Webserver behind VPN client

By OmegaHack
in Smart Home, Network & Security

 Share

Recommended Posts

Rising Star

OmegaHack

Posted
Posted

I just want someone to work through this with me to make sure I'm not going to be wasting my time implementing it.

I currently run a Linux server running ddclient for a DDNS service (afraid.org) among other services, and does not currently have a VPN client.

I am planning on installing a VPN client which would cause ddclient to stop reporting the correct IP to the DDNS. So I was going to run a virtual machine on eth1 (non-VPN) running ddclient and have the full server running on eth0 (VPN). That way ddclient is reporting the correct wan IP for my connection, then port forwarding to the local IP should allow the domain to see the web services/ssh/etc remotely while keeping other network traffic protected by the VPN... or at least that's what I am imagining.

Can anyone tell me if I over-thought this or if this will actually work?

Thanks!

Link to comment
https://www.neowin.net/forum/topic/1124036-webserver-behind-vpn-client/
Share on other sites
Grand Master

+BudMan MVC

Posted
  • MVC
Posted

port forwarding to what IP, the VMs IP?

If I hit you from say 24.13.a.b to your publicIP.nonvpn to be forwarded to your webserver. When your webserver answers back if default route to internet is through vpn -- it will go back through the vpn to answer me on 24.13.a.b

I don't think my box would like the connection coming from a different IP, etc.

Now if webservices/ssh going to run on the vm your fine - and you don't even need a second nic for that. Just bridge the VM to your 1 physical nic on the server so it gets an IP in your private network.

Rising Star

OmegaHack

Posted
  • Author
Posted

Port forwarding to the VPN protected IP.

The reason I'm doing this is there are some applications that need to be run behind the VPN but I need to be able to access them remotely. Is there another way of doing that?

This is a full fledged enterprise rackmount server, so it has the two nics built in already. I was going to trunk them for redundancy but if I have to run them independent to get this working that's okay.

I see what you're saying about the different IP responding. Didn't really think of it that way... There has to be a way to do this though.

Grand Master

+PeterUK MVC

Posted
  • MVC
Posted

The bit I'm confused with is a VPN client on the same server as (afraid.org)? Do you not mean install a VPN server on the same server as (afraid.org)?

Do you want (afraid.org) on the WWW for everyone or only accessed by VPN? If only by VPN then DDNS will only help you get to the VPN WAN IP not (afraid.org) and so VPN DNS server will have to point you to (afraid.org) by VPN LAN IP.

Grand Master

+PeterUK MVC

Posted
  • MVC
Posted

afraid.org is the DDNS provider. I want specific ports available to web access instead of being behind the VPN client. However the other traffic those applications create need to be behind the VPN.

So you do want (afraid.org) on the WWW for everyone and connect to this server by VPN for other things? In which case you need a VPN server (not client) setup on (afraid.org) and this will not affect DDNS in pointing to (afraid.org) by WAN IP.

Grand Master

Nas

Posted
Posted

@PeterUK, I think he just wants to know if he can segment his 2 NICs so that some traffic (vpn) is bound/routed via NIC #1 and all other traffic (non-vpn) is bound/routed via NIC #2.

@OmegaHack, it sounds like you're talking about proxying 2-way VPN traffic thru NIC #1 while allowing non-VPN traffic thru NIC #2 undisturbed. If that's the case, then it shouldn't be a problem -- provided that all client/server services are explicitly bound to the appropriate ethX device.

(For reference, this bifurcation is very typical for managed environments since the secondary Ethernet device can either serve a different VLAN or even upstream provider [think back-up/spare network bandwidth].)

Edit: bold-faced "proxying" since the OP wants more to proxy than to necessarily port-forward

Rising Star

OmegaHack

Posted
  • Author
Posted

@PeterUK I don't think you understand. freedns.afraid.org is the service I have my dynamic DNS through, ddclient is the application that gives my WAN IP to freedns.afraid.org so that a domain that I have points to my WAN IP. I am trying to set up a VPN client on here to protect the data that is sent/received by the applications running on the server. I need to be able to access certain ports on that server for those applications though. If I run ddclient on the primary server it will report the wrong (anonymous) IP address to freedns.afraid.org hence the VM to run ddclient on it's own ethernet device (I suppose I could just use a virtual switch though). So now the correct IP is being reported to the DDNS provider but will port forwarding on the router to the primary server allow me to access those specific ports/applications remotely. That is the question.

@NAS I am trying to leave the traffic on the VM undisturbed but also need to access certain ports on the primary system remotely.

Grand Master

+PeterUK MVC

Posted
  • MVC
Posted

If its the other way round as in (afraid.org) wants to connect to another VPN end point then you only need to disable for the VPN client do not use the remote gateway which will give you a LAN access to the other end without it affecting DDNS because you disabled the the VPN use the remote gateway option.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Politically funny images of the World

      By +Edouard · Posted

    • Free Software Foundation Europe pushes EU to force Google to allow AI uninstalls on Android

      By zikalify · Posted

      Free Software Foundation Europe pushes EU to force Google to allow AI uninstalls on Android by Paul Hill Credit: Pexels Users should be able to fully uninstall AI-based features from Android devices and be able to access interoperability functions, free from Google’s verification requirements, the European Commission has heard as part of an Android interoperability consultation under the Digital Markets Act. These measures were proposed by the Free Software Foundation Europe (FSFE) last week when it submitted its documentation. The FSFE noted that Google had started silently installing AI models without telling users. It noted that the EU’s DMA requires companies like Google to allow users to uninstall pre-loaded software from their devices, but in the case of the AI models Google is installing, they reinstall if you delete them, contravening the DMA. To get Google back under control, the FSFE has told the European Commission that there needs to be improvements within the Android Open Source Project (AOSP). First, it said that users should be able to fully remove pre-loaded AI components from their devices, with companies being prohibited from silently reinstalling or reactivating them. Second, access to Android interoperability features should not be contingent on registration, authorization, or contractual relationships with Google. This pertains to Google’s attempt to force developers to register with Google, even to publish apps to alternative app stores like F-Droid. Discussing its submission, Lucas Lasota, FSFE Legal Programme Manager, said: Google is planning to roll out its Android Developer Certification in September 2026. This will force every Android app developer to register with Google before their software can be installed on certified Android devices, but it should affect those who have removed Google Apps from their device. The program is controversial because it entails the signing of contracts and payment of account fees to Google, as well as the handing over of the identities of developers. It said: The FSFE said that if the Commission’s draft measures remain unchanged, then Google will be allowed to make developers verify their identity. The FSFE believes that asking developers to register is contrary to the text and spirit of the law. In summary, the FSFE has told the Commission that no developer should need a Google account, a Play Store presence, or any agreement with Google to access Android’s interoperability features.
    • Microsoft confirms Windows 11 26H2 to finally get one of the most requested features

      By KsenOug · Posted

      You could disable this "functionality/feature/whatever" with 2 registry keys, ages ago.
    • Microsoft releases major feature updates for stock Windows 11 apps

      By matthiew · Posted

      My Photos app is version 2026.11050.1001.0 and it remembers the window size and position. My Snipping Tool is version 11.2602.49.0 and it can capture the taskbar.
    • MusicBee 3.6.9668

      By Copernic · Posted

      MusicBee 3.6.9668 by Razvan Serea MusicBee is an application geared toward managing extensive music collections, easy to use and with a comprehensive feature set. It makes it easy to organize, find, and play music files on your computer, on portable devices, and on the Web. It provides playback of a wide range of audio formats, smart playlists with the ability to discover and play new music from the web, advanced tag editing with automated artwork and tag look up, folder monitoring, automated file re-organization, portable device synchronization, and secure CD ripping with AccurateRip verification. MusicBee features: Supported formats: MP3, AAC, M4A, MPC, OGG, FLAC, APE, TAK, WV, WMA and WAV. Audio CDs: Audio CD playback and ripping (with CD-Text capabilities) is supported. CD tracks can be ripped (in fast or secure mode) as individual files or as a single album with embedded cuesheet. Conversion: Conversion from and to all supported formats as metadata are preserved. Synchronization of tags only (in case that the output file already exists) instead of reencoding is possible. ReplayGain support: both playback and calculation. File Organization: Organization and renaming of music files into folders and files based on tag values such as artist, album, name, track number, etc. that can be specified. MusicBee can do this automatically for all files in a music library or the user can choose the files or folders themselves. Web Browsing: Browsing of the web using Mozilla's XULRunner environment. Scrobbling: Tracks played from MusicBee can optionally be scrobbled to Last.fm. Customizable user interface layout. Customizable keyboard shortcuts. MiniLyrics support Download: MusicBee 3.6.9668 | MusicBee Portable | ~9.0 MB (Freeware) Download: Windows Store Edition View: MusicBee Home page | Release Notes | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware

  • Recent Achievements

    • Conversation Starter
      sumytbe earned a badge
      Conversation Starter
    • One Year In
      B4dM1k3 earned a badge
      One Year In
    • One Year In
      DarkWun earned a badge
      One Year In
    • Dedicated
      Almohandis earned a badge
      Dedicated
    • Dedicated
      JuvenileDelinquent earned a badge
      Dedicated

  • Popular Contributors

    1. 1
      +primortal
      519
    2. 2
      +Edouard
      185
    3. 3
      PsYcHoKiLLa
      87
    4. 4
      Michael Scrip
      81
    5. 5
      Steven P.
      73
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!