Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server running PPTP that is supposed to run an httpd (nginx) accessible only through the VPN. I'm also running a few other httpds too, which are not supposed to work on the VPN.

routing table

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         x.x.x.x         UG    0      0        0 bond0
x.x.x.x         x.x.x.x UGH   0      0        0 bond0
x.x.x.x UH    0      0        0 ppp0
x.x.x.x U     0      0        0 bond0
x.x.x.x     U     1008   0        0 bond0

when I ping (that should work with VPN)

PING (x.x.x.x) 56(84) bytes of data.
--- ping statistics ---
32 packets transmitted, 0 received, 100% packet loss, time 31248ms

but I can see the packets in tcpdump -vv -i ppp0

15:21:09.543764 IP (tos 0x0, ttl 52, id 37313, offset 0, flags [DF], proto ICMP (1), length 84) > ICMP echo request, id 4652, seq 8, length 64
share|improve this question

migrated from Dec 12 '13 at 4:35

This question came from our site for computer enthusiasts and power users.

You could probably configure that particular nginx instance to only listen on the PPTP interface.

The documentation for the http_core module specifies a listen directive to allow nginx to only listen on a certain address and/or port.

listen <IP of VPN>:<port> on the instance of nginx that should work on the vpn should be ok

share|improve this answer
vpn ip is always changing it's not static. but the problem is I can't even ping to the vpn ip from the internet that's why I think I should change the nat first, before I start with nginx. – Orlo Dec 10 '13 at 12:59
You can use hostnames too for the listen directive. Also some providers will block pings from reaching their endpoints, so pings aren't an effective diagnostic tool anymore :( – Lawrence Dec 10 '13 at 13:00
so I can set listen ppp0:<port>? – Orlo Dec 10 '13 at 13:04
Not quite. You could do listen Hostnames and IP addresses, not interfaces for nginx. – Lawrence Dec 10 '13 at 13:04
Tried listen but it's not workings. though I can see the requests from tcpdump -vv -i ppp0 which is a good sign – Orlo Dec 10 '13 at 13:19

The simplest way to do It -- run the server on dedicated port and reject requests from interfaces other then ppp for this port:

iptables -A INPUT -i ! ppp+ -p tcp --dport <protected-port> -j REJECT

The main drawback of the above approach - your server may still become accidentally open.

If you are looking for stable and reliable solution for protected special-purpose server staff then I recommend the following way:

Choose any free dedicated private address, say

Setup internal virtual tap interface using this address.

# cat > ifcfg-tap0

Optionally disable proxy-arp in /etc/sysctl.conf if not needed:


Choose dedicated port to run your http server on, say 8888.

Bind your server to dedicated ip/port:


Restrict access to (locally or from VPN only):

-I INPUT -p ip -s -j ACCEPT
-I INPUT -i ! ppp+ -p ip -d -j REJECT

The major work has been done. All applications bound exclusively to are accessible only internally or using VPN.

But now you need to care about routing to on client side. You can avoid It and make your http server accessible trough VPN with any IP address you are generally using to access the host:

iptables -t nat -A PREROUTING -i ppp+ -p tcp --dport 8888 -d <normal_server_address> -j DNAT --to
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.