Am I exposing myself to attacks when running my test server while connected to a commercial VPN?

Question

I installed the Apache Web Server on my computer and I use it for developing a website locally, when it is finished I will move it to a paid host. The protections implemented against incoming malicious connections are changing 'Listen 80' to 'Listen 127.0.0.1:80' in ports.conf, allowing only local connections (the part with 'Order Deny,Allow') in my Apache configuration file and also blocking incoming connections with the ufw firewall (well, probably too much than really needed but I do it the first time so better safe than sorry).

However, I wonder if the fact that I am connected to a commercial VPN used to encrypt my connection matter in this case. I use it because apart from working with my local server, I want to use the Internet in the meantime and be connected to that VPN.

I don't know if this is true but my concern is that normally if I wouldn't be connected to the VPN, I would certainly be reachable only under my computer's IP. And usually routers for regular clients are configured not to allow incoming connections (not sure about that). But when using the VPN, traffic is still encrypted when it is passed through the router and it is only decrypted on my computer. So that would bypass the normal configuration of the router to disallow incoming connections. Correct me if I'm wrong.

My questions are:

1. Is the fact that I'm connected to the VPN increasing the attack surface or decreasing it? Would it mean that I am reachable both under my computer's IP and the VPN server's IP? Or only the VPN server's IP? Does this impact security in some other way?

2. Will the measures I took to block malicious incoming connections (i.e. listening only on 127.0.0.1:80 in Apache, etc.) that I described in the first paragraph still work when connected to the VPN?

Bonus question: if my setup is insecure, what could I do better? My idea is that I could have my server inside a VM with network adapter disabled and do my VPN browsing outside of it in the host OS, would that be secure?

Answer 1

as long as you access it over 127.0.0.1, localhost, or any domain that will resolve to localhost (because those are routed over the loopback interface and not through your VPN) and you have the proper protections you listed (which means it will be available locally only and not over the VPN) you will be ok.

Answer 2

A quick solution would be to drop incoming traffic on port 80.

You can also check in your current setup if the server is accessible from outside through the vpn by trying to open the public ip address assigned by the vpn. You can get it in many ways such as visiting whatismyipaddress.com after you connect to the vpn. If it opened then it means it is accessible.

What i think that you are fine.

Answer 3

I would say: Yes! You are making yourself vulnerable by having your Webserver/webservice hosted on your local computer and having it reachable by the internet, especially if you don't know how to secure it properly( all that depend on how you have configured your home network. if you're using a webserver on your internal networks with no way to be reachable from the outside then the answer would have been: way less vulnerable than having a potentially Vulnerable service running without any DMZ