You’ll need to add the DNS resolution as we have set it up above on the DNS Server:.Select Add Route (ensure that the server points to devs_server).Select Attach host to attach the two hosts (instances).Select Attach Organization to attach devs_org with devs_server.Remove the 0.0.0.0/0 route from the devs_server.The second IP of each subnet is used for DNS resolution and our VPC where Pritunl is running has peering with all the other VPCs, so it is able to resolve all the names inside our network. Port: 1194 (or any other port that you have setup for VPN access, check NLB).Navigate to Servers and create a new server:.Navigate to Users and create a new organization, e.g., devs_org.Create a user pritunl and add a new password.Navigate to the Pritunl log in page and use the credentials from the previous step.Run sudo pritunl default-password to get the default username and password.SSH into one of the Pritunl instances by using Session Manager. ![]() ![]() As the instances do not store any configuration items except the MongoDB URI, each instance needs to connect to the MongoDB to obtain the required configuration and then the instance joins the Pritunl cluster. Currently, we are using only port 1194, so the rest are for future usage. There are three listeners for VPN (on ports 1194, 1195, 1196) that can be used for the servers inside the Pritunl. The Network Load Balancer (NLB), which is in front of the instances, has five listeners as shown below. To set up the MongoDB URI ( mongodb+srv://pritunl: /pritunl) use the variable (string) mongodb_uri on Terraform. Also check Pritunl documentation for MongoDB Atlas. After the creation of the MongoDB Atlas, we added Pritunl’s public IPs on the whitelist of the Atlas cluster and we connected to the Atlas cluster locally to create a new database in it called pritunl ( guide on how to connect). Thus, we selected to use MongoDB Atlas as it is cheaper (starts from the free tier) and easier to set up. Next, we deployed two instances and installed and configured a MongoDB cluster, but maintaining and making sure that HA worked effectively was a big overhead. But it was quite expensive, as it starts at $0.28/hr for one db.r5.large instance. Initially, we checked the AWS DocumentDB solution. Then you can provide the list of the ENI IDs with the variable (list) fixed_eni on Terraform. You can manually create two ENIs (we selected the sixth address of each subnet 10.0.0.6 and 10.0.16.6) and attach public IPs to them. This can be achieved by attaching those ENIs as a secondary network interfaces on the instance, as outlined in the appendix below. This is useful when whitelisting those IPs into the Security Groups that Pritunl-VPN needs to access internally, such as our internal GitLab instance. The selection of two ASGs with one instance has been done due to the necessity of having the same Elastic Network Interface (ENI), which results on having the same private and public IPs. The module we wrote can be found here as an example for how to deploy Pritunl. To deploy Pritunl in our infrastructure, we used Terraform. It hides the complete configuration (user and server management) overhead behind the scenes of the web interface. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |