0

I'm currently running sniproxy and https server. If user is known (IP is known) iptables just allows connection to sniproxy which redirects user to desired website or local https server (127.0.0.1 4433). If IP isn't authorized to use sniproxy iptables redirects traffic straight to local https server.

I wanna have access to openVPN server from all IPs, many of location where I use internet have only 80 and 443 unblocked. If I configure openVPN to listen on TCP/443 and port-share https traffic to sniproxy I end with open access to sniproxy which I don't want.

I'm thinking about conditional port-share in openVPN - if ip is on the list it's redirected to sniproxy (127.0.0.1 44333), if not it's redirected to https server (127.0.0.1 4433). I looked through openVPN manual and unfortunately find nothing like this.

Is it any way to overcome this?

0

AFAIK, you should be able to use the local OpenVPN instance as a fallback in sniproxy. You can setup two sniproxy listen blocks and both of them can use OpenVPN as a fallback.

If you do not want to use OpenVPN as a fallback, you might use sslh to multiplex OpenvPN and TLS over the same port (using a single ):

  • iptables -> sniproxy -> HTTP servers;
  • iptables -> sniproxy -> sslh -> local HTTPS server;
  • iptables -> sniproxy -> sslh -> OpenVPN;
  • iptables -> sslh -> local HTTP server;
  • iptables -> sslh -> OpenVPN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.