Firewall rules for OpenVPN Access server

MariusE

Hello,

My VPN setup is working just fine but I'm experiencing an issue : how can I make the web client accessible through the VPN only ? I don't want anybody bruteforcing my Admin UI. I checked the default firewall but I don't seem to be able to allow connection on port 943 only from the VPN's ip range.

That could also help me putting several services through the VPN : chat , file sharing ..

I was wondering how to proceed on allowing access to certain ports from certain ip's.

Thanks.
Marius

The Johan

Regarding bruteforcing, there's an automatic lockout in place. You should check this security recommendations page first though:
https://openvpn.net/vpn-server-resources/recommendations-to-improve-security-after-installation/

And to allow access only through VPN you can disable service forwarding for the admin web service and bind it to an internal only IP address. You'd need an interface on your Access Server that has such a private IP. You can a dummy adapter if you don't have it.

MariusE

Hi,

Would you suggest installing my applications on the same server ? Because I will need to have other applications routed through the VPN.
Should I just use a dedicated server for OpenVPN and an other one as client for my applications ? Should I try to mess with the firewall?

Thanks for your reply.

Marius

The Johan

I would suggest separating roles, so have a separate server for Access Server, and a separate server for your other applications.

The Johan

Oh and those can be virtual servers of course, otherwise things would get needlessly expensive for no good reason.