Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to redirect connection to port 22 to my openvpn binded port, on 60001.

Openvpn is running on server on 60001

server:~$ sudo netstat -apn | grep openvpn
udp   0   0 67.xx.xx.137:60001*    4301/openvpn

I redirect on server port 22 to 60001

server:~$ sudo iptables -F -t nat
server:~$ sudo iptables -A PREROUTING -t nat -p udp --dport 22 -j REDIRECT --to-ports 60001

I start openvpn client (openvpn.conf is correct, it works with remote IP 22 replaced with remote IP 60001)

client:~$ ./openvpn openvpn.conf
Tue Apr 27 00:42:50 2010 OpenVPN 2.1.1 i686-pc-linux-gnu [SSL] [EPOLL] built on Mar 23 2010
Tue Apr 27 00:42:50 2010 UDPv4 link local (bound): [undef]:1194
Tue Apr 27 00:42:50 2010 UDPv4 link remote: 67.xx.xx.137:22
Tue Apr 27 00:42:52 2010 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Apr 27 00:42:55 2010 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

Connection fail. tcpdump capture on server side is:

server:~$ sudo tcpdump -n udp port 21 or port 60001
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
10:48:32.880307 IP 84.xx.xx.27.1194 > 67.xx.xx.137.21: UDP, length 14
10:48:35.039317 IP 84.xx.xx.27.1194 > 67.xx.xx.137.21: UDP, length 14
10:48:37.196800 IP 84.xx.xx.27.1194 > 67.xx.xx.137.21: UDP, length 14

So the packets arrive, but it doesn't connect. Openvpn.conf is correct, and openvpn client/server are working correctly, because if i replace remote IP 22 with remote IP 60001 all works. What's wrong with this redirection?

share|improve this question

Why don't you start with a tcpdump, are the packets definitely arriving at the server at all? Its possible a firewall in between is causing the connection refused.

Your iptables line looks correct to me.

Its best to used privileged ports for things like OpenVPN, otherwise an unprivileged user could potentially use that port and cause some nastiness.

nc -u 67.xx.xx.137 22

and type some input, to test without openvpn to make sure its doing what you think its doing. Typically if the port is closed your after your first line of input it will close, while if its open it will keep accepting. Of course it may close it because you sent it garbage, but that will appear in OpenVPN logs if that is the case.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.