Hi there, I'm trying to sort out what must be a relatively straightforward task, and feel like I'm hitting a brick wall. :( I have an existing Ubuntu server that denies all incoming traffic with a client unless it's able to authenticate with OpenVPN (we use Tunnelblick to manage client connections). However, we have other public servers (public IP addresses, not ones sat on a private VPN to be exposed) that we'd like to block access to using the same existing OpenVPN install. Here's a subset from server.conf: [oconf=Server Config]... port 1194 dev tun server 10.8.0.0 255.255.255.0 push "route (new_machine_IP) 255.255.255.255" ...[/oconf] From here, what's an appropriate way to disable public access to the new server if the visitor isn't authenticated behind the VPN? I've installed ufw and openvpn, but from here, I'm a bit worried that I'm either going to lock myself out by accident by closing public access before setting up the forwarding, or I'm going to just terribly mess up the forwarding in the first place. Please excuse my ignorance; I'm having a tough time sorting all of this out. Thank you!

Multiple servers behind one OpenVPN connection

sgrant

Hi there,

I'm trying to sort out what must be a relatively straightforward task, and feel like I'm hitting a brick wall. 🙁

I have an existing Ubuntu server that denies all incoming traffic with a client unless it's able to authenticate with OpenVPN (we use Tunnelblick to manage client connections). However, we have other public servers (public IP addresses, not ones sat on a private VPN to be exposed) that we'd like to block access to using the same existing OpenVPN install.

Here's a subset from server.conf:
...
port 1194
dev tun
server 10.8.0.0 255.255.255.0
push "route (new_machine_IP) 255.255.255.255"
... From here, what's an appropriate way to disable public access to the new server if the visitor isn't authenticated behind the VPN? I've installed ufw and openvpn, but from here, I'm a bit worried that I'm either going to lock myself out by accident by closing public access before setting up the forwarding, or I'm going to just terribly mess up the forwarding in the first place.

Please excuse my ignorance; I'm having a tough time sorting all of this out. Thank you!

TinCanTech

So you need help configuring your firewall ?

sgrant

Well, the original server is working wonderfully, I'm just having a hard time figuring out the setup for other servers behind the VPN. Is this a routing issue on the other servers? Do they need to have OpenVPN installed as well, or can I set up some routing to make sure that web requests are only available for clients who have properly authenticated?