How to serve web services/sites behind an OpenWRT+VPN router?

Installing and Using OpenWrt Network and Wireless Configuration
1

I have a working OpenWRT install on a router, with a VPN (NordVPN) configured.

I would now like to serve some simple websites from inside my LAN, without needing the client to be on the VPN.

I have already setup a domain that points to the fixed IP provided by my ISP, and I have tried the following to get HTTP/HTTP access working:

  1. Added firewall rules for TCP ports 80 and 443 for inputs to the router:

image
image655×167 13.6 KB

  1. Installed nginx and added /etc/nginx/conf.d/reverse-proxy.conf :
root@OpenWrt:~# cat /etc/nginx/conf.d/reverse-proxy.conf 
server {
    listen 80;
    server_name mydomain.net;
    location / {
        proxy_pass http://mylanhostname.lan:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

and I've confirmed that nginx is running (and I restarted it after adding the reverse proxy).

For now I'm just concerned with getting HTTP working and I will come back and add HTTPS, letsencrypt etc. once I have a basic setup going.

I've also confirmed that the web server at http://mylanhostname.lan:8080 is running and accessible from inside the LAN.

This is not currently working in two different ways:

  1. With the VPN turned on, attempting to access mydomain.net from outside the LAN results in "this site can't be reached" errors.
  2. With the VPN turned off, I get a 403 error from nginx.

I'm at a loss for how to proceed here and while I could try making some semi-informed guesses around port forwarding or something, I'm afraid of just making things worse or opening up security holes.

2

Oh, and here are my current firewall zones:

image
image740×236 17.1 KB

I tried changing the wan input from reject to accept, but it didn't make a visible difference to behaviour.

3

Your proxypass is misconfigured and duly returns 403;

4

You most certainly do not want to do this!! It exposes your router directly to the internet, allowing it to accept connections from anyone/anything.... change that back to reject.

3 Likes
5

Firstly you dont require nginx on the router - you can run DNAT type forwarding - input on wan source dest port 80 redirect to internal server port 1234
4443 ... other port.
403 looks like you still have nginx luci?