How to ensure access to a server in a private subnet from home?

To access a server in a private subnet of a data center from a home network, the following approaches can be used:

1. VPN (Virtual Private Network): Create a secure tunnel connection between your home computer or router and the data center infrastructure. This can be:

   • SSL/TLS VPN: Often used for individual user access via a web browser or VPN client.
   • IPsec VPN: Suitable for site-to-site connections if your home router supports this technology.
   • OpenVPN: A flexible and cross-platform solution that requires installing a client on your home device and configuring the server in the data center.

2. Bastion Host (Jump Host): Place a separate server in the public subnet of the data center (or with an accessible external IP address), to which the first SSH access is made. Then connect from this bastion host to the server in the private subnet.

3. SSH Port Forwarding (Tunneling): Use SSH to create a secure tunnel that redirects traffic from a local port on your home machine to a remote port on the server in the private subnet via an intermediate host accessible from outside.

   • Local Forwarding: A port on your home machine is forwarded to a port on the remote server through an SSH connection.

     # ssh -L <local_port>:<private_server_address>:<remote_port> <user>@<bastion_or_accessible_server>
     ssh -L 8080:192.168.1.100:80 bastion@example.com
     # After establishing the connection, you can access http://localhost:8080 on your home machine, and the traffic will go to 192.168.1.100:80
     

   • Remote Forwarding: A port on the remote server (the one you connect to via SSH) is forwarded to a port on your home machine. Often used for port forwarding from a private network to the outside.

4. Proxy Server: Set up a proxy server (e.g., SOCKS proxy via SSH) on the bastion host or another server in the data center. Then configure applications on your home machine to use this proxy to access resources in the private network.

   # ssh -D <local_port> <user>@<bastion_or_accessible_server>
   ssh -D 1080 bastion@example.com
   # Then configure your browser or other applications to use the socks5 proxy at localhost:1080
   

5. Cloud Services: If the infrastructure is hosted by a cloud provider, use their native means of providing access to private networks (e.g., AWS VPC Peering, Google Cloud VPN, Azure VNet Peering combined with VPN Gateways).

The choice of method depends on security requirements, ease of use, the number of users, and existing infrastructure. VPN and bastion hosts are the most common and secure approaches. SSH Port Forwarding and SOCKS proxies are convenient for one-time access or for individual applications.

Use a VPN (Virtual Private Network). Create a tunnel between the home computer and the VPN server in the corporate network. The VPN server can be located in a public subnet or DMZ, with access to the private subnet.

Alternative options:

• SSH Tunneling (Port Forwarding): Forward specific ports through an SSH connection to a server accessible from outside. Less scalable and convenient for accessing multiple services.
• Jump Server (Bastion Host): A server in a public subnet through which SSH access to servers in a private subnet is performed. Requires two-step authentication.
• Proxy Server: Setting up a proxy server in a public subnet to access web services in a private subnet. Limited to protocols supported by the proxy.

The most secure and flexible approach for general access is VPN.

Example of OpenVPN setup:

# Installing OpenVPN server
sudo apt-get update
sudo apt-get install openvpn easy-rsa

# Initializing PKI
openvpn --genkey --secret static.key # For static key
# Or using easy-rsa for Public Key Infrastructure (PKI)
./easy-rsa init-pki
./easy-rsa build-ca nopass
./easy-rsa build-server-full server nopass
./easy-rsa build-client-full client1 nopass
./easy-rsa gen-dh

# Example server configuration (server.conf)
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dns"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

# Example client configuration (client.ovpn)
client
dev tun
proto udp
remote <public_server_ip> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
remote-cert-tls server
comp-lzo
verb 3