Establishing a secure offsite backup infrastructure requires configuring OpenVPN for robust site-to-site connectivity between your primary data center and remote satellite offices. This guide details the precise configuration steps to link Site A and Site B, ensuring encrypted tunnel establishment, proper routing of backup traffic, and reliable data replication across untrusted networks while maintaining high security standards.
Prerequisites and Network Architecture
Before initiating the configuration process, ensure that both Site A (primary) and Site B (satellite) have static public IP addresses or dynamic DNS services properly resolved. You must install the OpenVPN server software on Site A and configure it as a bridge or routed VPN endpoint. The network topology should allow traffic from the backup subnet at Site B to route through the VPN tunnel to the backup storage servers at Site A. Verify that firewalls on both ends permit UDP port 1194 by default, although TCP can be used if UDP is blocked by intermediate ISPs. It is critical to define the virtual subnet for the VPN interface, such as
10.8.0.0/24, ensuring it does not overlap with existing local LAN subnets at either site.
Server Configuration on Site A
The core of the setup lies in the
server.conf file on your primary site. Begin by defining the port and protocol. For most offsite backup scenarios, UDP is preferred due to lower overhead, but TCP may be necessary if you are behind strict NAT devices. Set the
dev tun directive to create a routed IP tunnel rather than a bridged Ethernet connection, which simplifies routing table management. Generate strong Diffie-Hellman parameters using
openvpn --genkey --secret ta.key to add an additional layer of TLS authentication against DoS attacks.
You must specify the certificate authority files, server certificate, and private key paths. Crucially, enable push routes so that clients at Site B know how to reach the backup subnets at Site A. Add a line such as
push "route 192.168.10.0 255.255.255.0" assuming your backup storage resides on that subnet. If you need to direct all backup traffic specifically, consider using custom routes as detailed in our guide on
Configure OpenVPN Client with Custom Routes. Ensure the
keepalive directive is set to ping every 10 seconds and retry after 120 seconds to maintain stability over fluctuating internet connections typical of offsite links.
Client Configuration on Site B
At the satellite office, the client configuration must mirror the server's network settings but point towards the public IP of Site A. Create a
client.conf file that includes the CA certificate, client certificate, and client key generated during the PKI setup. Set the
remote directive to the public IP or hostname of your OpenVPN server. To prevent traffic leaks when the VPN drops, implement a kill-switch mechanism by adding
block-outside-dns and ensuring that no default gateway is pushed unless intended.
If your satellite office runs under specific containerized environments like OpenVZ, you may encounter kernel-level restrictions. In such cases, refer to
How to configure iptables to allow OpenVPN clients to access internet via the server, if it's run under OpenVZ? to resolve networking issues. For standard Linux or Windows clients, ensure that the firewall allows outgoing connections to the OpenVPN port. Test the connection by pinging the server's VPN IP address once the tunnel is established.
Routing and Firewall Rules
Proper routing is essential for seamless site-to-site communication. On Site A, enable IP forwarding by setting
net.ipv4.ip_forward=1 in
/etc/sysctl.conf. Configure your firewall to accept forwarded traffic between the VPN interface and the internal backup network. Use iptables rules to masquerade or SNAT traffic originating from the VPN subnet if the backup servers require source IP translation. Conversely, at Site B, ensure that the router forwards traffic destined for the Site A backup subnet into the OpenVPN tunnel. Avoid pushing a default route (
0.0.0.0 0.0.0.0) unless you intend to route all internet traffic through the backup link, which can cause performance bottlenecks.
Testing and Verification
Once configured, verify the tunnel status using
openvpn --config client.conf and check for successful negotiation messages. Perform a traceroute from Site B to the backup server at Site A to confirm traffic flows through the tunnel interface. Monitor logs for any disconnects or authentication failures. Regularly test the backup integrity by performing a small trial transfer. If you experience latency issues, consider adjusting the MTU size using the
mtu-test option to find the optimal packet size for your specific network path.
Frequently Asked Questions
Can I use TCP instead of UDP for better reliability?
Yes, switching to TCP can improve reliability in unstable network conditions where packet loss triggers UDP retransmission delays. However, TCP adds overhead and may reduce throughput compared to UDP, so benchmark both protocols to determine the best fit for your backup volume.
How do I handle dynamic IP changes at the satellite office?
Use Dynamic DNS (DDNS) services on Site B to update a hostname record whenever the public IP changes. Configure the OpenVPN client to connect to this hostname rather than a static IP, allowing automatic reconnection without manual intervention.
What happens if the VPN connection drops during a large backup?
Most modern backup software supports resume capabilities, allowing it to restart transfers from the last checkpoint. Additionally, OpenVPN’s keepalive feature helps detect dead peers quickly, enabling scripts to trigger alerts or retry mechanisms immediately upon disconnection.
Is it safe to expose the OpenVPN server directly to the internet?
It is safer to place the OpenVPN server behind a hardware firewall or reverse proxy that filters incoming traffic. Always enforce strong TLS authentication and disable weak ciphers to prevent unauthorized access attempts targeting the VPN port.
How can I optimize bandwidth usage for offsite backups?
Enable compression within the OpenVPN configuration using the
compress directive, though note that this consumes CPU cycles. Alternatively, use deduplication features in your backup software before encryption to minimize the amount of data transmitted over the tunnel.