I built a server(S) with openvpn.
And there might be several vpn clients(C1~C10) providing SSH/FTP/HTTP behind "S"
Several users(U1~U10) on internet will login through 'S' to access their own machine (C1~C10).
Assume that the U3 ip is 22.214.171.124
the S ip is 126.96.36.199
the C3 vpn ip is 10.8.0.6
and the forwarding port is '55555'
If a user(U3) types the correct user/pwd
--> 'S' will query which client(C3) belongs to the user and get its IP,
then DYNAMICALLY portforward the user(U3) to his client(C3) with:
//(only the 188.8.131.52 can access 10.8.0.6) iptables -t nat -I PREROUTING -i eth0 -s 184.108.40.206 -p tcp --dport 55555 -j DNAT --to-destination 10.8.0.6:80
It's success so far.
But after the user logout, I delete this rule with
iptables -t nat -D PREROUTING -i eth0 -s 220.127.116.11 -p tcp --dport 55555 -j DNAT --to-destination 10.8.0.6:80
This rule no more exist in 'iptables -t nat -L -n',
but the user U3 can still directly access C3 with 18.104.22.168:55555
That rule keep working even I type the following and reboot.
iptables -t -nat -F
Help! Could anyone tell me what's wrong or is there a better way
I've found what the problem is.
I test what above with HTTP, but there is a proxy server at 'U3' side.
That is, what you see is old data cached by proxy.
Try other protocols, such as SSH or NC, the the result is correct.
But... that means this iptables mechanism may not work well if a user use proxy,
How could I solve this problem?