Spain
Portugal
Hide a VDS web server behind a VPN
There is a VDS server with CentOS 7, iptables, apache, ssh. There is a purchased VPN account with a dedicated ip. It is necessary that the VDS is automatically connected to the VPN. Apache should only work via VPN. SSH should only work over a real IP.
I installed OpenVPN on VDS; I filled in the config, certificates and the key from the VPN provider in /etc/openvpn. After connecting the VDS to the VPN, the server stops pinging, the web page does not open either on the real IP or on the dedicated VPN. I turned off Iptables, it didn't help.
Can you tell me what to do? I didn't find any articles on the Internet, maybe I didn't search correctly, but all the articles on the topic "how to raise your VPN server".
You send ssh communication to the interface with the "real" IP and wrap all the rest of the traffic into your VPN (you register the default route on the openvpn interface). At the second end, you write a rule for the 80th port and forward it to the vds connected to the VPN.
Still, the problem was with port forwarding on the VPN server side. Now the VDS connects to the VPN, the site opens. It remains to make ssh work directly.
The hoster recommended deleting the default route in the ovpn config, but then it is not clear how to forward the route for the WEB server via ovpn?
OpenVPN Config
client
remote 77.77.77.202 443
proto tcp
dhcp-option DNS 8.8.8.8
redirect-gateway def1
ca in_ca.crt
cert in_123.crt
key in_123.key
ns-cert-type server
dev tap
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 4
mute 20iptables configuration script
#!/bin/bash # # Declaring variables export IPT="iptables"
# The interface that looks at the Internet export WAN=eth0 export WAN_IP=40.30.20.198
# VPN connection interface export VPN=tap0 export VPN_IP=10.10.10.200
# Clearing all iptables chains $IPT -F $IPT -F -t nat $IPT -F -t mangle $IPT -X $IPT -t nat -X $IPT -t mangle -X
# Set default policies for traffic that does not comply with any of the rules $IPT -P INPUT DROP $IPT -P OUTPUT DROP $IPT -P FORWARD DROP
# allowing local traffic for loopback $IPT -A INPUT -i lo -j ACCEPT $IPT -A OUTPUT -o lo -j ACCEPT
# We allow outgoing connections from the server itself $IPT -A OUTPUT -o $WAN -j ACCEPT $IPT -A OUTPUT -o $VPN -j ACCEPT
# The ESTABLISHED status indicates that this is not the first packet in the connection. # Skip all already initiated connections, as well as their children $IPT -A INPUT -p all -m state --state ESTABLISHED,RELATED -j ACCEPT # Skip new, as well as already initiated and their child connections $IPT -A OUTPUT -p all -m state --state ESTABLISHED,RELATED -j ACCEPT # Allow forwarding for already initiated and their child connections $IPT -A FORWARD -p all -m state --state ESTABLISHED,RELATED -j ACCEPT
# Enabling packet fragmentation. It is necessary because of the different MTU values $IPT -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
# Discard all packets that cannot be identified # and therefore cannot have a certain status. $IPT -A INPUT -m state --state INVALID -j DROP $IPT -A FORWARD -m state --state INVALID -j DROP
# Leads to the linking of system resources, so that the real # data exchange becomes impossible, we cut it off $IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP $IPT -A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP
# Opening the SSH port $IPT -A INPUT -i $WAN -p tcp --dport 2082 -j ACCEPT $IPT -A INPUT -i $VPN -p tcp --dport 2082 -j ACCEPT
# Opening the port for DNS $IPT -A INPUT -i $WAN -p udp --dport 53 -j ACCEPT $IPT -A INPUT -i $VPN -p udp --dport 53 -j ACCEPT
# Opening the port for NTP $IPT -A INPUT -i $WAN -p udp --dport 123 -j ACCEPT $IPT -A INPUT -i $VPN -p udp --dport 123 -j ACCEPT
# We allow you to respond to PING $IPT -A INPUT -p icmp --icmp-type 8/0 -j ACCEPT $IPT -A OUTPUT -p icmp --icmp-type 8/0 -j ACCEPT # VPN pings do not pass in any case
# Opening a port for the WEB $IPT -A INPUT -i $WAN -p tcp --dport 80 -j ACCEPT $IPT -A INPUT -i $VPN -p tcp --dport 80 -j ACCEPT
# Opening the FTP port # $IPT -A INPUT -i $WAN -p tcp --dport 21 -j ACCEPT # $IPT -A INPUT -i $VPN -p tcp --dport 21 -j ACCEPT
# Logging # Everything that is not allowed, but breaks, will be sent to the undef chain
# $IPT -N undef_in # $IPT -N undef_out # $IPT -N undef_fw # $IPT -A INPUT -j undef_in # $IPT -A OUTPUT -j undef_out # $IPT -A FORWARD -j undef_fw
# Log everything from undef
# $IPT -A undef_in -j LOG --log-level info --log-prefix "-- IN -- DROP " # $IPT -A undef_in -j DROP # $IPT -A undef_out -j LOG --log-level info --log-prefix "-- OUT -- DROP " # $IPT -A undef_out -j DROP # $IPT -A undef_fw -j LOG --log-level info --log-prefix "-- FW -- DROP " # $IPT -A undef_fw -j DROP
# Writing down the rules /sbin/iptables-save > /etc/sysconfig/iptables
Routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.10.10.1 128.0.0.0 UG 0 0 0 tap0
0.0.0.0 40.30.20.193 0.0.0.0 UG 0 0 0 eth0
10.96.0.0 0.0.0.0 255.224.0.0 U 0 0 0 tap0
40.30.20.193 0.0.0.0 255.255.255.255 UH 0 0 0 eth0
77.77.77.202 40.30.20.193 255.255.255.255 UGH 0 0 0 eth0
128.0.0.0 10.10.10.1 128.0.0.0 UG 0 0 0 tap0
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 eth0
ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 40.30.20.198 netmask 255.255.255.255 broadcast 40.30.20.255
inet6 fe80::5054:ff:fe0c:3f41 prefixlen 64 scopeid 0x20<link>
ether 52:54:00:0c:3f:41 txqueuelen 1000 (Ethernet)
RX packets 4046 bytes 893834 (872.8 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1974 bytes 175476 (171.3 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 0 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tap0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.10.10.200 netmask 255.224.0.0 broadcast 10.127.255.255
inet6 fe80::40a7:62ff:fe2c:81be prefixlen 64 scopeid 0x20<link>
ether 42:a7:62:2c:81:be txqueuelen 100 (Ethernet)
RX packets 2972 bytes 489800 (478.3 KiB)
RX errors 0 dropped 18 overruns 0 frame 0
TX packets 103 bytes 25054 (24.4 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
