0

I have a hosted linux server with public IP address. I would like to configure it as a VPN server. Then I would like to hide all of its services behind this VPN, so that if I open a socket then by default it is accessible through VPN and not accessible via Internet.

Is it possible?

3 Answers 3

1

Iptables is helpfull !

for example, with an openvpn run on eth0 interface, with 1194 tcp port and your vpn interface is "tun0"

#Flush you input tables
iptables -F INPUT

#Allow connection to openvpn
iptables -i eth0 -p tcp --dport 1194 -j ACCEPT

#Allow connction through you vpn interface

iptables -i tun0 -j ACCEPT

# set you default INPUT policy to DROP
iptables -P INPUT DROP

So, you can set your filter (rules 3) with you vpn adresses, or an other vpn interface (ipsec0, gre, tap etc..)

0
1

Attach the services to the interface/ip of the VPN. To make ssh only listen to the VPN-ip change the "sshd_config":

#Listen 0.0.0.0
Listen 10.62.63.1

Same with apache and so on..

You could also firewall the public ip and only allow on the VPN.

2
  • Thank you for your answer. I wouldn't like to modify all services, since they are started by different people. Could you write an example of how can I firewall the public IP while allowing all ports on VPN?
    – agsamek
    Aug 25, 2009 at 14:23
  • gayell's iptables "stub" looks good enough.. :)
    – rkthkr
    Aug 25, 2009 at 14:36
0

Of course, just set up iptables rules appropriately.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .