Tutorial: Change the Web Service Forwarding Settings
Overview
The OpenVPN TCP daemon and the web services are connected. This is done with service forwarding, which internally redirects web browser requests made to the OpenVPN TCP daemon, running on the default HTTPS port TCP 443, to where the web services are actually running.
You have the option to disable service forwarding by following this tutorial.
An installed Access Server.
Console access and the ability to get root access.
A new Access Server installation includes the following default configurations:
The OpenVPN TCP daemon on port TCP 443.
The web services on port TCP 943.
The Client and Admin Web UIs available on the same port (with /admin for the Admin Web UI).
An internal, automatic redirection for web browser requests on TCP 443 to point to where the web services run.
Connect to the console and get root privileges.
Switch to the scripts directory:
cd /usr/local/openvpn_as/scripts/Run your desired command based on the service forwarding you want to change:
Disable service forwarding for the Admin Web UI, but leave it enabled for the Client Web UI only:
./sacli --key "vpn.server.port_share.enable" --value "true" ConfigPut ./sacli --key "vpn.server.port_share.service" --value "client" ConfigPut ./sacli startDisable service forwarding for the Client Web UI, but leave it enabled for the Admin Web UI only:
./sacli --key "vpn.server.port_share.enable" --value "true" ConfigPut ./sacli --key "vpn.server.port_share.service" --value "admin" ConfigPut ./sacli startDisable service forwarding for both the Admin and Client Web UIs:
./sacli --key "vpn.server.port_share.enable" --value "false" ConfigPut ./sacli --key "vpn.server.port_share.service" --value "custom" ConfigPut ./sacli startEnable service forwarding for both the Admin and Client Web UIs (default):
./sacli --key "vpn.server.port_share.enable" --value "true" ConfigPut ./sacli --key "vpn.server.port_share.service" --value "admin+client" ConfigPut ./sacli startConfigure a custom redirection — only works with IP addresses on the server itself, nothing external:
./sacli --key "vpn.server.port_share.enable" --value "true" ConfigPut ./sacli --key "vpn.server.port_share.service" --value "custom" ConfigPut ./sacli --key "vpn.server.port_share.ip_address" --value <LOCAL_IP> ConfigPut ./sacli --key "vpn.server.port_share.port" --value <PORT> ConfigPut ./sacli start
Affecting server-locked profiles
If you make the Client Web UI completely unreachable for your users (such as by disabling service forwarding and blocking access to the port where the web services run, TCP 943), server-locked profiles will no longer work.
Users will receive a message indicating that the XML-RPC interface is unreachable, and they will be unable to authenticate and connect.
Ensure you keep the Client Web UI reachable for your users to use server-locked profiles.
Example use case
Using this tutorial, you might run the OpenVPN TCP daemon on port TCP 443, have the Access Server web services on its standard port TCP 943, and at the same time serve pages from an Apache2 or Nginx web server (or other SSL-capable web server) through port TCP 443 via service forwarding. Technically, if you really wanted to, you could make service forwarding to an external address possible by using iptables to redirect a port on a local interface to an external system.