this way - you can just use regular authentication for those.

That’s what I mean you don’t need to secure every service this way as the likes of AWS (and presumably the others) already supports user management and two stage auth with keys and the whole works.

At worst you need to allow a security group access based on a role which you’d need to do for VPN traffic to get in anyway.

And you don’t need to expose those ports directly as you could have cli-based infrastructure as code systems on place or use the GUI for direct administration if you like.

The reason I ask the question is that it seems like another one of those on premises logics that have seemingly been copy and pasted to the cloud because that’s the way it’s always been done instead of being “cloud native”.

You'll have to explain the difference between 'your server' and 'it's own server' to me. If I'm reading correctly, you're saying "why not create a dedicated server or docker instance for OpenVPN"? If I understood correctly, then by all means, whatever works for you. "Your server" in the context you're quoting is "Your openvpn server", but it could be a multi-purpose box with or without containers, etc. etc. Whataver works for you.
.

Sorry yes I was being a bit daft thinking it’s going on the end point server for whatever instead of a dedicated host.

There are of course hardware solutions for the effort as well.

 

[SauRoNZA]

Not all cloud providers do, some give you little more than a virtual machine (e.g. linode)... and how it's implemented is different from provider to provider. Also, not all your services and apps are available through the AWS portal - you might be wanting to access any number of custom apps on different endpoints which Amazon is not aware of... also, some providers charge for extra security. OpenVPN can also be automated and runs on Windows, Mac and Linux. It may be a fit for you, it may not.
.

I was talking about real cloud providers, not pretend ones running just virtual machines.

AWS is aware of every single little thing and everything has an end point you can point to.

They are the kings of custom so I have no idea what that comment is trying to relate to. Every EC2 instance is essentially custom unless you bought it on the marketplace and those work exactly the same.

Same goes for container instances and of course all their own products that can do all the same things.

You really don’t need a VPN inside AWS and I can only assume the same applies for the other big guys like Azure and Google.

Which is why I said the whole logic of it seems very old school on premises and not cloud native.

Regardless, it’s off topic, so let’s leave it at that.

 

[SauRoNZA]

Look dude, let's end this pointless discussion. Not everyone uses your use cases. This doesn't suit your needs? No worries, don't use it, but quit trolling.

And while you're at it, please let Amazon know they're wasting their time marketing this crap when it's not necessary LMAO

Virtual Private Network - AWS VPN - AWS

AWS VPN establishes encrypted connections for hybrid connectivity networks with AWS Site-to-Site VPN and remote workforce access with AWS Client VPN.

aws.amazon.com

Well you’ve just illustrated why one wouldn’t need OpenVPN on AWS.

But site-2-site VPNs make perfect common sense and it makes perfect sense for Amazon to provide the client service for people who still believe in working that way.

The only reason I actually object to this very scenario is because I’m currently dealing with exactly this setup of OpenVPN inside an AWS configuration and I keep asking the question why and nobody provides decent answers which is why I asked the same questions here.

But let’s leave it at that.

 

[Lord Flacko]

So much hostility.