So I have a few servers who handle different things. One is for a forward-facing website, one is an internally used website, as well as a few servers that host DB's.
I am in the process of writing a micro-service who will be used from both the front-facing and internally-facing website. Any traffic between either server and this micro-service will need to be encrypted, and the micro-service shouldn't be accessible from the outside world.
Not knowing how this is normally done, it would seem that setting up a VPN would be the correct move on how to secure this sort of cross-server traffic. (If this assumption is wrong and there are better solutions, please let me know.) Setting this sort of thing up would also have the benefit of having the DB's accessible only to those who have access to the VPN (currently handled by the DB's authentication strategy).
After researching VPN solutions, OpenVPN seemed to have came out on top. It seems to offer the best security and seems to work on Linux servers without too much hassle.
My question is how are most OpenVPN's setup when it comes to a group of servers, one main authentication server and the network's members? Or would you have to have multiple servers and set them up to use the same certificate? Once you authenticate to the VPN, can you make direct connections to other servers that are on the network?
I'm imagining a situation like this:
server1 = VPNServer
server2 = VPNClient - Website
server3 = VPNClient - Service
server4 = VPNClient - DB
server4 need to transmit data, will that connection go directly from
server2 > server4, or will the actual traffic look like
server2 > server1 > server4? Or is it set up so that once you authenticate to the VPN, all the members of the VPN are then directly accessible?
I have a vague understanding of how VPN's work, but this understanding obviously breaks down when it comes to having multiple members on the network.
How I'm envisioning setting up the VPN currently (sorry for the low quality):