Question Setting up an "intranet" site on a public VPS

[lukebrenner]

Hi there,
I tried to do it alone but somehow I am not getting the result I want therefore here I am crying for help
I am trying to build an "intranet" site in my Plesk, let me explain what architecture I have and what I did so far ...

VPS with AMD EPYC 7302 16-Core Processor (10 core(s))
CentOS Linux 7.9.2009 (Core)
Plesk Obsidian - Version 18.0.39 Update #1
32 GB RAM
1 main IP for the server + 4 other IPs available

I have several subscriptions each with several domains, hosted on the shared main IP address, all works well.

What I would like to do is set up an "intranet" site on one of the 4 additional IPs, and it should be reachable ONLY by using OpenVPN.

What I have done so far :
- I have created a new subscription with a non-resolvable domain "mycompany.intranet"
- I have Disabled DNS for this "mycompany.intranet" domain
- assigned IP 92.x.x.90 from the additional IP pool in "Web hosting access"
- created an openvpn cloud account, and set up a DNS entry in openVPN so that mycompany.intranet is bound to 92.x.x.90.
- created a connector, imported the .ovpn file in the openvpn client and set up the right profile.

When using mycompany.intranet in browser WITHOUT openvpn connected, nothing displays, getting a DNS error because the domain is not resolvable and this is CORRECT.
If I connect with OpenVPN client, the page displays properly, so openvpn works fine.

However, even with openvpn not connected, http://92.x.x.90 displays page information, of course because the IP is a public IP.
I tried to create a Firewall rule for this IP to be accessible only from the VPN server's address but there's no predefined rule for that.

What am I doing wrong and if there's a way, can someone please enlighten me ?

Thank you very much in advance.

 

[lukebrenner]

Nobody can help ?
Thanks

 

[Maarten.]

What exactly do you mean with "even with openvpn not connected, http://92.x.x.90 displays page information"? Does it show the login page or a white page?

Have you considered using a .htaccess file with this content?
order deny, allow
deny from all
allow from 92.x.x.90

You can even redirect to a custom error page:

https://support.plesk.com/hc/en-us/articles/213370209-How-to-enable-custom-error-pages-for-a-domain-in-Plesk

 

[mow]

Why use routable addresses at all? RfC1918 addresses should work fine with OpenVPN and avoid this particular problem.

 

[lukebrenner]

What exactly do you mean with "even with openvpn not connected, http://92.x.x.90 displays page information"? Does it show the login page or a white page?

Have you considered using a .htaccess file with this content?
order deny, allow
deny from all
allow from 92.x.x.90

You can even redirect to a custom error page:

https://support.plesk.com/hc/en-us/articles/213370209-How-to-enable-custom-error-pages-for-a-domain-in-Plesk

Hi, well the key point is that as long as that IP is NOT denied by the firewall, the http(s)://92.x.x.x will ALWAYS show a server placeholder.
So, can someone please tell me HOW can I deny incoming access to that particular IP on port 80 from the Obsidian Firewall feature, and allow it for the OpenVPN server IP ? I see there's a single template in creating a rule, but I cannot do it for a particular IP, that is the problem.
Thanks