In case you want to hide your web server's port using a VPN (openvpn) on the web server host
In that case, you could
- configure a vpn server, e. g. openvpn, to listen on your host's ip, e. g. 192.168.1.1, port 1194
- configure your web server to listen only to 192.168.1.1, port 4444
- stop the port forwarding in your router which forwards traffic from the internet to the web server
- configure a port forwarding in your router which forwards traffic from the internet to the vpn server on port 1194 (I personally use a different port on the outside, so that the router will forward e. g. port 11945 to port 1194 on the host)
- connect to your vpn via internet
- point your browser to your web app at 192.168.1.1, port 4444
In that scenario, you probably don't even need iptables. Your router only knows to forward that one port (1194) to your host, and that one port can only be established or connected to with the correct keys and certificates.
All other ports don't need to be closed, because they cannot be reached via your router.
In case you want to make your web server connectable only from the VPN IP address
I assume from your comments, however, that you use the VPN from your laptop, and that your web server is connected to "plain" internet.
In that scenario, you open up your firewall/iptables only for your VPN IP, e. g. 188.8.131.52
iptables -A INPUT -s 184.108.40.206/32 -j ACCEPT
or, more fine granular
iptables -A INPUT -p tcp -s 220.127.116.11/32 --dport 4444 -j ACCEPT
Attention: this must not be the only rule. You probably want to access your host via SSH from your local network, or generally allow everything from your local network:
iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
Also, you want to allow localhost traffic:
iptables -A INPUT -i lo -j ACCEPT
After that, you can close every other incoming port:
iptables -P INPUT DROP
Be sure to check this thoroughly against your own IP address range and your own VPN IP address.
Also, you have to configure your router/modem to forward any port, e. g. 4444 or 44444 to your web server port 4444.
In case you want to run your VPN service (private internet access) and your web server on the same host
Looking up privateinternetaccess.com, I figured out that
- there is client programs for various operating systems, among them Linux. (see here)
- PIA recommends, however, to use openVPN in case you always want to have the same VPN IP address (see here)
run VPN locally, so when DDNS resolves IP it will point at your VPN
- install openVPN
- edit the ovpn file provided by PIA to connect to always the same VPN server
- start the openVPN connection to PIA
- configure your DDNS client that it looks up and updates the IP address only after the VPN connection is established. The DDNS client should now find
18.104.22.168 as your IP address, update it in the DDNS server, and your clients can resolve
- Whilst PIA does not recommend to to so (see here), you should be able to enable port forwarding in PIA as described here for port 4444.