Ask HN: 各位机构/MSP，你们如何管理众多客户的 VPN 访问？
1 分•作者: k4roshi•5 个月前
Hi HN，
我们是一家软件开发机构，客户遍布欧洲各地。由于我们产品的特性，许多项目需要连接到客户的 VPN 才能提供协助和进行维护。大多数情况下，我们无法安装自己的 VPN。
这导致我们的一些开发人员需要管理 20 多个不同的 VPN，而这些 VPN 都有不同的客户端（有时版本还不兼容，说的就是 Fortinet），不同的凭据、过期时间、令牌等等。
其中一些 VPN 几个月都用不上，结果当您最需要它们来修复生产环境中的故障时，却发现它们坏了。对我们来说，这简直一团糟。
所以第一个问题是：这是一个相当普遍的问题，还是只有我们遇到了？如果是，您是否以任何方式解决了这个问题？
我一直在寻找简化流程的工具，但一无所获。
话虽如此，我们一直在探索一个想法：基本上是在现有 VPN 之上的一个控制层。一种虚拟化框架，其中 VPN 客户端在由控制平面管理的容器上运行。
用户只需要安装一个我们 VPN 层的客户端，然后决定要连接到哪个端点。
这也将开启其他可能性，例如完整的连接审计、快速离职、更好的 OTP 管理、过期通知。
当然，我们将会把它设计成零知识的，以避免安全问题。
目前还处于非常早期的阶段，老实说，我们不确定这是否真的是一个普遍的痛点，还是仅仅局限于我们所见过的少数环境。
欢迎指出这个想法有多蠢（但我想知道原因），或者讨论我们尚未考虑到的潜在问题。
查看原文
Hi HN,<p>we're a software development agency with several clients scattered across Europe. Due to the nature of our products many require to connect to the client's VPN to offer assistance and perform maintenance. Most times we can't install our own VPN.<p>This has led to some of our devs needing to manage more than 20 different VPNs, all with different clients (sometimes with incompatible versions, looking at you Fortinet), credentials, expirations, tokens and such.
Some of those get unused for months, only to discover they're broken when you most need them to fix an outage in production. For us, it has become a mess.<p>So the first question for you: Is this a fairly common problem or is this just us? If it is, did you solve it in any way?
I've been looking for tools to streamline this but haven't found anything.<p>That said, we’ve been exploring an idea for a while: basically a control layer on top of existing VPNs. A sort of virtualization framework where vpn clients run on containers managed by the control plane.
Users would only then have one client to our VPN layer installed and just decide which endpoint to connect to.
This would also open up other possibilities like full connection audits, quick offboarding, better OTP management, expiration notifications.
Of course we would design it to be zero knowledge to avoid security issues.<p>Still very early and we’re honestly not sure if this is actually a widespread pain or just limited to the few environments we’ve seen.<p>Happy to be told this is dumb (but I'd like to know why) or to discuss potential problems we haven't considered yet.