I have a (Ubuntu) server on the LAN connecting to an OpenVPN server so that apps running on both machines can talk to each other over the Internet. Works great. All traffic to the WAN routes out through the VPN (NAT-ed through the router), and clients on the LAN can also access the server normally.
However, I also need to have arbitrary hosts on the Internet that are not on the VPN connect to the machine on the LAN over port 80. Simply forwarding port 80 on the router to the machine's IP doesn't work, since I assume return packets are being routed out over the VPN.
I'm not familair with iptables, but reading the man page, it looks like I might need something like this:
iptables -t mangle -A PREROUTING -i eth0 -j TEE --gateway 192.168.1.1 --protocol tcp --sport 80
but that's not the whole story, since I need a way of telling the packets on that port to then go out via eth0, I think. Or I could be totally wrong. Can anyone give me any pointers?