VPN client still connects as "real IP" in internal webserver

ravenlost

Hello,

I have OpenVPN setup on my router at home using 'tun' device type.

I've also got an internal webserver running on my NAS on my local 192.168.0.x network.

I've got a FW rule on my router that forwards *:80 resquests to my NAS.

Now the problem I'm having is that I want to be able to limit access to my webserver only to users on the 192.168.0.x network AND users connected through my VPN. I'm able to do the local network, but not the 10.8.0.x network (VPN lan I was assuming). It seems that when I do an http request when connected through VPN, the webserver still only takes the 'remote_ip' as being my 'real internet ip'. I thought it would of been my VPN IP (10.8.0.x) but doesn't seem like so. I did check my VPN logs and it does seem to assign me a 10.8.0.x IP :

root@server:/tmp/log/openvpn# cat openvpn-status.log
OpenVPN CLIENT LIST
Updated,Sat Apr 28 12:37:05 2018
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
ravenlost,188.188.162.57:58698,3481,6216,Sat Apr 28 12:35:35 2018
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.8.0.10,ravenlost,188.188.162.57:58698,Sat Apr 28 12:35:46 2018
GLOBAL STATS
Max bcast/mcast queue length,0
END

Any help / guidance for this would be very appreciated! I'm not a pro in networking... Sorry if this is a very simple thing to fix.

Cheers!
Pat

TinCanTech

ravenlost wrote I want to be able to limit access to my webserver only to users on the 192.168.0.x network AND users connected through my VPN

So you do not need this:

ravenlost wrote I've got a FW rule on my router that forwards *:80 resquests to my NAS

Then your web server will not be accessible from the internet.

ravenlost

Okay, correction: PART of my website needs to be accessible from outside, other parts (admin stuff) needs to be locked down to only two networks...

The give an idea, this is my webserver's config for this. The particular site runs as a virtual host.

$HTTP["host"] =~ "(^|\.)mydomain.name.com$" {
  ...
  $HTTP["url"] =~ "^/admin"{
    $HTTP["remoteip"] !~ "192\.168\.0\.*|10\.8\.0\.*" {
       url.access-deny = ("")
    }
  }
  ...
}

And this is where it fails to allow 10.8.0.x network, since even though I'm connected through VPN, $HTTP["remoteip"] is still being logged as my real internet IP..

TinCanTech

ravenlost wrote Okay, correction: PART of my website needs to be accessible from outside, other parts (admin stuff) needs to be locked down to only two networks...

Is it apache2 ?