How to access a web server running on the same server as OPENVPN

Hi,

I think your issue may be related to firewall’s NAT settings on VPN server side. I changed my VPN configuration to simulate yours. Now it looks like in the diagram below.

       Internet
          |
          |                                     
 ------------------                          ------------------
|   DO Droplet 1   |     10.8.0.0/24        |   Home Office    |
|    (CentOS 8)    |_________VPN_______     |   ISP's router   |
| Internet gateway |                   \----| Internet gateway |
|    VPN Server    |                    \    ------------------
| Front-end Server |                     \____  |
 ------------------                           | |LAN 192.168.0.0/24
          |                                   | |------------
          |VPC                                | |            |
          |10.106.0.0/20                     -------------   | 
          |                                 |     PC 1    |  |
 -----------------                          | VPN Client/ |  |
|  DO Droplet 2   |                         | VPN Gateway |  |
|  (Ubuntu 20.4)  |                         |  (CentOS 7) |  |
|   VPN Access    |                          -------------   |
 -----------------                                           |
                                             -------------   |
                                            |     PC 2    |  |
                                            |  VPN Access |--
                                            | (Windows 10)|
                                             -------------

I can ssh Droplet 1 and get a website served by its from my home office network. VPN channel is up, of course, and I use droplet’s public IP address.

I have installed and configured nftables on Droplet 1. My NAT settings for the traffic outgoing from VPN network to the Internet looks like that:

set masq_interfaces_vpn {
  type ifname
  elements = { "tun0" }
}

set masq_ips_vpn {
  type ipv4_addr
  flags interval
  elements = { 10.8.0.0/24 }
}

chain outgoing {
  type nat hook postrouting priority 120; policy accept;
  iifname @masq_interfaces_vpn oifname != @masq_interfaces_vpn masquerade
  ip saddr @masq_ips_vpn masquerade
}

I hope it will get you closer to solving your issue. I probably could help you more if I knew more details of your configuration.