1

My setup is as follows:

eth0      Link encap:Ethernet
          inet addr:XXX.XXX.XXX.XXX
eth1      Link encap:Ethernet
          inet addr:10.10.20.20
lo        Link encap:Local Loopback
tun0      inet addr:10.8.0.1

I would like to set my webmail to be accessible only when connecting via VPN. Currently, the VirtualHost directive is *:443. I assume I want to replace the * with the eth1 address.

But do I also have to set an iptables route? If so, what/how?

2 Answers 2

0

On the OpenVPN server, add a below line:

push "route web.mail.ip.address"

In virtual host section, you can restrict access based on IP address, something like this:

<Directory "/your/virtual/host/directory">
    Order allow,deny
    Allow from vpn.server.ip.address
    ErrorDocument 403 http://google.com
</Directory>
6
  • I added : push "route web.mail.ip.address" with web.mail.ip.address as the external IP address of the server. For the "vpn.server.ip.address", I have tried 127.0.0.1, the external address, and the VPN subnet, but I always get sent to the ErrorDocument. What should I be using for this value?
    – John
    Sep 19, 2011 at 4:35
  • Looking at the logs, it says: "[client X.X.X.X] client denied by server configuration:" where the IP address there is the public IP address of my laptop's connection. Even though I am VPN'd in (whatusmyip.com shows an IP of the server, and I am connected to the VPN server).
    – John
    Sep 19, 2011 at 4:48
  • Check your routing table route -n. Make sure that you have a static route to web mail via tun0 interface.
    – quanta
    Sep 19, 2011 at 4:56
  • Destination Gateway Genmask Flags Metric Ref Use Iface 10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
    – John
    Sep 19, 2011 at 13:18
  • So there seems to be something wrong with the way I created the route.
    – John
    Sep 19, 2011 at 13:19
0
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.180.160.0    0.0.0.0         255.255.224.0   U     0      0        0 eth1

The webmail's IP address is the same as my server, let's say X.X.X.X.

The VPN server is on the same machine, and has a config file that has:

server 10.8.0.0 255.255.255.0

When I added: push "route X.X.X.X"

I couldn't get to the webmail address.

The weird thing is that even when I was connected to the VPN, and my IP address from http://www.whatismyip.com showed my server's IP address, the webmail logs showed that I was trying to connect from my ISP's IP address.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .