Second VPN Endpoint: What It Covers and What It Does Not

Two endpoints on paper look like redundancy. In practice a second address helps only when clients can reach it and when it avoids the failure you are planning for. Two servers behind the same access connection, the same account or the same target network fail together. The useful question is which single failure the second endpoint removes.

Compare What Both Endpoints Share

List what the two endpoints have in common before counting what they duplicate. Hosting location, provider account, upstream transit, DNS hosting, the identity source and the private resource behind the tunnel each represent either a shared dependency or an independent one. Two virtual machines in one region share a provider outage. Two regions under one account still share the billing relationship and the control plane that provisions them.

The target network deserves the same treatment. A healthy backup gateway cannot restore a NAS that is offline, and it cannot reach an office network whose uplink is down. If both endpoints terminate into the same private subnet, the second one adds a path to a destination that is already the single point of failure.

Identity is the dependency people forget. Cloning the certificate and the configuration to a second host creates two places where the same credential can be copied, and it says nothing about how revocations reach both.

Decide How a Client Switches

A second endpoint is useful only if the client knows about it and can select it without a support call. OpenVPN connection profiles can carry several remote lines with a selection policy, and most clients expose an alternative profile in a menu. Whatever the mechanism, write down which one your users have, because a profile they cannot find is not failover.

Read the client documentation on address changes during a session. Some implementations keep the original peer for the life of the tunnel and only consult alternatives when reconnecting. That distinction decides whether a dead endpoint produces a brief interruption or a session that never recovers. Test the reconnect path instead of assuming it happens.

A changed exit address also breaks application state. Failover is recovery, and describing it as uninterrupted continuity sets an expectation the transport cannot meet.

Test One Real Failure

Pick one controlled outage and run it end to end, rather than trusting the design document. Stop the primary endpoint, then confirm that an authorized client reaches the intended application through the alternative while unauthorized clients still cannot. Record how long the switch took and what the application saw.

dig +short vpn2.example.net
ip route get 10.20.30.41
journalctl -u openvpn@backup --since '-10 min'

The first command confirms that the backup name resolves to something routable before you need it, which is the cheapest test here. The second shows which interface the kernel would use for a private destination once the alternative is up. The third gives the client log naming the peer it actually connected to, and that is the only proof the switch happened. Watch the blocking behaviour during the gap too, because a policy that leaks traffic while switching is worse than a short outage.

Then bring the original back and confirm whether the client returns. A failback that happens by accident is a behaviour nobody planned for.

Write Down What the Second Address Buys

Summarise the coverage in one paragraph: which failure the second endpoint removes, which failures it shares with the first, and which assumptions the switch depends on. Name the client-side mechanism plus the private routes and DNS behaviour that must exist at both locations. A public internet exit is not a substitute for a private gateway, and a document that treats them as interchangeable will be believed. Add the recovery test you ran, with the date and the result.

Independence from one server is not independence from the shared account or the target network. The paragraph that states this out loud is what stops a second address from being sold internally as high availability. It also tells the next operator what to check first when the pair fails together.