0

I have a VPS running Ubuntu 19. The VPS is configured as follows:

  • OpenVPN server on port 443
  • OpenVPN has port-share with 4343
  • Apache2 web server listening on 80 and 4343 (for SSL)
  • OpenVPN DNS traffic passed to PiHole
  • PiHole has upstream DNS set to self-hosted unbound on same VPS

This setup works. PiHole does ad blocking for VPN clients and resolves all websites properly except the one hosted on the VPS by apache at 4343. The website loads fine when not connected to the VPN. Below my iptables configuration, I believe I have loopback on so I think it should work fine. SSH works fine when connected through VPN so it seems isolated to the port sharing. The configuration was taken from PiHole documentation.

~# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
REJECT     udp  --  anywhere             anywhere             udp dpt:80 reject-with icmp-port-unreachable
REJECT     tcp  --  anywhere             anywhere             tcp dpt:https reject-with tcp-reset
REJECT     udp  --  anywhere             anywhere             udp dpt:443 reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  10.8.0.0/24          anywhere            
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  10.8.0.0/24          anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 
0

The problem was that pihole was reading the server's IP address from '/etc/hosts' in which it was 127.0.0.1. The solution was to edit the hosts file to look like this:

mydomain.com my domain.com
127.0.0.1 localhost

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.