Managing Environment VPN.

In the portal, the environment VPN is managed through the VPN container modal.

To get there:

1. Select Environments from the main, left-hand navigation.
2. Select the environment from the first column.
3. Scroll down the environment dashboard and click on the Manage button next to VPN.

   

   Dependency on Load Balancer

   To use the VPN the environment load balancer must be running.

VPN Dashboard

The service is automatically created in every environment, but as per Cycle's security philosophy, it is disabled by default.

To configure:

1. Check to see if the load balancer service is running. If not, click on the link to the load balancer container from the list of services below container count and start it manually by holding the start button located at the top of the page.
2. Select the VPN tab underneath the environment name.
3. Click the Enable button.
4. Choose Generate VPN Files, then Download VPN files.
5. Unzip the download and add the connection to a local OpenVPN compatible client.
   Renewing VPN Certificate

   The certificate generated by the VPN service is good for 1,000 days. If the certificate expires the user should:

   1. Use the two-way console to log into the VPN container.
   2. Delete the following folder /usr/share/easy-rsa/pki .
   3. Restart the VPN container.
   4. Redownload the VPN config and install the new connection.

Configuring Authentication

For simplicity, the VPN service provides the option to allow any Cycle user with permission to access the environment, permission to access the VPN as well. They will be able to log in with their Cycle username/password. Check the box that says "Allow Cycle User Access", then click "Update".

The VPN service also provides the option to use an Access Control List (ACL) to limit who can connect. Specify a username and password for the user and add them to the list. Enabling either form of user authentication requires the checkbox next to the preferred method on the VPN dashboard.

Authentication Resets and Migration

If a VPN container needs to be migrated, it is possible to do so. However, after a migration has taken place the configuration and authentication must be reset and re-downloaded in order for the client to connect to the container.

Another pattern that makes sense is to delete the VPN container instance and use the create new button at the bottom of the instances page to create a new VPN container instance on the new serer being targeted. Each of these approaches requires a re-downloading of the client config.

Default Configuration Reference

Server-Side Defaults

While the server side directives can be customized (see below), the following are the default settings for Cycle VPN services:

Client-Side Defaults

After downloading the VPN connection zip and unzipping it, opening the config.conf file the following defaults are present:

Customizing VPN Server Configuration

Users with granular needs over the VPN configuration can set additional directives via the form on the **Config** tab located on the main left-hand navigation of the VPN modal.