I have an openvpn tunnel between two servers, the first one has a public static ip address and the second one is behind 2 nat. This last one has a subnet, clients are on the 192.168.15.x My vpn is working and I can ping every client on the 15.x network.
I'd like to route some port from the public ip to the local network behind nat but I am not able to reach clients.
For instance, I have
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 42024 -j DNAT --to 192.168.15.1:22
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 42025 -j DNAT --to 192.168.100.2:22
and ip_forward=1 on the server 1 (the one public on internet). The second line works, the first one not. 192.168.100.x is the subnet created by the vpn. 100.1 is the public one, 100.2 is the nat one. 192.168.15.1 is the local ip of the server. I also I am not able to DNAT to 192.168.15.2 and so on.
For having it working I have, on server 2 (the one behind nats) this
root@cosino ~ # cat /etc/iproute2/rt_tables
255 local
254 main
253 default
0 unspec
200 linoderouting
and
ip rule add from 192.168.100.2 table linoderouting
ip route add default via 192.168.100.1 table linoderouting
Why can't I DNAT ports to the local client or to the local ip of my server2?
EDIT1:
This is
root@cosino ~ # ip route show table linoderouting
default via 192.168.100.1 dev tun0
And this is the global route, on the same server
root@cosino ~ # ip route
192.168.100.1 dev tun0 proto kernel scope link src
192.168.100.2 10.50.50.0/26 dev eth0 proto kernel scope link src 10.50.50.13 metric 202
192.168.15.0/24 dev eth1 proto kernel scope link src 192.168.15.1
default via 10.50.50.1 dev eth0 metric 202
ip show route table linoderouting. – Zoredache Jan 30 at 18:12