Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My setup is as follows:

eth0      Link encap:Ethernet
          inet addr:XXX.XXX.XXX.XXX
eth1      Link encap:Ethernet
          inet addr:10.10.20.20
lo        Link encap:Local Loopback
tun0      inet addr:10.8.0.1

I would like to set my webmail to be accessible only when connecting via VPN. Currently, the VirtualHost directive is *:443. I assume I want to replace the * with the eth1 address.

But do I also have to set an iptables route? If so, what/how?

share|improve this question

2 Answers 2

up vote 0 down vote accepted

On the OpenVPN server, add a below line:

push "route web.mail.ip.address"

In virtual host section, you can restrict access based on IP address, something like this:

<Directory "/your/virtual/host/directory">
    Order allow,deny
    Allow from vpn.server.ip.address
    ErrorDocument 403 http://google.com
</Directory>
share|improve this answer
    
I added : push "route web.mail.ip.address" with web.mail.ip.address as the external IP address of the server. For the "vpn.server.ip.address", I have tried 127.0.0.1, the external address, and the VPN subnet, but I always get sent to the ErrorDocument. What should I be using for this value? –  John Sep 19 '11 at 4:35
    
Looking at the logs, it says: "[client X.X.X.X] client denied by server configuration:" where the IP address there is the public IP address of my laptop's connection. Even though I am VPN'd in (whatusmyip.com shows an IP of the server, and I am connected to the VPN server). –  John Sep 19 '11 at 4:48
    
Check your routing table route -n. Make sure that you have a static route to web mail via tun0 interface. –  quanta Sep 19 '11 at 4:56
    
Destination Gateway Genmask Flags Metric Ref Use Iface 10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 –  John Sep 19 '11 at 13:18
    
So there seems to be something wrong with the way I created the route. –  John Sep 19 '11 at 13:19
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.180.160.0    0.0.0.0         255.255.224.0   U     0      0        0 eth1

The webmail's IP address is the same as my server, let's say X.X.X.X.

The VPN server is on the same machine, and has a config file that has:

server 10.8.0.0 255.255.255.0

When I added: push "route X.X.X.X"

I couldn't get to the webmail address.

The weird thing is that even when I was connected to the VPN, and my IP address from http://www.whatismyip.com showed my server's IP address, the webmail logs showed that I was trying to connect from my ISP's IP address.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.