I am trying to restrict access to certain apache sites on my VPN server to only users that are connected to the VPN. I can connect to the VPN just fine, and I can route all traffic over the VPN. When I go to http://whatismyip.com I see the IP address of my VPN server (which is good). When I look at the apache access logs though, instead of seeing my VPN-given IP address, I see my ISP's IP address (as in the IP address from http://whatismyip.com when not connected to the VPN). Where should I be looking? What info can I provide to have someone be able to help? Thanks, John

This probably should get moved to the Configuration sub-forum...

Do you whant some users to to not access some sites on internet thru VPN tunnel, or some pages on same sarver where apache is installed? "apache sites" are ambiguos.

[quote]I am trying to restrict access to certain apache sites on my VPN server to only users that are connected to the VPN. I can connect to the VPN just fine, and I can route all traffic over the VPN.[/quote] so the apache servers are running on the same box as the VPN server right? when an OpenVPN client connects a special route is set up directly to the OpenVPN server itself; this route is needed for the encrypted tunnel traffic to go the the OpenVPN server directly , i.e. outside of the tunnel. If this route was not there then all encrypted tunnel traffic would flow via the VPN tunnel, which means it gets encrypted again, and is then fed back into the tunnel etc - the classic 'biting your own tail' problem. The result of this is that when you're connected to VPN server A.B.C.D and you then browse to website http://A.B.C.D is that this traffic is NOT sent over the VPN. In order to view the site via the VPN tunnel you must use http://VPN-SERVER-IP If you cannot set this up for your websites then you have a serious problem. If you can set this up, then bind apache to the VPN server IP instead of to the public IP of the server.

1.) I am talking about restricting access to certain pages on the same server (apache and openvpn are on the same box). For example, I have squirrelmail installed and want only users that are connected to VPN to be able to view that. 2.) Regarding this... What do you mean, exactly? [quote]The result of this is that when you're connected to VPN server A.B.C.D and you then browse to website http://A.B.C.D is that this traffic is NOT sent over the VPN. In order to view the site via the VPN tunnel you must use http://VPN-SERVER-IP[/quote] So if I understand you, if I have server: mydomain.com with an public IP address of X.X.X.X, then if I use the IP address in my browser, that traffic is not sent over the VPN (even if I am using redirect-gateway def1)? In other words, I MUST use the IP address of the site? [quote]If you cannot set this up for your websites then you have a serious problem. If you can set this up, then bind apache to the VPN server IP instead of to the public IP of the server.[/quote] What do you mean? How could I bind apache to the VPN server IP rather than the public IP? And could I have it set so that some apache sites on that server are accessible to everyone and some are restricted only to users connected to VPN?

[quote]So if I understand you, if I have server: mydomain.com with an public IP address of X.X.X.X, then if I use the IP address in my browser, that traffic is not sent over the VPN (even if I am using redirect-gateway def1)?[/quote] Yes. On every client a route to public IP of VPN server is added with mask 255.255.255.255 to external interface of client, in order not to lose connection with the VPN server itself. So every user will access apache service on your VPN server thru internet, not the tunnel, if client is using public IP. But this may be resolved like this: In the OpenVPN server config use "client-connect" option to call a script, that will write to some file, for example "users_ip_deny", the public ip of the client from enviromental variable "trusted_ip" and VPN ip of the client from environment variable "ifconfig_pool_remote_ip" based on common name taken from environmental variable "common_name". Apache will have to use this file to determine from what IP some client accesses the web server and allow or deny access to pages. Also, use "client-dissconect", to remove the unneeded ips from that file, specified by environmental variable like in previous paragraph. This way you will limit users that will access apache service not only by typing your servers public IP, but also by typing servers VPN IP.

[code]So if I understand you, if I have server: mydomain.com with an public IP address of X.X.X.X, then if I use the IP address in my browser, that traffic is not sent over the VPN (even if I am using redirect-gateway def1)?[/code] if the VPN server and the web server are both running on X.X.X.X , then yes [quote]In other words, I MUST use the IP address of the site?[/quote] no that is not required, but in general a domain name resolves to the same address, regardless of whether a VPN is used or not. This may the solution, BTW: [list]set up domain server on the VPN box for the VPN clients which resolves mydomain.com to the VPN IP address push out this DNS domain server to the VPN clients when a VPN client connects the address resolves to the VPN server IP and the connection flows via the VPN tunnel[/list] [quote]What do you mean? How could I bind apache to the VPN server IP rather than the public IP? And could I have it set so that some apache sites on that server are accessible to everyone and some are restricted only to users connected to VPN?[/quote] you can bind apache to as many IPs as you like, for different websites (read up on 'VirtualHost').

I want to thank you guys for this... it has helped me understand the issues and gotten me to get google to give me some more answers. If I set my Windows 7 hosts file to have: 10.8.0.1 mail.mydomain.com I am able to connect to webmail when connected to VPN. However if I remove that line, I cannot. So I must be missing something, the question is what... I installed dnsmasq. Config files: /etc/openvpn/server.conf: push "dhcp-option DNS 10.8.0.1" /etc/dnsmasq.conf server=/mydomain.com/10.8.0.1 listen-address=127.0.0.1,10.8.0.1 bind-interfaces /etc/resolv.conf domain mydomain.com search mydomain.com nameserver 127.0.0.1 nameserver 10.8.0.1 nameserver nameserver

after openvpn connects, do a [code]net stop dnscache net start dnscache[/code] then type [code]nslookup mail.mydomain.com[/code] if it then resolves correctly then you're running into a DNS caching issue (which is Windows specific). The solution for this is to add [code]register-dns[/code] to the client configuration. If not, then the problem lies elsewhere.

OK - did all that... nslookup mail.mydomain.com DNS request timed out. timeout was 2 seconds. Server: UnKnown Address: 10.8.0.1 DNS request timed out. timeout was 2 seconds. DNS request timed out. timeout was 2 seconds. DNS request timed out. timeout was 2 seconds. DNS request timed out. timeout was 2 seconds. *** Request to UnKnown timed-out So, I'll track this down. Another related question to a post up there... if I restrict access to 10.8. in my apache config, does that mean that if a person is connected to a different VPN and has an IP address of 10.8.0.x, that they would be able to connect to the page? If so, is there a way to restrict to only _my server's_ vpn?

what do you mean "a different VPN" ? the 10.x/8 address range is private and will not be routed by any internet provider - so if your server is receiving packets with source address 10.8.0.x then you can be certain that the packets are coming from *your* VPN - or you have a completely screwed internet provider.

VPN Client IP not showing up in server logs...

john_es

Mimiko wroteshow the result of "iptables -L -n" and "iptables -L -n -t nat"

Right, and when I load that, I see nothing regarding DNS/port 53... what commands do I want to add, so that the port is open only to vpn clients, (rather than the entire world)?

Mimiko

iptables -A INPUT -i tun+ --destination-port 53 -j ACCEPT

john_es

Mimiko wrote

iptables -A INPUT -i tun+ idport 53 -j ACCEPT

Thanks!

Tried that, and got:

iptables -A INPUT -i tun+ idport 53 -j ACCEPT
Bad argument `idport'
Try `iptables -h' or 'iptables --help' for more information.

iptables -A INPUT -i tun+ --dport 53 -j ACCEPT
iptables v1.4.4: unknown option `--dport'
Try `iptables -h' or 'iptables --help' for more information.

I am guessing there is a typo - but not sure where - I've sen differing version of this line on google and can't figure it out...

Mimiko

I've corrected the command. Try it. And you didn't show the iptable list.

john_es

I tried the latest command:

iptables -A INPUT -i tun+ --destination-port 53 -j ACCEPT

But am getting:

iptables v1.4.4: unknown option `--destination-port'

Will do some research and get this to work and post back with my results...

john_es

john_es wroteI tried the latest command:

iptables -A INPUT -i tun+ --destination-port 53 -j ACCEPT
But am getting:
iptables v1.4.4: unknown option `--destination-port'
Will do some research and get this to work and post back with my results...

Looks like I am missing the -p tag. Do I want to be opening up UDP and TCP or just UDP?

Mimiko

Oh, its a must to indicate the protocol:

iptables -A INPUT -i tun+ -p tcp --dport 53 -j ACCEPT
or
iptables -A INPUT -i tun+ -p tcp --destination-port 53 -j ACCEPT

john_es

I think we are getting somewhere... I ran that, and then tried again, with the same error messgae.

My syslog is showing:

 iptables denied: IN=tun0 OUT= MAC= SRC=PRIVATEIPOFCLIENT DST=10.8.0.1 LEN=75 TOS=0x00 PREC=0x00 TTL=128 ID=3343 PROTO=UDP SPT=57440 DPT=53 LEN=55

iptables -L -v

4926K 2605M ACCEPT     all  --  lo     any     anywhere             anywhere
    0     0 REJECT     all  --  !lo    any     anywhere             127.0.0.0/8         reject-with icmp-port-unreachable
2753K 2837M ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED
 1856 94989 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:smtp
  104  5408 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:pop3
    2   104 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:submission
  687 40440 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:pop3s
  116  6280 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:http-alt
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:imap2
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:imaps
  521 30240 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:www
 1423 78465 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:https
   19  1330 ACCEPT     udp  --  any    any     anywhere             anywhere            udp dpt:openvpn
   49  2548 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:xmpp-client
   98  4952 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:9091
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:20000
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:webmin
   61  3364 ACCEPT     tcp  --  any    any     anywhere             anywhere            state NEW tcp dpt:ssh
  232 10304 ACCEPT     icmp --  any    any     anywhere             anywhere            icmp echo-request
28875 4060K LOG        all  --  any    any     anywhere             anywhere            limit: avg 5/min burst 5 LOG level debug prefix `iptables denied: '
92623   16M REJECT     all  --  any    any     anywhere             anywhere            reject-with icmp-port-unreachable
    0     0 ACCEPT     tcp  --  tun+   any     anywhere             anywhere            tcp dpt:domain
    0     0 ACCEPT     udp  --  tun+   any     anywhere             anywhere            udp dpt:domain
    0     0 ACCEPT     tcp  --  tun0   any     anywhere             anywhere            tcp dpt:domain
    0     0 ACCEPT     udp  --  tun0   any     anywhere             anywhere            udp dpt:domain

Mimiko

0 0 REJECT all -- !lo any anywhere 127.0.0.0/8 reject-with icmp-port-unreachable

This rule in line 2 regects all packets for everithyng not from local computer. You have to remove it, and add a rule for TCP,UDP 53.

john_es

Mimiko wrote
0 0 REJECT all -- !lo any anywhere 127.0.0.0/8 reject-with icmp-port-unreachable
This rule in line 2 regects all packets for everithyng not from local computer. You have to remove it, and add a rule for TCP,UDP 53.

Thanks Mimiko - since these were default rules in my setup, what are the security drawbacks of removing that line? Can I update it and put a line in above it to specifically allow traffice from my vpn subnet and then just leave this line in there?

Mimiko

Move that line to the bottom of the ruleset. In other words: add a rule to allow incoming connection to port 1194 and to allow all traffic to and from tun adapter. The other rules are out of scope for OpenVPN.

« Previous Page