Accesing server public ip addres using openvpn

bchojnicki

Hi
Situation:
Opnevpn server running on linux.
public ip address: 1.2.3.4
apache running and listening on 1.2.3.4:80
iptables blocking all but openvpn port 1194

iptables -F
iptables -X
iptables -Z
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 1194 -j ACCEPT
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited

vpn server network configuration
server 10.8.0.0 255.255.255.0
and ip for client: ifconfig-push 10.8.0.9 10.8.0.10

What I want to achieve:
I want to access 1.2.3.4:80 only using vpn connection.

I think that things to be done are:
- add push "route 87.119.2.146 255.255.255.255" to openvpn config
- allow 10.8.0.9 to access 80 port in iptables

but what else?

Best regards
bchojnicki

janjust

if you're running the web server on the same box as the VPN server then this is very hard, if not impossible to do.
The VPN client needs a direct (non-VPN tunneled) route to the server in order to send the encrypted traffic. This route is not aware of which port you are using (port 80 or 1194); thus ALL traffic sent to the public IP address of the VPN server is sent *outside* of the VPN tunnel.
The easiest solution is to move the web server to a different IP; the only other solution is to add some extensive port-based routing to the openvpn *client* so that packets destined for 1.2.3.4:80 are rewritten to use the tunnel. This depends heavily on the client OS you are using and has little to do with OpenVPN.

Mimiko

On your server you have to allow input from VPN tunnel:

iptables -A INPUT -i tun+ -j ALLOW

If the client is linux based, than this might be done with rules:

iptables -A OUTPUT -d 1.2.3.4 -p TCP --dport 80 -j ROUTE --gw 10.8.0.10

where 10.8.0.10 is the IP of the server for established tunnel. Or use MARK and iproute2 for the same purpose.