Nyr
Fixing issues that happens when public or private IPv4 changes
While Linode, DigitalOcean, and OVH (scenario A) assign the public IP to the virtual machine's network interface, other cloud providers like AWS, GCP, and Azure (scenario B) translate the public address (NAT) to the private address on the way in.
Using a hostname (domain/sub-domain) to work around a changed public IP will not work for scenario A because the IPv4 is used in the iptables for NAT. It is also ineffective when, for any reason, the private IP changes on scenario B.
The solution for this problem is to use the default gateway's interface instead of the outbound IP in iptables. Then, OpenVPN can bind on 0.0.0.0, to accommodate connections independently of the IP.
The use case that required the following changes has been in production for over 2 years, so far:
- I have a fleet of VPN servers that scale in and out according to the demand. I use AWS ASG to increase and decrease the number of servers from a single image. Each new instance will have random private and public IPs.
- I use DNS to select (load balance) a random server for each new connection. The VPN client resolves the hostname only once, right before starting the connection, and uses the IP until the client decides to disconnect.
I am glad to answer any questions. Keep up with the good job!
I also incorporated the custom DNS solution (issue #889) from PR #1108 (which was incomplete) and PR #1104 (which had no input sanitization).