I installed the Apache Web Server on my computer and I use it for developing a website locally, when it is finished I will move it to a paid host. The protections implemented against incoming malicious connections are changing 'Listen 80' to 'Listen' in ports.conf, allowing only local connections (the part with 'Order Deny,Allow') in my Apache configuration file and also blocking incoming connections with the ufw firewall (well, probably too much than really needed but I do it the first time so better safe than sorry).

However, I wonder if the fact that I am connected to a commercial VPN used to encrypt my connection matter in this case. I use it because apart from working with my local server, I want to use the Internet in the meantime and be connected to that VPN.

I don't know if this is true but my concern is that normally if I wouldn't be connected to the VPN, I would certainly be reachable only under my computer's IP. And usually routers for regular clients are configured not to allow incoming connections (not sure about that). But when using the VPN, traffic is still encrypted when it is passed through the router and it is only decrypted on my computer. So that would bypass the normal configuration of the router to disallow incoming connections. Correct me if I'm wrong.

My questions are:

  1. Is the fact that I'm connected to the VPN increasing the attack surface or decreasing it? Would it mean that I am reachable both under my computer's IP and the VPN server's IP? Or only the VPN server's IP? Does this impact security in some other way?

  2. Will the measures I took to block malicious incoming connections (i.e. listening only on in Apache, etc.) that I described in the first paragraph still work when connected to the VPN?

Bonus question: if my setup is insecure, what could I do better? My idea is that I could have my server inside a VM with network adapter disabled and do my VPN browsing outside of it in the host OS, would that be secure?

  • Its not clear. Why you need vpn if you want to access it only locally ? Dec 7, 2017 at 23:19

3 Answers 3


as long as you access it over, localhost, or any domain that will resolve to localhost (because those are routed over the loopback interface and not through your VPN) and you have the proper protections you listed (which means it will be available locally only and not over the VPN) you will be ok.


A quick solution would be to drop incoming traffic on port 80.

You can also check in your current setup if the server is accessible from outside through the vpn by trying to open the public ip address assigned by the vpn. You can get it in many ways such as visiting whatismyipaddress.com after you connect to the vpn. If it opened then it means it is accessible.

What i think that you are fine.


I would say: Yes! You are making yourself vulnerable by having your Webserver/webservice hosted on your local computer and having it reachable by the internet, especially if you don't know how to secure it properly( all that depend on how you have configured your home network. if you're using a webserver on your internal networks with no way to be reachable from the outside then the answer would have been: way less vulnerable than having a potentially Vulnerable service running without any DMZ

  • So you say that the steps I took to restrict access to localhost only (like adding "Listen" to ports.conf in Apache) don't work when connected to a VPN? Why is that?
    – user136370
    Jan 15, 2017 at 16:41
  • Because you made your PC (hence here : 127.0.01:80) available to reach trough the VPN. a VPN which has access to the internet. you made your PC Vuln especially if attackers can corrupt your installation of apache trough a priviledge escalation(if your apache server is incorrectly setup it is incredibly easy to do) and gain root access to your machine and then pwn the rest of your network.
    – Z3phyre1
    Jan 17, 2017 at 1:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .