0

Currently our network looks like this:

enter image description here

The issue is that OpenVPN Access Server does not support working behind a proxy server so some features are currently not working. As we only have 1 external IP and we have no possibilities to add some extra, i try to find a way to get OpenVPN AS working and hosting some website's (on other servers) at the same time.

I was thinking, maybe i can "route" traffic to vpn.company.com (443) directly from pfSense (dns based port forwarding or something???) to the OpenVPN AS and all other traffic (port 443) to the Nginx proxy server. This would make the network looking like this:

enter image description here

This way, the OpenVPN AS is not behind a proxy server anymore and can work like a direct port forwarding. The other website's still work like they currently do.

  1. Is it possible to do some routing, based on a (external) domain at all? (with other words can my idea work?)
  2. If 1. is answered with yes, is it possible with pfSense? if yes, how?

I tried to Google this and found a lot of stuff but nothing that could help me. Orriginialy I'm a software engineer and no network engineer so apologize if i ask something stupid.

Improve this question
1
  • DNS is an application-layer thing, and the network and transport protocols use addresses, not names. Anything at or below OSI layer-4 has no concept of names or DNS, only addresses.
    – Ron Maupin ♦
    Dec 18 '20 at 21:02
2

DNS-based port forwarding isn't a thing. The transport layer has no idea about DNS names. The only way to do something like that is with an application-layer (aware) proxy and, of course, an application-layer protocol that uses host names, like HTTP.

With just a single IP address, you'll need a dedicated TCP port for OpenVPN (and probably one for UDP, too). Forwarding that to the AS should be no problem on the pfSense. You can change OpenVPN's TCP or UDP ports during installation or afterwards: https://openvpn.net/vpn-server-resources/advanced-option-settings-on-the-command-line/

Another approach would be policy-based forwarding, depending on the source address of an external packet. That way, you could theoretically forward known VPN clients to the OVPN AS and the rest of the Internet to your web servers. I don't think that's practical, however.

Improve this answer
2
  • With just a single IP address, you'll need a dedicated TCP port for OpenVPN (and probably one for UDP, too). Forwarding that to the AS should be no problem on the pfSense. - For the OpenVPN Access Server is this no option as it requires port 443 like my (https) website's. So actually i need a proxy which is not supported so i can throw this idea away. Thanks for the explaination.
    – CodeNinja
    Dec 18 '20 at 12:03
  • 1
    You can very easily run an OpenVPN AS on an alternative port, I'm doing that myself.
    – Zac67
    Dec 18 '20 at 12:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.