0

I have the following configuration, Apache Web host that is running on my local PC at port 4444.

I've registered at noip.com for DDNS, and I've done setup correctly.

Was wondering, since I am little paranoid of exposing my IP to the public when representing web app to clients, so is it possible for me to run VPN localy, so when DDNS resolves IP it will point at my VPN connection?

I have only basic knowledge of iptables, which is not sufficient for this task. Currently using Debian 8.

Thanks for your help!

1
  • Welcome to SuperUser! Could you add some precisions on what you are trying to achieve? Do you want to connect to the VPN first and then use the DN to access the website, or connect the VPN to the DN and then access the website with IP? Remember that either way, your PC will have to be exposed to the Internet, unless you use an external server as VPN server. – Nathan.Eilisha Shiraini Jul 26 '16 at 10:03
0

In case you want to hide your web server's port using a VPN (openvpn) on the web server host

In that case, you could

  • configure a vpn server, e. g. openvpn, to listen on your host's ip, e. g. 192.168.1.1, port 1194
  • configure your web server to listen only to 192.168.1.1, port 4444
  • stop the port forwarding in your router which forwards traffic from the internet to the web server
  • configure a port forwarding in your router which forwards traffic from the internet to the vpn server on port 1194 (I personally use a different port on the outside, so that the router will forward e. g. port 11945 to port 1194 on the host)
  • connect to your vpn via internet
  • point your browser to your web app at 192.168.1.1, port 4444

In that scenario, you probably don't even need iptables. Your router only knows to forward that one port (1194) to your host, and that one port can only be established or connected to with the correct keys and certificates. All other ports don't need to be closed, because they cannot be reached via your router.

In case you want to make your web server connectable only from the VPN IP address

I assume from your comments, however, that you use the VPN from your laptop, and that your web server is connected to "plain" internet. In that scenario, you open up your firewall/iptables only for your VPN IP, e. g. 3.2.2.2

iptables -A INPUT -s 3.2.2.2/32 -j ACCEPT

or, more fine granular iptables -A INPUT -p tcp -s 3.2.2.2/32 --dport 4444 -j ACCEPT

Attention: this must not be the only rule. You probably want to access your host via SSH from your local network, or generally allow everything from your local network:

iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT

Also, you want to allow localhost traffic:

iptables -A INPUT -i lo -j ACCEPT

After that, you can close every other incoming port:

iptables -P INPUT DROP

Be sure to check this thoroughly against your own IP address range and your own VPN IP address.

Also, you have to configure your router/modem to forward any port, e. g. 4444 or 44444 to your web server port 4444.

In case you want to run your VPN service (private internet access) and your web server on the same host

Looking up privateinternetaccess.com, I figured out that

  • there is client programs for various operating systems, among them Linux. (see here)
  • PIA recommends, however, to use openVPN in case you always want to have the same VPN IP address (see here)

So to

run VPN locally, so when DDNS resolves IP it will point at your VPN connection

you would

  • install openVPN
  • edit the ovpn file provided by PIA to connect to always the same VPN server
  • start the openVPN connection to PIA
  • configure your DDNS client that it looks up and updates the IP address only after the VPN connection is established. The DDNS client should now find 3.2.2.2 as your IP address, update it in the DDNS server, and your clients can resolve yourhost.yourddns.com to 3.2.2.2.
  • Whilst PIA does not recommend to to so (see here), you should be able to enable port forwarding in PIA as described here for port 4444.
7
  • I am subscribed to a vpn service, can I use it somehow instead openvpn ? So for the example, my external vpn IP is 3.2.2.2, how can I setup my webhost to be accessed remotely by navigating to 3.2.2.2:4444? As I've said, I am using ddns for this. Thank you for feedback. – fugitive Jul 17 '16 at 21:39
  • "subscribed to a vpn service" raises the question from which device you are connecting to the vpn service. If you connect from your, e.g laptop, then your laptop will be assigned the IP 3.2.2.2, your web server still has its public ip and its ddns name. If you are connecting to the vpn service from your web server host, it depends on whether the vpn service provider supports "incoming" connections. Plus, the vpn service must be enabled and online all the time, e. g. the web server host must be connected all day. Also, the ddns must know about the vpn and push the vpn IP to the ddns servers. – stueja Jul 18 '16 at 5:00
  • Which vpn service do you use and from which device are you currently connecting to it? – stueja Jul 18 '16 at 5:02
  • I am using a services from Private Internet Access. It is a local website on my Debian , it will not be online for the whole time, only when I make some progress with developing, but I need to use this way. I am unsure how to push ports and set up iptables, to allow this kind of access. Thanks for the help! – fugitive Jul 18 '16 at 11:54
  • I edited my answer accordingly. Please let me know if questions are open. – stueja Jul 18 '16 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.