I'm having some problems accessing my Apache2 intranet site when connected to my network's VPN server.

My setup/environment:

  • ASUS RT-66U router with PPTP VPN server.
  • Debian server with apache 2.2 as "intranet server".
  • LAN addresses are in the network.

The intranet site on the Apache2 server is configured so that only the LAN addresses have access (as below):

Order deny,allow
Deny from all

Allow from localhost

# IPv4
Allow from       # IPv4 Loopback Addresses
Allow from    # IPv4 Link-local Addresses
Allow from        # IPv4 Normal LAN Address Space

My ASUS RT-660U router is setup with a built-in PPTP VPN server, and I'm connecting to it with the Windows 7 built-in VPN client.

The VPN connection works fine with regards to the LAN; I can access network shares, SSH to the Linux/Apache2 server, and access the router's web interface at So far, so good.

However, I cannot access the intranet virtual site on the Apache2 server. I can access this when connected to the LAN, and from the outside I get the 403 Forbidden message. So basically it works as it should.

But when I connect to the VPN and try to open the intranet site, I still get the 403 Forbidden message. This is, as mentioned, while having no problems accessing other LAN resources.

When I'm connected to the VPN, from my mobile network, this is Windows ipconfig info:

PPP adapter AEV25 VPN:

Connection-specific DNS Suffix  . : 
IPv4 Address. . . . . . . . . . . :
Subnet Mask . . . . . . . . . . . :
Default Gateway . . . . . . . . . :

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix  . : 
Link-local IPv6 Address . . . . . : fe80::ccb5:407b:3314:5a66%12
IPv4 Address. . . . . . . . . . . :
Subnet Mask . . . . . . . . . . . :
Default Gateway . . . . . . . . . :

The Windows 7 PC is connected to my Android phone's network (hotspot), then connected to the VPN.

From my basic understanding of networking, it seems that Apache2 uses the address of the Wireless LAN, which is connected to the "outside" through my mobile phone, and not the PPTP adapter address, which is the LAN address.

So, how can I get Apache2 to recognize the "correct" adapter/address, so that I can access the internal site via the VPN connection?


What is the output of your /var/log/apache2/error.log and /var/log/apache2/access.log? That should provide some clues as to why it's being denied, and specifically, the client IP.

If you're using the wrong route to the server, make sure that you're giving the clients the right route. You should be sending them through the VPN gateway when they try to access the Intranet network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.