I am probably unnecessarily paranoid. But still also I think paranoid isn't too bad when it comes to security.

I have a web server running on a VPS. I run zerotier on all my VPS and my home machines. I then use Letsencrypt to run a https webserver.

Therefore, I have a DNS entry pointing to my webserver with the zerotier VPS address: myzerotier_webserver.mydomain.com

Now, I'd like to restrict access to my webserver to only participants in the zerotier network.

I tried this:

        listen ssl http2;
        listen ssl http2;

But this doesn't seem to work accessing this server from my connected home laptop entering myzerotier_webserver.mydomain.com in the browser.

I also tried by replacing with the actual IP address of the VPS, e.g.

But it also didn't work.

Is this actually doable in some way? Should I do it differently maybe? Maybe it should work so the issue is some other configuration I got wrong?

  • Which webserver you are using? Nginx will get it's listeners from the line listen <ip>:<port>. If this doesn't work as expected, a line from the access log would be helpful.
    – bjoster
    Jan 18 at 10:41
  • 1
    I now know why this wasn't working: I was running nginx in a docker container, and the client IP was appearing as yet another network via docker compose: Which means even the accepted solution actually doesn't work. In order to make it work, I had to extract nginx to run on the host, not in a container. Now I can filter by VPN address AND I can use multiple server instances of nginx listening to the same ports without interfering. Jan 18 at 15:02

2 Answers 2


If you are using UFW, you can just simply allow port access only for specific ranges. Here is an example:

ufw allow from to any port 443 proto tcp comment "HTTPS only zerotier"

Change to appropriate range.

Also don't forget to make default traffic rules:

ufw default allow outgoing

ufw default deny incoming

And enable UFW:

ufw enable && ufw reload

  • if you are accessing your server through ssh, don't forget to allow it's port: ufw allow from any to any port 22 proto tcp comment SSH. Execute this command BEFORE enabling UFW
    – NukDokPlex
    Jan 16 at 21:28

There is also an option to make it through NGINX configs, here it is:

location / {
  allow; # Change this to appropriate range
  deny all;
  • I like both suggestions, but prefer the ufw approach as I am personally likely to keep an eye on those rather more often. Thank you! Jan 16 at 22:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.