I’m sick of dealing with dynamic IP issues. My broadband connection at home has a dynamic IP address. I can always find out what my home IP address is. I’m using dns/noip to manage a hostname which points to home. I can always ssh home via the hostname.
The problems arise when I try to restrict access to services provided at home or access to services on external servers. For example, the web server upon which this blog is hosted allows incoming ssh only from a few select IP addresses, one of which is my home address. The webpages for The FreeBSD Diary and FreshPorts are stored in a cvs repository at home. The web servers access cvs through a secure channel provided by stunnel.
I have a nagios installation at home which monitors several servers on the Internet. These servers restrict incoming connections based upon IP address.
All the above services are affected when the IP address at home changes. In short, when the IP address changes, I need to update the following items on each server:
- /etc/pf.conf – update the IP address of my home gateway
- /etc/hosts – update the IP address
- /usr/local/etc/nrpe.conf – allow hosts to connect from the outside
- restart stunnel – ensure the stunnel over which cvs updates is restarted
Looking at this now, I see I could do away with the nrpe.conf change if I restrict incoming connections through pf.conf. However, in keeping with the Defense in Depth strategy, I should maintain that file.
The options I have considered are:
- status quo
- create a script to update the files
I have discarded options 1 and 2. I am now seriously considering option 3.
How would a VPN be useful in this case?
I could create a VPN on which all my servers resided, both at home and at data centers around the world. This would completely negate any IP address changes. My web servers could then directly access my cvs repositories. Nagios could directly access the remote nrpe clients.
I think the best configuration is creating a VPN service on each colocated server. The network at home would then connect to each service. This would be a star arrangment with one connection from home to each server. I had considered one VPN ihosted on one of the servers. But this would require traffic from NY to travel to Austin before heading to Pennsylvania (or similar). No, to avoid length transits each remote server should have it’s own connection.
Why don’t I go with a static IP address? Cost. I’d need to get a business account and that would be +$80.00 a month. No thank you.