I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world.
I want to have several private boxes (web servers, db servers, puppet/master boxes etc.) along with a public facing load balancer box that will forward requests to the private web boxes. I am trying to figure out how to set this all up without too many security holes.
I am thinking of setting up a VPN (I am thinking of using Tinc since it looks straight forward) and putting all of my boxes on it.
My private boxes will only accept requests over the VPN network, my load balancer box will additionally accept public requests over port 80 and port 443 and will forward requests over the VPN network to the private web boxes.
Does this sound like a good setup? What's the best way to restrict access in this fashion, via iptables?
If this doesn't sound like a good setup then what would be a better way to about this?