Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an openvpn tunnel between two servers, the first one has a public static ip address and the second one is behind 2 nat. This last one has a subnet, clients are on the 192.168.15.x My vpn is working and I can ping every client on the 15.x network.

I'd like to route some port from the public ip to the local network behind nat but I am not able to reach clients.

For instance, I have

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 42024 -j DNAT --to
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 42025 -j DNAT --to

and ip_forward=1 on the server 1 (the one public on internet). The second line works, the first one not. 192.168.100.x is the subnet created by the vpn. 100.1 is the public one, 100.2 is the nat one. is the local ip of the server. I also I am not able to DNAT to and so on.

For having it working I have, on server 2 (the one behind nats) this

root@cosino ~ # cat /etc/iproute2/rt_tables
255     local
254     main
253     default
0       unspec
200 linoderouting


ip rule add from table linoderouting
ip route add default via table linoderouting

Why can't I DNAT ports to the local client or to the local ip of my server2?


This is

root@cosino ~ # ip route show table linoderouting
default via dev tun0

And this is the global route, on the same server

root@cosino ~ # ip route dev tun0 proto kernel scope link src dev eth0 proto kernel scope link src metric 202 dev eth1 proto kernel scope link src
default via dev eth0 metric 202
share|improve this question
Are you sure you have the port opened? –  Khaled Jan 30 '12 at 15:39
I do have a firewall on both servers but to keep it simple I am working without firewalls. So yes, my ports are not filtered. Thanks –  Federico E. Galli Jan 30 '12 at 15:42
Can you show the full route table for linoderouting? ip show route table linoderouting. –  Zoredache Jan 30 '12 at 18:12
I edit the question –  Federico E. Galli Jan 30 '12 at 22:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.