Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My setup is as follows:

eth0      Link encap:Ethernet
          inet addr:XXX.XXX.XXX.XXX
eth1      Link encap:Ethernet
          inet addr:
lo        Link encap:Local Loopback
tun0      inet addr:

I would like to set my webmail to be accessible only when connecting via VPN. Currently, the VirtualHost directive is *:443. I assume I want to replace the * with the eth1 address.

But do I also have to set an iptables route? If so, what/how?

share|improve this question
up vote 0 down vote accepted

On the OpenVPN server, add a below line:

push "route web.mail.ip.address"

In virtual host section, you can restrict access based on IP address, something like this:

<Directory "/your/virtual/host/directory">
    Order allow,deny
    Allow from vpn.server.ip.address
    ErrorDocument 403
share|improve this answer
I added : push "route web.mail.ip.address" with web.mail.ip.address as the external IP address of the server. For the "vpn.server.ip.address", I have tried, the external address, and the VPN subnet, but I always get sent to the ErrorDocument. What should I be using for this value? – John Sep 19 '11 at 4:35
Looking at the logs, it says: "[client X.X.X.X] client denied by server configuration:" where the IP address there is the public IP address of my laptop's connection. Even though I am VPN'd in ( shows an IP of the server, and I am connected to the VPN server). – John Sep 19 '11 at 4:48
Check your routing table route -n. Make sure that you have a static route to web mail via tun0 interface. – quanta Sep 19 '11 at 4:56
Destination Gateway Genmask Flags Metric Ref Use Iface UH 0 0 0 tun0 – John Sep 19 '11 at 13:18
So there seems to be something wrong with the way I created the route. – John Sep 19 '11 at 13:19
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface UH    0      0        0 tun0   UG    0      0        0 tun0   U     0      0        0 eth1

The webmail's IP address is the same as my server, let's say X.X.X.X.

The VPN server is on the same machine, and has a config file that has:


When I added: push "route X.X.X.X"

I couldn't get to the webmail address.

The weird thing is that even when I was connected to the VPN, and my IP address from showed my server's IP address, the webmail logs showed that I was trying to connect from my ISP's IP address.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.