How to configure access to internal resources through VPN?

Question

linux

There is a server on Linux. I want to raise a VPN server on it in order to give one site. That is, there was no access to the server's port 80 before the VPN connection was established. I've never raised a VPN server before, only a client, but I think I'll figure it out from a bunch of documentation. Which server is better to use here and how to restrict access to it from the Internet? I will be glad to any advice.

Answer 1

Judging by "I want to raise a VPN server on it to give one site."
"That is, there was no access to server port 80 before the VPN connection was established."
"Which server is better to use here and how to restrict access to it from the Internet?"
It is noticed that you don’t have a very good idea of ​​how exactly this works, and what you really want to do is probably not done using a VPN, but using the settings of the same web server.
Raise it not on port 80, but on some other one.
Make access only for certain IP addresses.
Set up HTTP authorization.
ALL, no additional servers needed.

Answer 2

I used OpenVPN for a long time at two sponsored organizations, both for client connections and for intersite communication. Now switched to SoftEther VPN. bribed the convenience and versatility of use.

Answer 3

If I understand correctly, then you need to give the site only to those who have access via VPN
Therefore, you need to raise the VPN server, and raise the web server on its internal interface. Those who connected by ip will have access to the site

Answer 4

OpenVPN in multi-connection mode is fine. Any web server will do, you just need it to listen on the right interfaces, not all. If the server will listen on the internal interface, then there is no need to limit anything especially (except for the standard firewall settings). Of course, the OpenVPN daemon must listen on the outside interface.

Answer 5

The following scheme works for me:
(1) tincvpn is a central node on a virtual server (LEMP) with a white ip.
(2) tincvpn is a regular node on a work machine (LEMP) on the internal network.
In the nginx config (1) for the subdomain, a proxy pass is registered to the address of the working machine (2) + access is closed via http auth using nginx.
If there is no vpn connection between (1) and (2), then nginx returns an error, if there is, it requests authorization.

Answer 6

I here in a neighboring question on this topic muddied the answer: How to reach a machine in a VLAN network behind an OpenVPN server?
This will be, in fact, the minimum configuration for a free OpenVPN server.
How to tie TLS to this there is a lot of mana in RuNet. And how to set up from scratch, too, in fact.