Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a hosted linux server with public IP address. I would like to configure it as a VPN server. Then I would like to hide all of its services behind this VPN, so that if I open a socket then by default it is accessible through VPN and not accessible via Internet.

Is it possible?

share|improve this question
up vote 1 down vote accepted

Iptables is helpfull !

for example, with an openvpn run on eth0 interface, with 1194 tcp port and your vpn interface is "tun0"

#Flush you input tables
iptables -F INPUT

#Allow connection to openvpn
iptables -i eth0 -p tcp --dport 1194 -j ACCEPT

#Allow connction through you vpn interface

iptables -i tun0 -j ACCEPT

# set you default INPUT policy to DROP
iptables -P INPUT DROP

So, you can set your filter (rules 3) with you vpn adresses, or an other vpn interface (ipsec0, gre, tap etc..)

share|improve this answer
Thank you - I will test it in a few days – agsamek Aug 26 '09 at 8:01

Attach the services to the interface/ip of the VPN. To make ssh only listen to the VPN-ip change the "sshd_config":


Same with apache and so on..

You could also firewall the public ip and only allow on the VPN.

share|improve this answer
Thank you for your answer. I wouldn't like to modify all services, since they are started by different people. Could you write an example of how can I firewall the public IP while allowing all ports on VPN? – agsamek Aug 25 '09 at 14:23
gayell's iptables "stub" looks good enough.. :) – rkthkr Aug 25 '09 at 14:36

Of course, just set up iptables rules appropriately.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.