Replica and different location behind NAT - any concerns?

[Francis Augusto Medeiros-Logeay]

Hi,

I have a few cloud servers and would like to have FreeIPA as an IdM for 
them, reusing what I have on a different location.

My current FreeIPA install sits on a LAN, so all IP's are private. That 
will be a similar design on the cloud. So, for the replicas to 
communicate with each other, I thought about creating some 
port-forwarding rules/openings on both firewalls, but the catch is that 
the replica creation command would point to the public address of the 
destination.

Any problems I might encounter with a setup like this, or is this a 
common practice?

Best,
Francis

[Alexander Bokovoy]

On ke, 13 huhti 2022, Francis Augusto Medeiros-Logeay via FreeIPA-users wrote:
> Hi,
>
> I have a few cloud servers and would like to have FreeIPA as an IdM 
> for them, reusing what I have on a different location.
>
> My current FreeIPA install sits on a LAN, so all IP's are private. 
> That will be a similar design on the cloud. So, for the replicas to 
> communicate with each other, I thought about creating some 
> port-forwarding rules/openings on both firewalls, but the catch is 
> that the replica creation command would point to the public address of 
> the destination.
>
> Any problems I might encounter with a setup like this, or is this a 
> common practice?

Replication is bi-directional. It means all replicas should be able to
initiate and accept connections with other replicas they have direct
topological connection.

I'd recommend you to look into making a mesh networking between
replicas. This can be done on demand with IPSEC (LibreSWAN in RHEL, for
example) or Wireguard or OpenVPN and any other solution. LibreSWAN can
definitely benefit from certificates issued by IPA CA.

See
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/htm...
for some details.

[Francis Augusto Medeiros-Logeay]

__
Francis Augusto Medeiros-Logeay
[e-mail]
Mobile: [phone]
Oslo, Norway
Sent from a mobile device / Enviado a partir de dispositivo móvel
> On 13 Apr 2022, at 10:33, Alexander Bokovoy  wrote:
>
> 
>
> Replication is bi-directional. It means all replicas should be able to
> initiate and accept connections with other replicas they have direct
> topological connection.
>
> I'd recommend you to look into making a mesh networking between
> replicas. This can be done on demand with IPSEC (LibreSWAN in RHEL, for
> example) or Wireguard or OpenVPN and any other solution. LibreSWAN can
> definitely benefit from certificates issued by IPA CA.

Thanks Alexander.

My idea was to have port forwarding on both ends, actually. I just wonder if starting the replication with public ip’s would work - they will of course reach each other, but the ip addresses used on the replication wouldn’t be those of the servers, as they would be behind a NAT.

I will consider WireGuard as well, since I already have it deployed on the cloud site.

Best,

Francis
>