| 1 |
On Friday 10 Feb 2012 04:42:51 Pandu Poluan wrote: |
| 2 |
> On Fri, Feb 10, 2012 at 10:48, Pandu Poluan <pandu@××××××.info> wrote: |
| 3 |
> > Scenario: I have a server in the cloud that needs to connect to an |
| 4 |
> > internal server in the office. There are 2 incoming connections into my |
| 5 |
> > office, ISP "A" and ISP "B". The primary connection is A, but if A goes |
| 6 |
> > down, we can use B. The app running on the cloud server has no automatic |
| 7 |
> > failover ability (i.e., if A goes down, someone must change the app's |
| 8 |
> > conf to point to B). |
| 9 |
> > |
| 10 |
> > My thought: If I can make a tunnel from the server to the FortiGate |
| 11 |
> > firewall currently guarding the HQ, the cloud app can simply be |
| 12 |
> > configured to connect to the internal IP address of the internal server. |
| 13 |
> > No need to manually change the app's conf. |
| 14 |
> > |
| 15 |
> > The need: a VPN client that: |
| 16 |
> > + can selectively send packets fulfilling a criteria (in this case, dest= |
| 17 |
> > IP address of internal server)* |
| 18 |
|
| 19 |
As far as I know typical VPNs require the IP address (or FQDN) of the VPN |
| 20 |
gateway. If yours changes because ISP A goes down then the tunnel will fail |
| 21 |
and be torn down. |
| 22 |
|
| 23 |
|
| 24 |
> > + has automatic failover and failback ability |
| 25 |
|
| 26 |
Right, I don't know if one exists with this functionality - because this is |
| 27 |
not a typical VPN function but one offered by load balancers/fall back servers |
| 28 |
or routers. |
| 29 |
|
| 30 |
|
| 31 |
> > *solutions involving iptables and iproute2 are also acceptable |
| 32 |
|
| 33 |
I am convinced that you can do that by clever enough routing on a linux box, |
| 34 |
but cannot recall where I last read about it. |
| 35 |
|
| 36 |
|
| 37 |
> > Can anyone point me to the right direction re: what package and the |
| 38 |
> > relevant howto? |
| 39 |
> > |
| 40 |
> > Thanks in advance. |
| 41 |
> |
| 42 |
> I have been doing some research, and... |
| 43 |
> |
| 44 |
> Do you think I can do that using HAProxy running in tcp mode? |
| 45 |
> |
| 46 |
> My thought goes like this: Have the cloud app connect the IP:port of |
| 47 |
> HAProxy, and let HAProxy perform a TCP proxy (NAT?) to connect to the |
| 48 |
> internal server via A or B according to the "server checks". |
| 49 |
|
| 50 |
I haven't used HAProxy, but would consider setting up a fallback route at the |
| 51 |
HQ router end. This is also called a failover configuration. The router |
| 52 |
pings one address, say ISP A and if that fails more than x times over y pings |
| 53 |
then it switches over the connection to ISP B. |
| 54 |
|
| 55 |
This keeps it at a lower level in the OSI model, which is less complicated and |
| 56 |
therefore easier to manage. |
| 57 |
-- |
| 58 |
Regards, |
| 59 |
Mick |
Archives