I'm running an OpenVPN network and one of the VPN clients in my network is a web server which provides access to some internal services used by my application.

Normally, on a public facing web server I would open port 80 with iptables like this:

-A INPUT -p tcp --dport 80 -j ACCEPT

However, doing this for my internal web server, this will expose port 80 on the private IP (192.168.x.x) which is what I do not want since it would potentially allow other VM's on the same network (which aren't necessarily controlled by me) access to this machine.

How do I set the iptables rule in such a way that port 80 is only accessible through the VPN IP (10.8.x.x) so that only VPN client in my network can access it?

iptables -A INPUT -p tcp -s -d 192.168.X.X --dport 80 -j ACCEPT

Should do the trick... unless you are nat-ing first.

You could even add a -i tun0 or something, to limit on the interface name.

| improve this answer | |
  • I've used the -i tun0, which seems to work great! – Luke Jan 13 '15 at 22:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.