2

I am wondering if it is possible to redirect requests through Apache to eg. OpenVPN.
As long as I need to bypass firewall, I need to use port 80/443 for openVPN, but there is Apache server which has both port for itself.

Client ---> Firewall (allows 80/443 only) --->| ---> Apache (80/443) ---> OpenVPN (1194) |
                                              --------------------------------------------
                                                           My Server

I was thinking about mod_proxy, but I am not sure if it is good idea, have you got any ideas?
I hope possible solution will be applicable on virtual host as well.

Improve this question
6
  • You need the client to connect to "My Server" for which service ? If it is HTTP/HTTPS you can use mod_proxy or re-write rule. Just have in mind that: or you do some NAT or you need to point the DFGW to the VPN server cause there will be asynchronous routing. Regards.
    – voodooo
    Jan 21, 2011 at 13:26
  • @voodoo: I want to be able to have running apache on default ports (80.443) and running VPN Server (TCP) as well. Something like sslh ...
    – Ency
    Jan 21, 2011 at 16:54
  • Why cant you open other tcp port at the firewall ? In this scenario you cant use mod_proxy nor rewrite rules. You need something listening on port 443 that can distinguish the https traffic and forward to apache and forward the rest to openvpn server.
    – voodooo
    Jan 21, 2011 at 17:24
  • @voodoo: Because I cannot access firewall, it is not FW on "My server"'s side. Do you know any program which can separate Web traffic and the rest? Or maybe some apache module ...
    – Ency
    Jan 21, 2011 at 17:26
  • Client ---> Firewall (allows 80/443 only) to Client ---> Firewall (allows 80/443/444 only) isn't this possible ? Noup, don't know such program..
    – voodooo
    Jan 21, 2011 at 17:31

5 Answers 5

Reset to default
2

I used sslh. It works just great.

Improve this answer
1
  • I second to this. Using sslh is a breeze, and allow you to put vital services in the same port (ssh, https and vpn).
    – ThoriumBR
    Oct 17, 2016 at 18:54
2

The issue - sharing ports - could be solved in the opposite direction, by making Apache listen on port, say, 10443 and forwarding requests from OpenVPN there with the port-share option. (via)

port 443
port-share localhost 10443
Improve this answer
1
  • I think this should be the preferred solution over sslh. Perhaps it was the only thing available at the time.
    – Erik
    Oct 25, 2019 at 0:26
0

You can not use the same port for multiple services. So, you can keep apache running on one port 80 or 443 but not both. The other port can be used to forward requests to the openvpn server.

You can try port forwarding using SSH. Have a look at this link. You can forward the port 80 on the server to openVPN port. Of course, you need to change the port used by the openvpn client.

Improve this answer
1
  • Well, I know I cant use one port for more apps, but on my webserver are used both protocols (HTTP, HTTPS). That is why I'm looking for something like apache proxy, mod_proxy seems good, but I do not think it is able to handle different protocol than http(s)/ftp. Tunnelling through SSH is not solution for me.
    – Ency
    Jan 21, 2011 at 12:08
0

The simplest solution would be to get a second ip on the server and have OpenVPN listen to port 443 on that ip.

Don't forget, mod_proxy is for HTTP and HTTPS requests, and OpenVPN doesn't support either protocol as a transport.

Corkscrew will allow you to tunnel SSH over an SSL proxy. It could be used in conjunction with the SSH port forwarding that Khaled mentioned if getting an extra ip isn't an option.

Improve this answer
1
  • I cannot get second IP, tunneling over ssh is user-unfriendly, so good for me, but not for my sister :)
    – Ency
    Jan 21, 2011 at 12:58
0

The httptunnel package should help solve your problem. Source is available at ftp://ftp.gnu.org/pub/httptunnel

On the server:

  • run hts, redirected to openvpn (tcp) port.
  • hts -F openvpn-ip:1194 8888

You will need to set up a vhost with mod_proxy to port 8888

On the client:

  • run htc from an openvpn client
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.