Mastering VPN Integration: How I Successfully Configured NordVPN on Linux with SSL for Secure WordPress Hosting

Navigating the complexities of integrating a dedicated VPN IP with SSL certificates to protect your online assets while maintaining seamless access to your WordPress sites

This article summarizes or chronicles my efforts to get behind a VPN to protect my web hosting of sites and in particular, my WordPress blog and IT reseller sites. Let me first start out by saying, “Caveat emptor” which translates to “Let the buyer beware.” What I mean by that is that if you’re on shared hosting, it’s likely you won’t be able to do any of this as you won’t have permission/ you don’t own the hosting site, you just share it with others. The other thing is, you have to have some advanced skills to go command line interface (CLI) on Linux to manipulate and change everything from host and site files to SSL (secure socket layer) certificate files that secure your website. You must also be patient when manipulating DNS (domain name server) records, and so on. That being said, the objective is to secure your web sites!

Although I think I have mentioned previously, it bears repeating that security and site backups are a must and not an option as it’s only a matter of when and not if your system(s) may be compromised. This goes from using 2-factor security and apps like Google Authenticator or VPN (virtual private networks) that mask your real ip (internet protocol) or site address.

Many sites advertise that they scan for malware—and while that’s true, what they often don’t tell you is that they don’t guarantee to clean or remediate it. The typical scenario? You’re informed that you have malware, and when you ask if they can remove it, the response is, “Yes, for an additional fee. Your current subscription doesn’t cover malware remediation or rootkit removal.” And the cost? It could be anywhere from $75 to $150, depending on what they find. I know this all too well from prior experience. So what do you get with a VPN?

The importance of a VPN masking your real IP address lies in the additional layer of security and privacy it provides. Here’s why it matters:

1. Anonymity: By masking your IP address, a VPN helps protect your identity online. Your real IP address is tied to your physical location and can be used to trace your activities back to you. A VPN routes your internet traffic through its servers, making it appear as though you’re browsing from a different location, which adds a layer of anonymity.
2. Security: Even if attackers can target the VPN server’s IP address, they still can’t trace the traffic back to your actual IP address. This adds an extra hurdle for potential attackers who might otherwise try to directly attack your VPS or network.
3. Protection from Targeted Attacks: Some attackers specifically target known IP ranges or organizations. By using a VPN, you can avoid being an easy target simply by having a recognizable or static IP address. The VPN’s IP addresses are often shared among many users, which makes it more difficult for an attacker to single you out.
4. Geo-restriction Bypass: Masking your IP address allows you to bypass geo-restrictions, enabling access to content and services that might be blocked in your region.
5. Mitigating DDoS Attacks: VPNs can help protect against Distributed Denial of Service (DDoS) attacks by masking your real IP address. If an attacker doesn’t know your actual IP, they can’t easily flood your server with traffic.

While a VPN is not foolproof and can still be a target, the layered security it offers makes it significantly harder for attackers to directly impact your VPS. Essentially, a VPN adds complexity to the attacker’s task, reducing the likelihood of a successful breach.

Pros of a Dedicated VPN IP:

1. Consistency: A dedicated IP provides a consistent IP address for your activities. This can be beneficial for services that require regular access from the same IP, such as banking websites, remote work environments, or running a business website.
2. Reduced Captchas and Access Issues: With a dedicated IP, you are less likely to encounter issues like captchas or blocked access, which can happen when using shared VPN IPs that may have been flagged due to misuse by other users.
3. Better for Hosting Services: If you’re hosting a website or service on your VPS, a dedicated IP allows you to maintain a stable and recognizable address for your domain, which can be important for SSL certificates and reliable access.

Cons of a Dedicated VPN IP:

1. Reduced Anonymity: While your real IP address is still hidden, using a dedicated VPN IP reduces your anonymity compared to a shared IP. Since the IP is only used by you, your activities can be more easily associated with this specific IP, reducing the obfuscation that a shared IP provides.
2. Targeting Potential: Since the dedicated IP is consistently associated with your activities, it can become a target for attackers. If an attacker discovers this IP, they may be able to focus their efforts on breaching it, much like they would with a non-VPN static IP.
3. Not Fully Anonymous: The dedicated IP is still under the control of the VPN provider. While this adds a layer of separation between your real IP and the internet, it does not provide the same level of anonymity as using a shared IP, where your traffic is mixed with that of many other users.

Overall Impact:

• Security: You still gain the benefit of masking your real IP, which keeps your actual location and identity hidden. However, if the dedicated IP is compromised or known, it could still become a target.
• Privacy: Using a dedicated IP reduces the anonymity provided by the VPN, as your activities are more directly associated with this single IP address.
• Flexibility: A dedicated IP can be useful if you need a consistent IP for specific services, but it sacrifices some of the anonymity and protection against tracking that comes with using a shared IP.

In summary, while a dedicated VPN IP offers benefits in terms of consistency and accessibility, it does slightly reduce the level of anonymity and potentially increases the risk of being targeted compared to using a shared VPN IP.

My Challenges getting behind NordVPN on Linux

WARNING! This part is going to be kind of technical and may hurt if you continue reading! Here’s a summary of the steps I took to successfully configure my server with NordVPN while maintaining functionality for your websites:

Initial Setup & Issues

1. NordVPN Connection & DNS Records:
   • I connected to NordVPN using a dedicated IP address (new IP) and changed my DNS records to reflect this new IP. However, my sites didn’t work as expected. 🙁
   • I later realized that the SSL certificates were likely bound to the old IP, and the new wildcard SSL didn’t resolve the issue immediately. I would find out it didn’t work for my storefront.360web storefront that ended up using its old SSL.
2. SSL Configuration:
   • After generating a wildcard SSL certificate (can be used for many subdomains), I switched back to the old IP but experienced issues with the WordPress wp-config.php file and SSL settings, which were causing the sites not to load properly. Actually the wildcard SSL, which I didn’t know at the time, was good for the main site, but the issue was a line 89 of config file and the following: ‘if (isset($_SERVER[‘HTTP_X_FORWARDED_PROTO’]) && $_SERVER[‘HTTP_X_FORWARDED_PROTO’] === ‘https’) { $_SERVER[‘HTTPS’] = ‘on’; }’
   • I deleted the line 89 from the wp-config and then switched back to the original SSL files (cert1), which brought the sites back up. Again, I found out later that the wildcard SSL (cert2) works for the main WordPress site.

Final Working Configuration

1. DNS Configuration:
   • DNS Records: I decided (figured out) to leave the DNS records pointing to the old IP.
   • Hosts File: I updated the /etc/hosts file on the VPS to point to the new IP, forcing the VPS to resolve the domain internally to the new IP and NordVPN.
2. SSL Certificates:
   • Wildcard SSL: I configured drbill360.net to use the wildcard SSL (cert2). This SSL configuration worked correctly after testing with the openssl command connected or disconnected to NordVPN.
   • Storefront SSL: For store.360web.drbill360.net, I needed to ensure it was pointing to the correct SSL files (cert1), as the wildcard SSL caused issues for the storefront.
3. Testing and Verification:
   • I tested the setup by connecting to NordVPN and checking site functionality without changing the DNS records. The sites worked as expected with the wildcard SSL on drbill360.net and the original SSL on the storefront.
   • After making these changes, everything worked well. Why does this work? Possible the VPN masks an ip and not replace it.

Key Takeaways

• DNS Record: Keep DNS records pointing to the old IP.
• Hosts File: Update the hosts file to resolve the domain to the NordVPN new IP internally when connected to NordVPN. Note, if you don’t have many sites, i.e., only have one– it may be a lot easier to connect to NordVPN without a dedicated ip address and be even more safe.
• SSL Certificates: Use the wildcard SSL for drbill360.net and the original SSL (cert1) for store.360web.drbill360.net.
• Service Restart: Remember to restart Nginx after making changes to the hosts file or SSL configuration.

By following this approach, you successfully balanced using NordVPN for security while maintaining the functionality of your websites. Resolved!

I would love to hear from you!