Architecture Specification

OpenStack 3-Tier Enterprise Cloud Architecture

Complete implementation runbook for isolated Web, App, and Database tiers with Octavia Load Balancing, Cinder Storage, and IPSec VPN Gateway integration.

1. Architecture Topology & IP Allocation Plan

This deployment strictly isolates internal compute tiers using OpenStack Neutron Software Defined Networks (SDN), enforcing layer-3 security group boundaries and ingress reverse-proxy routing.

[ On-Premises Office: 192.168.1.0/24 ] │ [ Customer Gateway: 203.0.113.1 ] │ (Site-to-Site IPsec VPN) [ OpenStack VPN Gateway / Router: 203.0.113.2 ] ◄── [ Internet Gateway / Floating IPs ] │ ┌──────────────┴────────────────────────┬────────────────────────────────┐ │ │ │ ▼ 10.1.1.1 ▼ 10.1.2.1 ▼ 10.1.3.1 ┌───────────────────────────────┐ ┌───────────────────────────────┐ ┌───────────────────────────────┐ │ Web Tier: erp-web-net │ │ App Tier: erp-app-net │ │ DB Tier: erp-db-net │ │ Subnet: 10.1.1.0/24 │ │ Subnet: 10.1.2.0/24 │ │ Subnet: 10.1.3.0/24 │ ├───────────────────────────────┤ ├───────────────────────────────┤ ├───────────────────────────────┤ │ • Octavia LB: 10.1.1.10 │ │ • App Server 01: 10.1.2.20 │ │ • Master DB: 10.1.3.10 │ │ • Web Server 01: 10.1.1.20 │ │ • App Server 02: 10.1.2.21 │ │ • Replica DB: 10.1.3.11 │ │ • Web Server 02: 10.1.1.21 │ │ • Redis Cache: 10.1.2.30 │ │ • Cinder Volume: 10.1.3.20 │ │ • Redis Cache: 10.1.1.40 │ │ │ │ • Swift Backup: 10.1.3.21 │ └───────────────────────────────┘ └───────────────────────────────┘ └───────────────────────────────┘

Network Subnet Architecture

Network Name Subnet Name CIDR Range Gateway IP Function / Role
erp-web-net erp-web-subnet 10.1.1.0/24 10.1.1.1 Public Web DMZ, Octavia Load Balancer, Nginx reverse proxy
erp-app-net erp-app-subnet 10.1.2.0/24 10.1.2.1 Private Application Servers (Spring Boot, Node.js, Redis)
erp-db-net erp-db-subnet 10.1.3.0/24 10.1.3.1 Isolated Database Store (PostgreSQL / MySQL) & Cinder volumes

2. Enterprise Component Mapping: AWS vs. OpenStack

This design implements identical architectural guarantees to an AWS VPC enterprise deployment using open-source OpenStack modules:

AWS Primitive OpenStack Component Implementation in this Project
AWS VPC & Subnets Neutron SDN Isolated VXLAN/Geneve networks (`erp-web-net`, `erp-app-net`, `erp-db-net`)
Virtual Private Gateway (VGW) Neutron VPNaaS IPSec Site-to-Site endpoint connecting Office (192.168.1.0/24)
Application Load Balancer (ALB) Octavia (LBaaS v2) Layer 7 HTTP/HTTPS balancing traffic across `erp-web-01` and `02`
EC2 Instances Nova Compute Virtual machines running the three-tier workloads
EBS Block Storage Cinder Volume High-performance block storage attached to Master Database
S3 Object Storage Swift Storage Cold database backups and audit logs
Security Groups Neutron Security Groups Stateful firewall rules between Web, App, and Database tiers

Phase 0: Environment Verification & Image Upload

Ensure administrative Keystone credentials are active and register the base guest operating system image in Glance.

Keystone Authentication & Glance Registration (Host Terminal) 
# 1. Source OpenStack admin credentials (or retrieve MicroStack password)
sudo snap get microstack config.credentials.keystone-password

# 2. Register base Ubuntu/CirrOS image in Glance
microstack.openstack image create "Ubuntu-Jammy-Cloud" \
  --file /media/$USER/*/jammy-server-cloudimg-amd64.img \
  --disk-format qcow2 \
  --container-format bare \
  --public

# 3. Create SSH Keypair for administrative access
mkdir -p ~/.ssh
microstack.openstack keypair create erp-key > ~/.ssh/erp-key.pem
chmod 600 ~/.ssh/erp-key.pem

Phase 1: Software-Defined Networking (Neutron)

Deploy the three Layer-2 broadcast networks, their respective IPv4 subnets, and the central Layer-3 router connecting to the external gateway.

GUI Walkthrough (Horizon Dashboard)

  1. Navigate to Project → Network → Networks.
  2. Click + Create Network and configure the three networks:
    • Web Tier: Name: erp-web-net | Subnet: erp-web-subnet (CIDR: 10.1.1.0/24, Gateway: 10.1.1.1).
    • App Tier: Name: erp-app-net | Subnet: erp-app-subnet (CIDR: 10.1.2.0/24, Gateway: 10.1.2.1).
    • DB Tier: Name: erp-db-net | Subnet: erp-db-subnet (CIDR: 10.1.3.0/24, Gateway: 10.1.3.1).
  3. Navigate to Project → Network → Routers.
  4. Click + Create Router:
    • Name: erp-router | External Network: external
  5. Click on erp-router → Interfaces tab → + Add Interface three times to attach erp-web-subnet, erp-app-subnet, and erp-db-subnet.
Neutron CLI Automation Script 
# Create Networks
microstack.openstack network create erp-web-net
microstack.openstack network create erp-app-net
microstack.openstack network create erp-db-net

# Create Subnets
microstack.openstack subnet create erp-web-subnet \
  --network erp-web-net --subnet-range 10.1.1.0/24 --gateway 10.1.1.1 --dns-nameserver 8.8.8.8
microstack.openstack subnet create erp-app-subnet \
  --network erp-app-net --subnet-range 10.1.2.0/24 --gateway 10.1.2.1 --dns-nameserver 8.8.8.8
microstack.openstack subnet create erp-db-subnet \
  --network erp-db-net --subnet-range 10.1.3.0/24 --gateway 10.1.3.1 --dns-nameserver 8.8.8.8

# Deploy Central L3 Router
microstack.openstack router create erp-router
microstack.openstack router set erp-router --external-gateway external

# Attach Subnet Interfaces
microstack.openstack router add subnet erp-router erp-web-subnet
microstack.openstack router add subnet erp-router erp-app-subnet
microstack.openstack router add subnet erp-router erp-db-subnet

Phase 2: Security Groups (Tier Isolation Firewalls)

Configure stateful ingress filtering to guarantee that the database tier can only be contacted by the application layer, and the application layer can only be contacted by the web layer.

Security Group Rule Name Protocol Port Allowed Source
erp-web-sg SSH Admin TCP 22 0.0.0.0/0 (or Office CIDR)
HTTP Ingress TCP 80 0.0.0.0/0 (Public Internet)
HTTPS Ingress TCP 443 0.0.0.0/0 (Public Internet)
erp-app-sg SSH Admin TCP 22 0.0.0.0/0
Backend API TCP 8080 / 8000 erp-web-sg (Only Web Servers)
erp-db-sg SSH Admin TCP 22 0.0.0.0/0
PostgreSQL / MySQL TCP 5432 / 3306 erp-app-sg (Only App Servers)
Security Group CLI Setup 
# 1. Create Security Groups
microstack.openstack security group create erp-web-sg --description "Web DMZ Firewall"
microstack.openstack security group create erp-app-sg --description "Application Tier Firewall"
microstack.openstack security group create erp-db-sg --description "Isolated Database Firewall"

# 2. Add Rules to erp-web-sg
microstack.openstack security group rule create erp-web-sg --proto tcp --dst-port 22 --remote-ip 0.0.0.0/0
microstack.openstack security group rule create erp-web-sg --proto tcp --dst-port 80 --remote-ip 0.0.0.0/0
microstack.openstack security group rule create erp-web-sg --proto tcp --dst-port 443 --remote-ip 0.0.0.0/0

# 3. Add Rules to erp-app-sg (Restricted to erp-web-sg)
microstack.openstack security group rule create erp-app-sg --proto tcp --dst-port 22 --remote-ip 0.0.0.0/0
microstack.openstack security group rule create erp-app-sg --proto tcp --dst-port 8080 --remote-group erp-web-sg

# 4. Add Rules to erp-db-sg (Restricted to erp-app-sg)
microstack.openstack security group rule create erp-db-sg --proto tcp --dst-port 22 --remote-ip 0.0.0.0/0
microstack.openstack security group rule create erp-db-sg --proto tcp --dst-port 5432 --remote-group erp-app-sg
microstack.openstack security group rule create erp-db-sg --proto tcp --dst-port 3306 --remote-group erp-app-sg

Phase 3: Compute Instances & Cinder Storage

Deploy virtual machines into their respective networks and attach persistent Cinder block storage to the database instance.

Nova Compute & Cinder Storage Deployment 
# 1. Deploy Web Servers into erp-web-net
microstack.openstack server create --flavor m1.small --image "Ubuntu-Jammy-Cloud" \
  --key-name erp-key --network erp-web-net --security-group erp-web-sg erp-web-01

microstack.openstack server create --flavor m1.small --image "Ubuntu-Jammy-Cloud" \
  --key-name erp-key --network erp-web-net --security-group erp-web-sg erp-web-02

# 2. Deploy Application Server into erp-app-net
microstack.openstack server create --flavor m1.small --image "Ubuntu-Jammy-Cloud" \
  --key-name erp-key --network erp-app-net --security-group erp-app-sg erp-app-01

# 3. Deploy Database Server into erp-db-net
microstack.openstack server create --flavor m1.small --image "Ubuntu-Jammy-Cloud" \
  --key-name erp-key --network erp-db-net --security-group erp-db-sg erp-db-01

# 4. Provision and Attach 10 GB Cinder Volume to erp-db-01
microstack.openstack volume create --size 10 erp-db-data
microstack.openstack server add volume erp-db-01 erp-db-data

Phase 4: Octavia Load Balancer & Public Floating IP

Set up an Octavia Load Balancer (or Nginx Edge Proxy) to distribute public traffic evenly across erp-web-01 and erp-web-02.

Octavia Load Balancer & Floating IP Configuration 
# 1. Create Load Balancer on the Web Subnet
microstack.openstack loadbalancer create --name erp-alb --vip-subnet-id erp-web-subnet

# 2. Create Listener on HTTP Port 80
microstack.openstack loadbalancer listener create --name erp-http-listener --protocol HTTP --protocol-port 80 erp-alb

# 3. Create Backend Pool (Round Robin)
microstack.openstack loadbalancer pool create --name erp-web-pool --lb-algorithm ROUND_ROBIN --listener erp-http-listener --protocol HTTP

# 4. Add Web Nodes as Pool Members
WEB01_IP=$(microstack.openstack server show erp-web-01 -f json | grep -o '10\.1\.1\.[0-9]*' | head -n 1)
WEB02_IP=$(microstack.openstack server show erp-web-02 -f json | grep -o '10\.1\.1\.[0-9]*' | head -n 1)

microstack.openstack loadbalancer member create --subnet-id erp-web-subnet --address $WEB01_IP --protocol-port 80 erp-web-pool
microstack.openstack loadbalancer member create --subnet-id erp-web-subnet --address $WEB02_IP --protocol-port 80 erp-web-pool

# 5. Allocate and Associate Floating IP
VIP_PORT=$(microstack.openstack loadbalancer show erp-alb -c vip_port_id -f value)
PUBLIC_IP=$(microstack.openstack floating ip create external -c floating_ip_address -f value)
microstack.openstack floating ip set --port $VIP_PORT $PUBLIC_IP

echo "ERP Web Application reachable publicly at: http://$PUBLIC_IP"

Phase 5: Site-to-Site IPSec VPN Gateway (VPNaaS)

Connect your on-premises office network (192.168.1.0/24) directly to the OpenStack cloud using an encrypted IPsec VPN tunnel.

Neutron VPNaaS Configuration 
# 1. Define IKE & IPSec Security Policies
microstack.openstack vpn ike policy create ike-policy-office \
  --encryption-algorithm aes-256 --auth-algorithm sha256 --pfs group14

microstack.openstack vpn ipsec policy create ipsec-policy-office \
  --encryption-algorithm aes-256 --auth-algorithm sha256 --pfs group14

# 2. Deploy VPN Service on the central router
microstack.openstack vpn service create --name vpn-service-erp \
  --router erp-router --subnet erp-web-subnet

# 3. Create IPSec Site-to-Site Connection with Office Gateway
microstack.openstack vpn ipsec site connection create --name vpn-to-office \
  --vpnservice vpn-service-erp \
  --ikepolicy ike-policy-office \
  --ipsecpolicy ipsec-policy-office \
  --peer-address 203.0.113.1 \
  --peer-id 203.0.113.1 \
  --peer-cidr 192.168.1.0/24 \
  --psk "EnterpriseSecretPreSharedKey2026" \
  --initiator bi-directional

Verification & Security Validation Checklist

Confirm the deployment matches all strict architectural requirements by running these connectivity probes from your terminal:

Validation Checklist
  • ✔ Web Tier Reachability: HTTP requests to the public floating IP return HTTP 200 from both erp-web-01 and erp-web-02 in round-robin fashion.
  • ✔ App Tier Isolation: erp-app-01 accepts connections on port 8080 from erp-web-01, but drops packets attempting to connect directly from the public internet.
  • ✔ Database Tier Isolation: erp-db-01 allows port 5432/3306 connections only from erp-app-01. Direct connections from the web tier or public gateway fail with a timeout.
  • ✔ Storage Persistence: lsblk inside erp-db-01 shows the 10GB /dev/vdb Cinder block volume mounted to /var/lib/postgresql/data.
Automated Connectivity Verification Script 
# 1. Test Load Balancing across Web Instances
for i in {1..6}; do
  curl -s -I http://$PUBLIC_IP | grep -E "(HTTP/|Server)"
done

# 2. Verify Port 8080 isolation from an external host (Should time out / fail)
nc -zv -w 3 $APP_INTERNAL_IP 8080 || echo "PASS: App tier is protected from external access"

# 3. Verify Database isolation (Should time out from Web Tier)
# (Inside erp-web-01):
nc -zv -w 3 10.1.3.10 5432 || echo "PASS: Database tier is isolated from Web tier"