ngix server available from OpenVPN remote server connection

[4o4rh]

I followed the thread and setup a second ngix instance to serve wpad/proxy files.
This is all working correctly.

The avast on one of my clients showed a HNS-WAN-ACCESS vulnerability on the server port of OpenVPN.
I have a block all rules on all lan/wan/vpn interfaces.

but sure enough, if i put in the openvpn server port address, i get a nginx 403 error.

http {
    include       /usr/local/etc/nginx/wpad-mime.types;
    default_type  application/octet-stream;

    sendfile        on;
	access_log      syslog:server=unix:/var/run/log,facility=local5 combined;
	keepalive_timeout 75;

    server {
		  listen 80;
        server_name  wpad;

        location / {
            location = /proxy.crt {
            }
            location = /favicon.ico {
            log_not_found off;
            } 
            allow 192.168.2.0/23;
            allow 192.168.5.0/23;
     	   deny all;

            root   "/usr/local/www/nginx";
            index  index.html index.htm;
        }
    }
}

what am i missing