To solve that problem, a virtual private network (VPN) is used to allow authorized remote access to an organization’s private network. Working in a fully remote company like Mattermost creates the need for employees to use a VPN connection in order to be able to access internal private infrastructure and resources. A vast majority of companies use OpenVPN as a solution to host those VPN connections on their own servers. OpenVPN is a widely used software and protocol which was also our selection to be used as a quick and reliable solution to access our internal infrastructure. After using it a while, we needed a better solution in terms of:.Supporting better access control (e.g., only SREs can access production servers and only developers can access development accounts). ![]() It hides the complete configuration (user and server management) overhead behind the scenes of the web interface.Its pricing is reasonable for our scale.The Pritunl client can be installed on any platform.Working with SSO, particularly OneLoginĪfter some investigation, we ended up with Pritunl because. To deploy Pritunl in our infrastructure, we used Terraform. The module we wrote can be found here as an example for how to deploy Pritunl. The selection of two ASGs with one instance has been done due to the necessity of having the same Elastic Network Interface (ENI), which results on having the same private and public IPs. This is useful when whitelisting those IPs into the Security Groups that Pritunl-VPN needs to access internally, such as our internal GitLab instance. This can be achieved by attaching those ENIs as a secondary network interfaces on the instance, as outlined in the appendix below. You can manually create two ENIs (we selected the sixth address of each subnet 10.0.0.6 and 10.0.16.6) and attach public IPs to them. Then you can provide the list of the ENI IDs with the variable (list) fixed_eni on Terraform. Initially, we checked the AWS DocumentDB solution. But it was quite expensive, as it starts at $0.28/hr for one db.r5.large instance. Next, we deployed two instances and installed and configured a MongoDB cluster, but maintaining and making sure that HA worked effectively was a big overhead. Thus, we selected to use MongoDB Atlas as it is cheaper (starts from the free tier) and easier to set up. Also check Pritunl documentation for MongoDB Atlas.Īfter the creation of the MongoDB Atlas, we added Pritunl’s public IPs on the whitelist of the Atlas cluster and we connected to the Atlas cluster locally to create a new database in it called pritunl ( guide on how to connect). To set up the MongoDB URI ( mongodb+srv://pritunl: /pritunl) use the variable (string) mongodb_uri on Terraform. The Network Load Balancer (NLB), which is in front of the instances, has five listeners as shown below. There are three listeners for VPN (on ports 1194, 1195, 1196) that can be used for the servers inside the Pritunl. Currently, we are using only port 1194, so the rest are for future usage.
0 Comments
Leave a Reply. |