Skip to content

Latest commit

 

History

History
45 lines (32 loc) · 1.8 KB

README.md

File metadata and controls

45 lines (32 loc) · 1.8 KB
Raw

Couchbase strongSwan IPSEC VPN Container

To facilitate cross-datacenter relplication of your Couchbase buckets we add a requirement that a site-to-site VPN must connect the two sites. The reason is that the cluster operates in an overlay network with RFC1918 addresses, these are encoded into the cluster map thus a cluster in site A must have L3 connectivity to these addresses in site B.

This is a pure L3 routed solution, and daemon set containers must be installed on the Couchbase nodes which add a static route for the remote prefix or prefixes whose next hop is the VPN gateway. While we could just use SNAT within the VPN gateway to mitigate the requirement for static routes, we avoid this as it would add state to the system, and connection tracking tables are only a finite size. Therefore we sacrifice simplicity for reliability in that connections won't randomly get dropped.

Building

make

Configuration

STRONGSWAN_LEFTID
The local gateway's identity
STRONGSWAN_LEFTSUBNET
The local gateway's subnet(s) e.g. 10.0.0.0/16
STRONGSWAN_RIGHT
The remote gateway's public IP address
STRONGSWAN_RIGHTID
The remote gateway's identity
STRONGSWAN_RIGHTSUBNET
The remote gateways subnet(s) e.g. 10.10.0.0/16,10.16.0.0/24
STRONGSWAN_PSK
The pre-shared key to authenticate with

Running

docker run \
  -p 500:500/udp \
  -p 4500:4500/udp \
  -e STRONGSWAN_LEFTID=aws-us-west \
  -e STRONGSWAN_LEFTSUBNET=10.0.0.0/16 \
  -e STRONGSWAN_RIGHT=85.254.56.102 \
  -e STRONGSWAN_RIGHTID=aws-us-east \
  -e STRONGSWAN_RIGHTSUBNET=10.1.0.0/16 \
  -e STRONGSWAN_PSK=supersecret \
  --cap-add NET_ADMIN \
  couchbase/strongswan:1.0.0