I've got a situation I can't really handle on my own. I've got an openvpn server and a client, which actually is a debian based router. To my debian based router I've connected a pc with a static ip address. I want to be able to connect from the OpenVPN server to the pc on port 60.
[server: 10.8.0.1] -> [client (tun0): 10.8.0.3] -> [client (eth0_lan): 10.1.1.1] -> [pc: 10.1.1.3:60]
On the client, there are no iptables rules set. So I've started with:
iptables -t nat -A PREROUTING -p tcp -d 10.8.0.5 --destination-port 60 -j DNAT --to 10.1.1.3:60
Using tcpdump I can see the packets flowing
# tcpdump -i tun0 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes 12:14:38.456427 IP 10.8.0.1.49802 > 10.8.0.5.60: Flags [S], seq 3745909032, win 5840, options [mss 1368,sackOK,TS val 3685104628 ecr 0,nop,wscale 7], length 0 # tcpdump -i eth0_lan tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0_lan, link-type EN10MB (Ethernet), capture size 65535 bytes 12:15:36.928081 IP 10.8.0.1.49812 > 10.1.1.3.60: Flags [S], seq 378990321, win 5840, options [mss 1368,sackOK,TS val 3685163144 ecr 0,nop,wscale 7], length 0 12:15:36.928835 IP 10.1.1.3.60 > 10.8.0.1.49812: Flags [S.], seq 1252114870, ack 378990322, win 1448, options [mss 1460,sackOK,TS val 4593688 ecr 3685163144,nop,wscale 0], length 0
So packets are coming from my server and are forwarded to the pc. Unfortunately when pc responds, they only get to eth0_lan and are not getting to the tun0 interface.
I've tried adding:
iptables -A FORWARD -i eth0_lan -o tun0 -m state --state ESTABLISHED,RELATED -j ACCEPT
but it didn't help.
What iptables rule am I missing in here to make it work?
EDIT: This might or might not help:
# route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.8.0.0 * 255.255.255.0 U 0 0 0 tun0 192.168.1.0 * 255.255.255.0 U 0 0 0 eth1 192.168.1.0 * 255.255.255.0 U 0 0 0 wlan0 10.1.1.0 * 255.255.255.0 U 0 0 0 eth0_lan default debwrt.lan 0.0.0.0 UG 0 0 0 wlan0 default debwrt.lan 0.0.0.0 UG 0 0 0 eth1
Executed on the client, where debwrt.lan is: 192.168.1.1 [router on my network].