phodara
I am having two issues -
When I setup my OpenVPN Instance I want two interfaces one in my public VPC (to which I will assign an elastic IP) and the second interface (on a private subnet) that I wish to move the admin web interface to. The Idea is I don't want the Admin GUI visible on the dirty/outside interface even if its a different port.
1). If I build my instance with eth0 on the Public VPC and eth1 on an internal VPC. Once my OpenVPN server is up and I ssh in I still only see one interface.
2). Even with just one interface what I would like to do is move the Admin Web site to port 943 then block this port from the outside (in the AWS security policy). But I am having a lot of trouble doing this.
Are there any specific instructions on how I can make these modifications?
Thank you
The Johan
Regarding the issue with adding a network interface; you'll have to consult AWS documentation for that.
For my part, I suggest you set the Admin web UI on a different PORT and then use Security Groups in AWS to block it off so only your IP address can access it. Be sure to disable service forwarding for the Admin web UI.
You're talking about moving the Admin web UI to port 943, but that's where it already is. You see, the client web UI and admin web UI by default both run on TCP 943, and using service forwarding, incoming https requests on the OpenVPN TCP daemons running on TCP port 443 (the default https port) will automatically be forwarded internally to the web service on TCP 943. We run the OpenVPN TCP daemons on port TCP 443 because that port is usually left open in basic firewalls that block most traffic except browsing. So TCP 443 is a fallback method of connecting. UDP 1194 is preferred.
phodara
Amazing I don't need to bang my head against the wall any longer. Thank's for your clear accurate explanation.
I was able to disable service forwarding for the admin ui, change the WEB Admin port, not allow the port in the instance security policy and now only the client page is accessible from outside the firewall.
Thank you, much appreciated!
The Johan
Glad to be of assistance.
phodara
1). I login into the Admin GUI under the admin account and created a group called 'AllRoutes' turned on access control within the group, assigned blocks of IP's for that group, I create a user account for myself and add 'AllRoutes' to my user account. I login under my user account check my routes and everything looks good.I logout of VPN.
Now I log back in as the Admin go to my account and give myself admin rights. So now my account has admin rights and has 'AllRoutes'.
I log back into VPN under my user account and I lost all the routes I assigned in 'AllRoutes' If I go back in as admin and uncheck admin for my user account, next time I log in I have all my routes.
What am I missing?
The Johan
Admin users are treated differently and can have completely different access rules. Kindly don't mix admin users and non-admin groups. Just add a 'normal' user account for VPN use and you'll be fine.
phodara
Thank you, I will keep them separate.
