howto setup OpenVPN behind load balancer ?

[BigGExpress]

Hello.

I think this question is simple enough, & is captured in my subject.

Please let me know what further info would help.

I have this setup, but it is not working.

I am unable to reach the OpenVPN instance through the [tcp] load balancer.

Thanks for any guidance.

[Clouds]

Security protocols for Virtual Tunnels! or External protocol forwarding, PPTP with Layer 2 forwarding. Although it is not entirely secure, it is paired with the standards IPSec end-to-end encryption between clients and servers?

[BigGExpress]

@Clouds  I do not understand this reply at all.

Perhaps it was mistakenly applied to my question?

[BigGExpress]

bump.

Any comments?

Should this work?

Should it not work?

This works "out of the box" on AWS ...

[Simrandeep]

Hello,

You should be able to configure the OpenVPN server instance behind a TCP Load Balancer. You might need to confirm if your use case might require special requirement of configuration as if you want TCP LB or UDP LB. You could follow the documentation[1] to configure the Load balancer and your backend application.

[1] https://cloud.google.com/load-balancing/docs/network

[BigGExpress]

Hello. Thanks for the reply.

In this case, I need it on UDP (1194) ...

[BigGExpress]

bump.

You can try this yourself in ~10 minutes.

I have many functioning GCP NLBs.  I have many functioning OpenVPN servers.

There appears to be an issue combining these two ...

[GCPJoe]

This is an old post but I thought I'd add my findings. In the past I had avoided using a LB with OpenVPN because I knew there would be issues and shortcomings.  I don't know if you ever found a solution, if you have I'd love to hear it.  

UDP just isn't compatible with passthrough network load balancers. As I understand it UDP is stateless and there will be a loss of source IP address by OpenVPN's kernel and so establishing a connection doesn't seem feasible.  However, OpenVPN works with TCP and UDP so if the vpn client supports TCP as openvpn connect does it should work.  

There are work arounds for supporting UDP on the server side.  I would read through this article to get a better understanding.

https://cloud.google.com/load-balancing/docs/network/udp-with-network-load-balancing