On separate machine Ive setup some www server based on Debian 8 for testing purposes. It has also samba and GIT server installed. Today we got public ip from our ISP and i redirected port :80 to our LAN machine server.

 LAN SERVER [*.*.0.200:8010] <= INSIDE ROUTER [*.*.1.100] (:80 redirection to *.0.200:8010 ) <= OUTSIDE ROUTER(:80 redirection to *.*.1.100:80)

Our project already has some authorisation and login mechanisms applied but all is on very early state (pre alpha) so we affraid about security. But server need to be exposed for our boss (for progress tracking) and people which work in offices in another city (testers) who are the targets of this project.

So we tought about setup VPN tunnel for outside users to our LAN Server. Already read some articles like this one... https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-8

And now we (me, because i will have to configure it) are thinking about setup redirections this way

LAN SERVER [*.*.0.200:8010] <= VPN Server [*.*.1.210] (:80 redirection to *.0.200:8010 ) <= INSIDE ROUTER [*.*.1.100] (:80 redirection to *.0.210:80 ) <= OUTSIDE ROUTER(:80 redirection to *.*.1.100:80)

where VPN server will be either separate machine or virtual machine with its own IP set on LAN SERVER machine. All outside traffic will have to pass trough VPN but LAN users can directly access server by 0.200:8010 address.

What do you think about this idea?

  • Excellent idea, I actually do the same, but with StrongSwan. If correctly setup, as an added bonus, StrongSwan supports the native VPN clients of iPhones and Macs – Rui F Ribeiro Mar 16 '17 at 12:56
  • Ive just read that it is possible to bind more than one IP addres to interface. So if my apache virtualhosts are set on and i will set as second IP, can i redirect all outside trafic to 201, set OpenVPN on it and redirect traffic from it to 200? I wont have to use physical or virtual machine then. – 180doman Mar 16 '17 at 13:42
  • You do not need servers to be in the same netblock as your private network address VPN space. – Rui F Ribeiro Mar 16 '17 at 13:47

Ok my idea was wrong because i havent fully undestand how VPNs work. Especially the fact that OpenVPN creates its own interface so there is no need to create another one. I went trough all tutorial like it was written, only changing minor things and it worked.

I reccomend Hak5 video which is very similar , or (strangely) the same as tutorial above but little more detailed.


ADVICE. In my opinion it is better after installation to begin with generating certificate and server key and then configure server and firewall because then you have better understanding of server.conf file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.