Securing a VPS network with a VPN and a DMZ

Question

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world.

I want to have several private boxes (web servers, db servers, puppet/master boxes etc.) along with a public facing load balancer box that will forward requests to the private web boxes. I am trying to figure out how to set this all up without too many security holes.

I am thinking of setting up a VPN (I am thinking of using Tinc since it looks straight forward) and putting all of my boxes on it.

My private boxes will only accept requests over the VPN network, my load balancer box will additionally accept public requests over port 80 and port 443 and will forward requests over the VPN network to the private web boxes.

Does this sound like a good setup? What's the best way to restrict access in this fashion, via iptables?

If this doesn't sound like a good setup then what would be a better way to about this?

Answer 1

I had a similar setup for my production servers. The HTTP server load balancing was done by HAPROXY. I can recommend NGINX especially for the front facing server that will also handle SSL. Also I am not sure, what policy you are taking to transfer files to the host machines or getting terminal access. You probably need to think about opening up an SSH port via virtual tunnel through the gateway server that has the public facing interface. For transferring files you can use SFTP or rsync.