Can't make app VPN protection work

[bazinga]

Apologies if this is considered an app-related issue, but to me it sounds like the platform issue.

I want to restrict access to one of my Cloudron apps to a VPN only. I've got the VPN app running, client created, my OpenWRT home router has a WG interface added and a VPN routing policy added to route my desktop's requests to my Cloudron IP via the WG interface.

Doing "traceroute app.domain.net" from my home machine I see the traffic going through the VPN (packets pass 10.9.0.1, which is the default VPN network), VPN app in Cloudron shows Rx/Tx.

However the app for which I have enabled VPN Protection keeps showing "VPN connection required" page.

Not sure what exactly I am doing wrong or how to troubleshoot this. Would appreciate any help.

PS: I am on Cloudron 10.1.5.

[luckow]

@bazinga Does a direct VPN connection between your computer and your Cloudron instance work?

[bazinga]

@luckow You mean - configuring my desktop to route all traffic via the VPN? Haven't tried that because it should really be immaterial here... I've been using different kinds of VPNs for at least a decade now and running a tunnel on a router is something that I do often without any issues.

In this case I want to make sure only one domain for all home devices is ever routed via the VPN. The rest shouldn't be routed via the VPN. So running a VPN on all devices all the time isn't a solution.

[luckow]

@bazinga Yes. Just to troubleshoot - “but to me, that sounds like a problem with the platform.”
If the basic steps work, we can move on - just like with, “Did you turn it off and on again?”

[bazinga]

Setting a VPN up on the desktop is an extra annoyance that I wanted to avoid.. My thinking was - since traceroute shows traffic passing through the VPN's network that's sufficient proof of the VPN link being used.

Rebooted Cloudron. Rebooted the router couple of times (along with restarts of the firewalls and ip caches flush).

[bazinga]

Additional tests:

• Route all desktop traffic via router's WG tunnel.
  • IP / DNS leak tests on the desktop show the IP of my Cloudron.
  • The app protected by VPN Protection is not reachable and the error page is shown.
  • Review Cloudron's Event Log - for every entry it shows "Client IP" value, which is set to my Cloudron's IP - so I am accessing cloudron instance via the VPN.
• Route only Cloudron IP via policy routing on my OpenWRT router to Cloudron's VPN.
  • Can access Cloudron console and all apps that aren't configured for VPN Protection.
  • Cannot access the app being protected.
  • Review Cloudron's Event Log - for every entry it shows "Client IP" value, which is set to my Cloudron's IP - so I am accessing cloudron instance via the VPN.
• Direct access to my Cloudron's instance (no VPN)
  • Event Log entries now show my home IP under "Client IP" value
  • Cannot access the app being protected.

If this doesn't prove that something is broken with VPN Protection, then please tell me what else to check.

[bazinga]

This post is deleted!