LinuxQuestions.org - OpenVPN to server on the internet to manage it ??

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - OpenVPN to server on the internet to manage it ?? (https://www.linuxquestions.org/questions/linux-newbie-8/openvpn-to-server-on-the-internet-to-manage-it-749246/)

OpenVPN to server on the internet to manage it ??

I have a VDS running that is on the public internet.
To be able to have a secure access to it to manage the server, can I run an OpenVPN-server on it and make a VPN-connection to it ?

Services like webmin, CSF&LFD-firewall GUI and other webGUI tools would then be safe to access ??

Quote:

Originally Posted by jonaskellens (Post 3652116)

As long as you secure the VPN in the right manner, sure will. Consider that you have to have the webmin and other webGUI stuff to only be accesible from localhost (aka 127.0.0.1). Else you would nearly defy the purpose of your vpn.

But I guess more hassel free is just to use ssh and install a cmd browser like w3m. Or go for an X eviroment through ssh.

I say it depends on your momentary knowlegde, the knowlegde you want to gain and the time you have.

Quote:

Originally Posted by zhjim (Post 3652132)

Configuration of the mailserver (ssmtp), asterisk, openvpn, and apache I have done through ssh with rsa-keys.
But the firewall configuration in iptables is not (yet) my thing.

X11 through ssh, is it possible when server is in runlevel 3 ??

webmin and webGUI stuff only accesible from localhost ??
When my OpenVPN-server gives me an IP of 10.8.0.1 I can not really use the webGUI-apps, no ?!

Quote:

Originally Posted by jonaskellens (Post 3652138)

But the firewall configuration in iptables is not (yet) my thing.

While configuring a remote host with iptables I always used this little gadget to prevent myself from being locked out

1.) Create a little shell script

Code:

iptables -t nat -F

iptables -F

iptables -t mangle -F

iptables -P ACCEPT INPUT

iptables -P ACCEPT OUTPUT

this clears all the iptables and reset the default policies to accept everything. This is just from mind and should be checked. Especially when it comes to the targets/chains with -t. cat /proc/net/ip_tables_name holds all possible targets

2.) Create a cronjob that runs every minute and executes the script above so in case of lockout you'll gain access.

Quote:

Originally Posted by jonaskellens (Post 3652138)

X11 through ssh, is it possible when server is in runlevel 3 ??

Could be done when you add X11 to the start up scripts of runlevel 3. Normaly you'd need 4 or 5.

Quote:

Originally Posted by jonaskellens (Post 3652138)

webmin and webGUI stuff only accesible from localhost ??
When my OpenVPN-server gives me an IP of 10.8.0.1 I can not really use the webGUI-apps, no ?!

You're right on this one. Just wanted to make clear that you need to restriced the acces from outside.

Something like

Code:

Order Deny,Allow

Allow from 127.0.0.1, your_vpn_ip

inside the apache config