Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a situation I can't really handle on my own. I've got an openvpn server and a client, which actually is a debian based router. To my debian based router I've connected a pc with a static ip address. I want to be able to connect from the OpenVPN server to the pc on port 60.

[server: 10.8.0.1] -> [client (tun0): 10.8.0.3] -> [client (eth0_lan): 10.1.1.1] -> [pc: 10.1.1.3:60]

On the client, there are no iptables rules set. So I've started with:

iptables -t nat -A PREROUTING -p tcp -d 10.8.0.5 --destination-port 60 -j DNAT --to 10.1.1.3:60

Using tcpdump I can see the packets flowing

# tcpdump -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
12:14:38.456427 IP 10.8.0.1.49802 > 10.8.0.5.60: Flags [S], seq 3745909032, win 5840, options [mss 1368,sackOK,TS val 3685104628 ecr 0,nop,wscale 7], length 0


# tcpdump -i eth0_lan
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0_lan, link-type EN10MB (Ethernet), capture size 65535 bytes
12:15:36.928081 IP 10.8.0.1.49812 > 10.1.1.3.60: Flags [S], seq 378990321, win 5840, options [mss 1368,sackOK,TS val 3685163144 ecr 0,nop,wscale 7], length 0
12:15:36.928835 IP 10.1.1.3.60 > 10.8.0.1.49812: Flags [S.], seq 1252114870, ack 378990322, win 1448, options [mss 1460,sackOK,TS val 4593688 ecr 3685163144,nop,wscale 0], length 0

So packets are coming from my server and are forwarded to the pc. Unfortunately when pc responds, they only get to eth0_lan and are not getting to the tun0 interface.

I've tried adding:

iptables -A FORWARD -i eth0_lan -o tun0 -m state --state ESTABLISHED,RELATED -j ACCEPT

but it didn't help.

What iptables rule am I missing in here to make it work?

EDIT: This might or might not help:

# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.8.0.0        *               255.255.255.0   U     0      0        0 tun0
192.168.1.0     *               255.255.255.0   U     0      0        0 eth1
192.168.1.0     *               255.255.255.0   U     0      0        0 wlan0
10.1.1.0        *               255.255.255.0   U     0      0        0 eth0_lan
default         debwrt.lan      0.0.0.0         UG    0      0        0 wlan0
default         debwrt.lan      0.0.0.0         UG    0      0        0 eth1

Executed on the client, where debwrt.lan is: 192.168.1.1 [router on my network].

share|improve this question
    
Just trying to clarify, here: You're logged in to 10.8.0.1 and you want to connect 10.1.1.1:60? I don't think you need any NAT rules, here, just a route through the VPN and a FORWARD rule on the Debian box to allow the traffic through at that end. –  SmallClanger Feb 23 '11 at 14:24
    
On 10.8.0.1 I want to connect to 10.8.0.3:60 and have all the packets forwarded to 10.1.1.3:60. Packet forwarding seems to work fine with the rule I've set, however they are not coming back to 10.8.0.1. –  Krystian Feb 23 '11 at 16:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.