title: How to configure "client-to-site" VPN on GCP using OpenVPN?
body: <p><strong>TLDR;</strong> I have a web app, let's call it Tools, that I want to make available online to my team but not the rest of the world.</p>
  
  <p><strong>The Tools App.</strong> The app is containerised and can be deployed to one of my Kubernetes clusters on GCP. I intend to run it on a machine that lacks an external IP, but that can be accessed from other machines inside my GCP network.</p>
  
  <p><strong>Solution 1: Cloud VPN</strong>. I have read about <a href="https://cloud.google.com/vpn/docs/" rel="nofollow noreferrer">Googles Cloud VPN</a>  but that appears to primarily apply if you want to do network-to-network VPN. What I'm looking for is a client-to-site VPN. </p>
  
  <p><strong>Solution 2: OpenVPN</strong>. So instead I have read about OpenVPN. As I understand things I can setup my own instance of OpenVPN in my GCP network, give it an external IP and provision credentials to my team enabling them client access to the VPN server.</p>
  
  <p><strong>Goal</strong>. I want to be able to connect to my VPN, go into my browser and type "www.tools.mydomain.com" and end up at the webserver. If I type that domain without the VPN it should give "connection error" or something like that. </p>
  
  <p><strong>Question</strong>. How do I configure OpenVPN to ensure that traffic from the client is routed to my webserver inside GCP when you resolve the "tools.mydomain.com" adress? Is this even the best solution to achieve my goal? Any guidance is appreciated.</p>