5

I have just finished setting up a OpenVPN server running on Ubuntu 12.04 and I have been able to connect to it from my own computer (the client).

I am able to set up the VPN server to route ALL traffic via the VPN with the push "redirect-gateway def1" directive. When I then check my IP it is not showing my real IP, but the VPN IP.

I am also able to restrict SOME traffic to go via the VPN. ie: all my traffic goes via my normal internet connection, and traffic to a server I wanted (46.XX.XX.XX) goes via the VPN. I achieve this with the push "route 46.XX.XX.XX 255.255.255.255" directive. This works fine: google is showing me my real ip address, and when I tail the nginx access logs on my 46.XX.XX.XX server I can see the traffic is coming from the VPN.

That all works fine and I am happy with that, but on my VPN server I am also hosting a few other websites with Nginx. If I tail the access log on those sites, it is showing my real IP address, so the traffic to the VPN server itself is not going through the VPN (even if I do the 'direct ALL traffic via VPN directive).

Reading about it, I understand that this is something normal, since the traffic that goes to the VPN server itself does not get a chance to be rerouted via the VPN. What I can't find anywhere, is some information on how to set up the VPN server configuration so that I can access the website hosted on my VPN server itself, via the VPN.

My Iptables has only one rule:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

My ultimate goal is to be able to have the traffic going to the VPN server itself via the VPN, and then I will be able to restrict access to my website (via allow/deny rules) so that it can only be accessed by people connected to the VPN).

Is this something that can be achieved with more iptables rules? or a different push route directive?

Improve this question
5
  • Have you tried to use the internal VPN IP address to access the VPN server, not the public IP?
    – pincoded
    Nov 1, 2014 at 19:37
  • Which addresses did you try (vpn/internal/external) to reach for the webserver?
    – unNamed
    Dec 15, 2020 at 13:11
  • I've asked this Q in 2014 so can't remember much of how I actually did it, but in the end I created another network interface on the server with its own public IP and pointed those websites to the new IP. That way when I tried accessing the sites via the VPN it was actually routing the traffic outside of the server and back into it via the new IP/interface and thus seeing my original VPN IP in the access logs. It might not be the best way to do it but it worked well for what we needed at the time.
    – Titi
    Dec 17, 2020 at 13:51
  • @Titi: Do you mean you had to get a second public IP from your ISP?
    – user541686
    Feb 26 at 15:26
  • The server is hosted on AWS so it just has an extra network interface attached to it with its own public elastic IP.
    – Titi
    Feb 26 at 20:13

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.