connect vps from openvpn located the same vps

Question

i have openvpn at vps.
also that vps has an apache and some services (from browser) which i'd like to use only from my own ip or when i've connected to my openvpn.

openvpn ip = vps ip

vps has iptable rules:

-A INPUT -p tcp -m xx.xx.xx.xx --dport 12345 -j ACCEPT #(xx.xx.xx.xx = my own ip)
-A INPUT -s yy.yy.yy.yy/32 -j ACCEPT #(yy.yy.yy.yy = openvpn/vps ip)

in browser:
i have an access to 12345/tcp from my own ip.
i connect openvpn (nat, my external ip is changing to yy.yy.yy.yy), i also have access to that port.

but when i connect to openvpn from different ip (not xx.xx.xx.xx = my own ip) i have a fault to connect service port 12345 .
or when i delete a rule that accept inputs for xx.xx.xx.xx -> connect openvpn -> also have a fault to connect service port 12345 .

why?

does browser send packets to the vps directly from my own ip because ip ovpn = request ip? like: my ip -> browser -> vps port 12345 ?
not: my ip -> ovpn -> browser -> vps port 12345 ?

what should i do to open 12345 port when i connected openvpn (nat) from any ip?

iptables LOG (when ovpn nat connected):

May 21 22:36:38 my.domain kernel: [16599.174007] IN=eth0 OUT= MAC=[-] SRC=xx.xx.xx.xx DST=yy.yy.yy.yy LEN=52 TOS=0x00 PREC=0x00 TTL=109 ID=38136 DF PROTO=TCP SPT=8101 DPT=12345 WINDOW=64240 RES=0x00 SYN URGP=0

Answer 1

does browser send packets to the vps directly from my own ip because ip ovpn = request ip? like: my ip -> browser -> vps port 12345 ?

Yes – although the VPN client routes everything through the tunnel, the VPN server itself gets deliberately excluded from this, otherwise you would have a routing loop: if packets to the VPS were routed through the VPN, then the actual VPN packets would also be sent via the VPN again, infinitely, never actually going out to the server. (This is because standard IP routes cannot be applied to specific ports only – so if your service on port 12345/tcp goes via the VPN, then the OpenVPN packets on port 1194/udp also go via the VPN...)

On some systems it is possible to have more precise exceptions (e.g. on Linux, "policy routing" and/or iptables fwmarks can be used), but this isn't universal.

what should i do to open 12345 port when i connected openvpn (nat) from any ip?

Connect to the service using your server's internal address (the one assigned to the OpenVPN 'tun0' interface) instead of the external address.