Search code examples
networkinggoogle-cloud-platformvpnplatformopenvpn

Restrict OpenVPN server to be accessable only through Domain Name and not the server IP on the browser

I have deployed an OpenVPN server from GCP market Place and have attached a Domain name to it along with the SSL certificate. Currently, I am able to access the server through both

  1. https://domain-name.com
  2. https://x.x.x.x -(Server Static Ip)

I want the server to be accessible only through the hostname and not its Server IP as the latter URL gives an SSL security error as the SSL certificate is attached to the Domain name and not to the server IP.

Can anyone help me to restrict it or give some advice to solve it?

Solution

  • You could try to do it(prevent access by IP) but I advice you to not try to do it.

    Theoretically it could be possible for your HTTP server to reset SSL connection when browser sends "wrong" SNI(Server Name Indication) in a handshake.

    Thus you could prevent your browser displaying security alerts.

    Instead your browser would show network error message.

    I doubt you would like to trade one type of error to another one.

    I suggest you to do nothing about such "error" because legitimate visitors will come to your site via domain name and will not see such security warning.

    Also there is huge possibility that legitimate visitor (with paranoid mindset) will use browser with SNI feature disabled so your server will not be able to make difference between good and bad URLs.

    PS: here are relevant questions and discussions at reddit and at ServerFault and another one