0

I am probably unnecessarily paranoid. But still also I think paranoid isn't too bad when it comes to security.

I have a web server running on a VPS. I run zerotier on all my VPS and my home machines. I then use Letsencrypt to run a https webserver.

Therefore, I have a DNS entry pointing to my webserver with the zerotier VPS address: myzerotier_webserver.mydomain.com 172.29.70.241.

Now, I'd like to restrict access to my webserver to only participants in the zerotier network.

I tried this:

        listen 127.0.0.1:443 ssl http2;
        listen 172.29.0.0:443 ssl http2;

But this doesn't seem to work accessing this server from my connected home laptop entering myzerotier_webserver.mydomain.com in the browser.

I also tried by replacing 172.29.0.0 with the actual IP address of the VPS, e.g. 172.29.70.241.

But it also didn't work.

Is this actually doable in some way? Should I do it differently maybe? Maybe it should work so the issue is some other configuration I got wrong?

Improve this question
2
  • Which webserver you are using? Nginx will get it's listeners from the line listen <ip>:<port>. If this doesn't work as expected, a line from the access log would be helpful.
    – bjoster
    Jan 18 at 10:41
  • 1
    I now know why this wasn't working: I was running nginx in a docker container, and the client IP was appearing as yet another network via docker compose: 192.168.80.1. Which means even the accepted solution actually doesn't work. In order to make it work, I had to extract nginx to run on the host, not in a container. Now I can filter by VPN address AND I can use multiple server instances of nginx listening to the same ports without interfering.
    – transient_loop
    Jan 18 at 15:02

2 Answers 2

Reset to default
1

If you are using UFW, you can just simply allow port access only for specific ranges. Here is an example:

ufw allow from 172.29.70.0/24 to any port 443 proto tcp comment "HTTPS only zerotier"

Change 172.29.70.0/24 to appropriate range.

Also don't forget to make default traffic rules:

ufw default allow outgoing

ufw default deny incoming

And enable UFW:

ufw enable && ufw reload

Improve this answer
1
  • if you are accessing your server through ssh, don't forget to allow it's port: ufw allow from any to any port 22 proto tcp comment SSH. Execute this command BEFORE enabling UFW
    – NukDokPlex
    Jan 16 at 21:28
1

There is also an option to make it through NGINX configs, here it is:

location / {
  allow 45.43.23.0/24; # Change this to appropriate range
  deny all;
}
Improve this answer
1
  • I like both suggestions, but prefer the ufw approach as I am personally likely to keep an eye on those rather more often. Thank you!
    – transient_loop
    Jan 16 at 22:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.