how to restrict apache access outside openvpn clients?

marceloramone

Hello,

I need to restrict apache access from the public, only vpn clients should be able to access the webserver.

10.8.0.0/24 is the private network for openvpn.

I have iptables rules already configured but I need to shield apache from outside:

sudo iptables -L -n -v
Chain INPUT (policy ACCEPT 6727 packets, 1462K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    1    42 ACCEPT     udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           state NEW udp dpt:1194 
   40  6840 ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 5906  969K ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  tun+   eth0    0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
 5293 3157K ACCEPT     all  --  eth0   tun+    0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 

Chain OUTPUT (policy ACCEPT 6324 packets, 3501K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      tun+    0.0.0.0/0            0.0.0.0/0

Any idea?

Thanks.-

TiTex

https://httpd.apache.org/docs/2.4/howto/access.html

marceloramone

is not the case titex, i know that can be done with a .htaccess file but is not the case.
thanks.-

TiTex

iptables -I INPUT -p tcp --dport 80 ! -s 10.8.0.0/24 -j DROP

this rule will drop all traffic on tcp port 80 (http default) , except when the originating request is from 10.8.0.0/24