Allow incoming traffic only to a specific public IP

Question

I have a Debian VPS with 2 public IP addresses, 90.90.90.90 and 90.90.90.100.

What I'd like to do is to make the server to accept incoming traffic only to the other public IP.

Example:

I have an OpenVPN server running on the server. When I make a VPN connection to 90.90.90.90, the public IP will be 90.90.90.100. (This is the current situation)

I don't want the OpenVPN ports to be open for 90.90.90.100, only for the other IP I use when connecting to the server.

Is this possible using iptables or some other method?

Thanks!

Answer 1

If I understand where you're going with this, you want VPN connections made to IP #1 to masquerade their outgoing connections as IP #2 and VPN connections made to IP #2 to masquerade their outgoing connections as IP #1.

For the sake of this answer, we'll call 90.90.90.90 IP #1 and 90.90.90.100 IP #2

The easiest way to do this is to run 2 openvpn servers. Set up each with a different private subnet range, for example, incoming connections on IP #1 will receive addresses in the range 10.0.1.0/24, and incoming connections on IP #2 will receive addesses in the range 10.0.2.0/24.

The configuration files will mostly be the same as the original configuration except for three lines, the first configuration will have the following:

local 90.90.90.90
server 10.0.1.0 255.255.255.0
push "route 10.0.1.0 255.255.255.0"

While the second will have this instead:

local 90.90.90.100
server 10.0.2.0 255.255.255.0
push "route 10.0.2.0 255.255.255.0"

Restart the openvpn service to make sure both config files are activated.

Then, to make sure the connections get the correct external IP address when leaving your VPN server, you can use the following iptables rules. Replace eth0 with the actual interface name.

iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -o eth0 -j SNAT --to 90.90.90.100
iptables -t nat -A POSTROUTING -s 10.0.2.0/24 -o eth0 -j SNAT --to 90.90.90.90

Now the vpn connections come in on one IP and go out pretending to be the other. This may be more complicated than need be, specifically there's no reason to run two vpn servers, in which case, just remove one of the configs and use the remaining config exclusively.