1

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world.

I want to have several private boxes (web servers, db servers, puppet/master boxes etc.) along with a public facing load balancer box that will forward requests to the private web boxes. I am trying to figure out how to set this all up without too many security holes.

I am thinking of setting up a VPN (I am thinking of using Tinc since it looks straight forward) and putting all of my boxes on it.

My private boxes will only accept requests over the VPN network, my load balancer box will additionally accept public requests over port 80 and port 443 and will forward requests over the VPN network to the private web boxes.

Does this sound like a good setup? What's the best way to restrict access in this fashion, via iptables?

If this doesn't sound like a good setup then what would be a better way to about this?

Improve this question

1 Answer 1

Reset to default
2

I had a similar setup for my production servers. The HTTP server load balancing was done by HAPROXY. I can recommend NGINX especially for the front facing server that will also handle SSL. Also I am not sure, what policy you are taking to transfer files to the host machines or getting terminal access. You probably need to think about opening up an SSH port via virtual tunnel through the gateway server that has the public facing interface. For transferring files you can use SFTP or rsync.

Improve this answer
2
  • I was thinking of using Varnish, but I have heard that NGINX makes a good load balancer as well, I'll look into that. I will most likely have a jumpbox/gateway box that I will be able to SSH into in order to get into the network, I'll have to make this box very secure indeed of course.
    – jiminy
    Sep 29, 2014 at 8:41
  • Could one whitelist their control boxes' IP over the VPN port and 943 for its web console, visit the console and download a profile, and use that with OpenVPN Connect/Tunnelblick/etc? I think the 943 port could be safely disabled after the profile is retrieved. The SSH tunnel will basically be the same thing, but wanted to add that alternative if it's valid. :)
    – Jasmine Hegman
    Jul 2, 2016 at 9:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.