Related

Marketplace 1-Click Deploy: OpenVPN Access Server Marketplace
1 droplets with web app, 2 office building, some phones and VPN? Question Question
Route IPv6 through DigitalOcean VPN Server Question Question

Question

How to access a web server running on the same server as OPENVPN

Posted September 24, 2020 151 views
VPN

Hi
I am accessing the internet from home through an openvpn server running on a digital ocean droplet. I also set up a web server on the same droplet.

Now if I try and ssh to the IP address or access the IP address through the VPN the various commands/accesses just hang.

If I turn off the VPN I can access everything just fine.

I appreciate this is probably something to do with routing on the droplet site. I’d be grateful if someone could give me a pointer as to what I need to do to enable access through the vpn and from another machine without the vpn.
Thanks
Andrew

Add a comment
andrewellis
By:
andrewellis
Add a comment

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
1 answer
Yannek September 25, 2020

Hi,

I think your issue may be related to firewall’s NAT settings on VPN server side.
I changed my VPN configuration to simulate yours. Now it looks like in the diagram below.

       Internet
          |
          |                                     
 ------------------                          ------------------
|   DO Droplet 1   |     10.8.0.0/24        |   Home Office    |
|    (CentOS 8)    |_________VPN_______     |   ISP's router   |
| Internet gateway |                   \----| Internet gateway |
|    VPN Server    |                    \    ------------------
| Front-end Server |                     \____  |
 ------------------                           | |LAN 192.168.0.0/24
          |                                   | |------------
          |VPC                                | |            |
          |10.106.0.0/20                     -------------   | 
          |                                 |     PC 1    |  |
 -----------------                          | VPN Client/ |  |
|  DO Droplet 2   |                         | VPN Gateway |  |
|  (Ubuntu 20.4)  |                         |  (CentOS 7) |  |
|   VPN Access    |                          -------------   |
 -----------------                                           |
                                             -------------   |
                                            |     PC 2    |  |
                                            |  VPN Access |--
                                            | (Windows 10)|
                                             -------------

I can ssh Droplet 1 and get a website served by its from my home office network. VPN channel is up, of course, and I use droplet’s public IP address.

I have installed and configured nftables on Droplet 1. My NAT settings for the traffic outgoing from VPN network to the Internet looks like that: 

set masq_interfaces_vpn {
  type ifname
  elements = { "tun0" }
}

set masq_ips_vpn {
  type ipv4_addr
  flags interval
  elements = { 10.8.0.0/24 }
}

chain outgoing {
  type nat hook postrouting priority 120; policy accept;
  iifname @masq_interfaces_vpn oifname != @masq_interfaces_vpn masquerade
  ip saddr @masq_ips_vpn masquerade
}

I hope it will get you closer to solving your issue. I probably could help you more if I knew more details of your configuration.

Reply Report
  • andrewellis September 26, 2020

    Hi, thanks so much for the detailed reply. I’m spending a bit of time getting used to the nftables and reading around the subject. I have been using an edgerouter x and thought I was getting used to that. Each system seems to be completely different.

    I shall let you know how it goes. May I ask what you used to generate the fancy ascii diagram.

    Reply Report
    • Yannek September 26, 2020

      You are welcome :) 

      @andrewellis wrote
      I shall let you know how it goes.

      I will appreciate it. 

      @andrewellis wrote
      May I ask what you used to generate the fancy ascii diagram.

      Gnome Text Editor - gedit :D

      Reply Report
  • andrewellis September 26, 2020 
     Internet                               Internet
         |                                      ++
         |                                       |
+--------+---------+   10.8.0.0/24 VPN-----------+--------------+
|  DO Droplet 1    +-----------------| 4G Router  192.168.8.1   |
|  (ubuntu 18)     |                 +------------+-------------+
|  Internet gateway|                              |
|  VPN Ser^er      |                     Bridged  | Connection
|  WWW server      |                              |
+------------------+                              |
                                     +------------+-------------+
                                     |    Asus router with VPN  |
                                     +------------+-------------+
                                                  |
                                                  |
                                                  +
                                                LAN

    Well, I added the outgoing chain to a file as follows

    table ip  filter{
set masq_interfaces_vpn {
  type ifname
  elements = { "tun0" }
}

set masq_ips_vpn {
  type ipv4_addr
  flags interval
  elements = { 10.8.0.0/24 }
}

chain outgoing {
  type nat hook postrouting priority 120; policy accept;
  iifname @masq_interfaces_vpn oifname != @masq_interfaces_vpn masquerade
  ip saddr @masq_ips_vpn masquerade
 }
}

    I also replaced the first line with table ip nat

    Unfortunately it hasn’t made a difference to my ability to connect to the server.

    I have just noticed that if I am on one of my devices that uses the vpn then I can access the server using https://10.8.0.1. However I want to access it using the fixed IP address 161.x.x.x from the internet side. I presume I need some rule to change the destination address from 161.x.x.x to 10.8.0.1 for traffic from the VPN.

    saddr 10.8.0.1 oiaddr

    Reply Report
    • Yannek September 27, 2020

      Thank you for the diagram :) . It directed me to the correct path for troubleshooting the problem. Before, I precipitately assumed that you use OpenVPN client installed on the PC you connect from.
      I dug deeper into my configuration and figured out the route set up on PC 1 (VPN Client/Gateway) that send the traffic to VPN server via my Home Office Internet Gateway, not through VPN tunnel. I removed that route, just for test, but it broke all the communication. I think OpenVPN client needs it to keep the connection.
      So, if it is OK to you to reach your droplet’s resources outside VPN tunnel, you can add the static route to your Asus router configuration. Using Linux it would be like

      ip route add your_droplet_ip via 192.168.8.1

      BTW. Can you share what is the model of your Asus router ?

      Reply Report
Submit an Answer

Related

Looking for something else?

Ask a new question Search for more help