Webserver behind VPN client

By OmegaHack
in Smart Home, Network & Security

 Share

Recommended Posts

Rising Star

OmegaHack

Posted
Posted

I just want someone to work through this with me to make sure I'm not going to be wasting my time implementing it.

I currently run a Linux server running ddclient for a DDNS service (afraid.org) among other services, and does not currently have a VPN client.

I am planning on installing a VPN client which would cause ddclient to stop reporting the correct IP to the DDNS. So I was going to run a virtual machine on eth1 (non-VPN) running ddclient and have the full server running on eth0 (VPN). That way ddclient is reporting the correct wan IP for my connection, then port forwarding to the local IP should allow the domain to see the web services/ssh/etc remotely while keeping other network traffic protected by the VPN... or at least that's what I am imagining.

Can anyone tell me if I over-thought this or if this will actually work?

Thanks!

Link to comment
https://www.neowin.net/forum/topic/1124036-webserver-behind-vpn-client/
Share on other sites
Grand Master

+BudMan MVC

Posted
  • MVC
Posted

port forwarding to what IP, the VMs IP?

If I hit you from say 24.13.a.b to your publicIP.nonvpn to be forwarded to your webserver. When your webserver answers back if default route to internet is through vpn -- it will go back through the vpn to answer me on 24.13.a.b

I don't think my box would like the connection coming from a different IP, etc.

Now if webservices/ssh going to run on the vm your fine - and you don't even need a second nic for that. Just bridge the VM to your 1 physical nic on the server so it gets an IP in your private network.

Rising Star

OmegaHack

Posted
  • Author
Posted

Port forwarding to the VPN protected IP.

The reason I'm doing this is there are some applications that need to be run behind the VPN but I need to be able to access them remotely. Is there another way of doing that?

This is a full fledged enterprise rackmount server, so it has the two nics built in already. I was going to trunk them for redundancy but if I have to run them independent to get this working that's okay.

I see what you're saying about the different IP responding. Didn't really think of it that way... There has to be a way to do this though.

Grand Master

+PeterUK MVC

Posted
  • MVC
Posted

The bit I'm confused with is a VPN client on the same server as (afraid.org)? Do you not mean install a VPN server on the same server as (afraid.org)?

Do you want (afraid.org) on the WWW for everyone or only accessed by VPN? If only by VPN then DDNS will only help you get to the VPN WAN IP not (afraid.org) and so VPN DNS server will have to point you to (afraid.org) by VPN LAN IP.

Grand Master

+PeterUK MVC

Posted
  • MVC
Posted

afraid.org is the DDNS provider. I want specific ports available to web access instead of being behind the VPN client. However the other traffic those applications create need to be behind the VPN.

So you do want (afraid.org) on the WWW for everyone and connect to this server by VPN for other things? In which case you need a VPN server (not client) setup on (afraid.org) and this will not affect DDNS in pointing to (afraid.org) by WAN IP.

Grand Master

Nas

Posted
Posted

@PeterUK, I think he just wants to know if he can segment his 2 NICs so that some traffic (vpn) is bound/routed via NIC #1 and all other traffic (non-vpn) is bound/routed via NIC #2.

@OmegaHack, it sounds like you're talking about proxying 2-way VPN traffic thru NIC #1 while allowing non-VPN traffic thru NIC #2 undisturbed. If that's the case, then it shouldn't be a problem -- provided that all client/server services are explicitly bound to the appropriate ethX device.

(For reference, this bifurcation is very typical for managed environments since the secondary Ethernet device can either serve a different VLAN or even upstream provider [think back-up/spare network bandwidth].)

Edit: bold-faced "proxying" since the OP wants more to proxy than to necessarily port-forward

Rising Star

OmegaHack

Posted
  • Author
Posted

@PeterUK I don't think you understand. freedns.afraid.org is the service I have my dynamic DNS through, ddclient is the application that gives my WAN IP to freedns.afraid.org so that a domain that I have points to my WAN IP. I am trying to set up a VPN client on here to protect the data that is sent/received by the applications running on the server. I need to be able to access certain ports on that server for those applications though. If I run ddclient on the primary server it will report the wrong (anonymous) IP address to freedns.afraid.org hence the VM to run ddclient on it's own ethernet device (I suppose I could just use a virtual switch though). So now the correct IP is being reported to the DDNS provider but will port forwarding on the router to the primary server allow me to access those specific ports/applications remotely. That is the question.

@NAS I am trying to leave the traffic on the VM undisturbed but also need to access certain ports on the primary system remotely.

Grand Master

+PeterUK MVC

Posted
  • MVC
Posted

If its the other way round as in (afraid.org) wants to connect to another VPN end point then you only need to disable for the VPN client do not use the remote gateway which will give you a LAN access to the other end without it affecting DDNS because you disabled the the VPN use the remote gateway option.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Google pitches Spanner as one database for all AI agents with these new featues

      By Karthik Mudaliar · Posted

      Google pitches Spanner as one database for all AI agents with these new featues by Karthik Mudaliar Google Cloud is introducing new features within Spanner, its distributed database, as a place where enterprises should keep their data, using which AI agents could make smarter and better decisions. In a detailed blog post, Google highlighted quite a few features coming to Spanner, including relational data, graph relationships, vector search, key-value access, full-text search, and operational analytics together in one database architecture. Google says that today's systems aren't well-made for AI agents. There could be data that is present in one system, search indexes in another, embeddings in a vector database, and relationship data in a graph database. This fragmentation isn't great for AI agents to do their jobs because they don't have access to all of this data in one place. This is where Google is positioning Spanner as a solution. Spanner is already a globally distributed relational database with strong consistency, and Google wants its customers to see it as a broader data layer for AI applications. The company introduced something called Spanner Graph, along with integrated vector search, full-text search, a Cassandra-compatible key-value endpoint, and a columnar engine for analytical queries on operational data. Google also added that its ScaNN-powered vector search can support indexes with more than 10 billion vectors, while the columnar engine can make some analytical scans up to 200 times faster. All of this isn't just exclusive to the Google Cloud Platform, and there's support for multi-cloud as well. This comes via Spanner Omni, which Google says is a downloadable, containerized version of Spanner that can run on Kubernetes and in environments outside Google Cloud, including Microsoft Azure and AWS, and even on-premises infrastructure as well as edge deployments. Google says that customers who are interested in the full-featured edition should contact the company, and there's no word on commercial availability or separate pricing. Those interested can read the full blog by Google Cloud, which details these features individually.
    • Kalmuri 4.2.5

      By Copernic · Posted

      Kalmuri 4.2.5 by Razvan Serea Kalmuri is your all-in-one, portable screen capture and recording solution designed for speed, simplicity, and flexibility. Whether you need a full-screen snapshot, a custom area, a scrolling webpage, or smooth video recording, Kalmuri delivers with ease. Capture text instantly from images with built-in OCR, keep floating images on top for quick reference, and use the precise color picker for perfect design matching. Customize hotkeys to work your way and share results instantly with built-in upload options. Kalmuri runs without installation, making it ideal for USB use, and offers an intuitive interface that’s easy to learn. Kalmuri key features: Video recording support (designation of whole screen and area) Whole screen, active program, window control, area application Extract text from images using optical character recognition (OCR). Support for PNG, JPG, WEBP, BMP, GIF file formats MP4 video recording powered by FFmpeg for high-quality results Full web page capture Share the captured image on the web Color extraction function Printer output Hotkey settings Adjustable via keyboard for area capture (Arrow key, Ctrl+Arrow key, Shift+Arrow key) File name format (sequential, datetime) Free to use it at work, at home, in government offices, at school, etc. Using Kalmuri portable for video recording Kalmuri’s portable version doesn’t include FFmpeg, which is required for video recording. Without it, you’ll get an “error FFmpeg.exe not found” message. To fix this, download FFmpeg from the provided link, extract it, and place FFmpeg.exe in Kalmuri’s folder. Kalmuri will then recognize it automatically, allowing you to start recording in high quality instantly. Kalmuri 4.2.5 changelog: Fixed an intermittent crash when using Area Capture Improved stability for Area Capture and screen recording Resolved a capture issue that could occur right after startup Download: Kalmuri 4.2.5 | 24.2 MB (Freeware) Download: Kalmuri Portable 4.2.5 | 2.1 MB View: Kalmuri Website | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • WhatsApp is getting usernames, and you can reserve your preferred one now

      By ad47uk · Posted

      I wonder why they decided all of a sudden.
    • WhatsApp is getting usernames, and you can reserve your preferred one now

      By ad47uk · Posted

      They have lots of info on me, I have a facebook account and have done so for years, it was the thing to have then. My phone number is not on it. I don't have the Facebook app on my phone these days, just the messenger part, and only for a couple of people to contact me, most will text me via SMS or phone. I agree, Meta, like others, even without an account will know something about me. Just have to try and keep some things private Also, never saw the need for Whatsapp, people used to ask for me to join it, but as I said to them, I have SMS and a phone, use that, or email
    • WhatsApp is getting usernames, and you can reserve your preferred one now

      By ad47uk · Posted

      True, I see no need for one,

  • Recent Achievements

    • First Post
      rosiecharles earned a badge
      First Post
    • Reacting Well
      Juan Dela earned a badge
      Reacting Well
    • Week One Done
      Collagen Project earned a badge
      Week One Done
    • Reacting Well
      Wakeen1966 earned a badge
      Reacting Well
    • Rookie
      Almohandis went up a rank
      Rookie

  • Popular Contributors

    1. 1
      +primortal
      513
    2. 2
      +Edouard
      271
    3. 3
      PsYcHoKiLLa
      145
    4. 4
      Steven P.
      98
    5. 5
      macoman
      54
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!