I have installed a WireGuard VPN server on a Raspberry Pi (running Raspbian) using PiVPN and I would like to

  1. either block the VPN clients to access specific websites (i.e. block them access https://www.foo.com and https://www.bar.com) or
  2. let them access them by using their IP and not the Raspberry's.

Furthermore, I am also using the UFW Firewall.

Is there a way to achieve that? Thank you in advance!

  • Are the websites in question behind Cloudflare? If so, then this is impossible without either getting your clients to accept a rogue root CA and spying on all of their connections, or blocking everything that's behind Cloudflare (which is a very large portion of the Internet). Feb 23 '20 at 18:46
  • Unfortunately, I am not aware if they are behind Cloudflare. Let's say that we are certain that foo.com is not behind Cloudflare. How can I block the access to it?
    – G. Digkas
    Feb 24 '20 at 12:06

I see three ways this could be implemented, but no real "perfect" solution. Here are your options:

  1. Drop requests to these sites at firewall level. This means you have to block the IPs of these websites, which might be doable for small sites (with a single IP and no LB or reverse proxy) but very hard / impossible for big sites. Also you'll have to block all Cloudflare's site if one of them is it the list... Not a very good option but once the IPs are blocked in the firewall you know for sure no one will reach them.
  2. Implement you own DNS server and blacklist the domain names. Since you said you are using a Raspberry, you could look into PiHole which is a DNS server for Raspberry. You'll then have to configure clients to use the Raspberry as their DNS server. This is easier to implement than the first one but it can be bypassed by changing DNS server in Wiregard option for the client.
  3. Redirect all VPN requests through a proxy doing some SSL inspection. VPN clients will have to install the proxy's CA on their device and then you can do some blacklisting on the "Host" header for example.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.