I have installed OpenVPN on my server on which I also run git and web server. My initial idea before I got into installing was to be able to enable visiting of some websites only to VPN clients and to allow access to git's SSH only to them. I thought that I will only allow access to ports from VPS's local IPs - 10.254.1.0/24, but I figured out that package seems to be forwarded with my actual IP, not the IP from VPN. My current rule for prerouting from tun interface (I'm using UFW and this is part of iptables' rule which resides in ufw's before.rules):
*nat :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 10.254.1.0/24 -o eth0 -j MASQUERADE COMMIT
I don't quite understand why is client's actual IP assigned to the packet which is sent through VPN, I would rather expect that this packet would be sent from VPN's network. I was thinking about solution for this and the only idea I got was to install OpenVPN on my second server and connect from it. However, the reason I posted this question is that I would more prefer to do this from current server where I already have OpenVPN installed. Any suggestion is welcomed.