Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I run a FreeBSD server with VirtualBox on it. There's a VM in there I'd like to contact via SSH directly using Port 20000.

Client and FreeBSD server are connected through OpenVPN via tun. The following graphic illustrates what the setup is supposed to look like.

enter image description here

Explanation:

The OpenVPN client IP is 10.8.0.6. It connects without problems to the Host at 10.8.0.1. When SSH is used through Port 20000 I'd like the connection to be redirected to the internal VM 192.168.56.10 Port 22.

--

However, this does not work. When I try to connect like that ssh 10.8.0.1 -p 20000 I get the response: Network is unreachable.

The current pf.conf looks like this:

udp_services = "{ openvpn }"
tcp_services = "{ http, https, smtp }"

ip_public="<PRIVATE>"
ip_vpn="10.8.0.1"
net_vpn="10.8.0.0/24"
net_vbox1="192.168.56.0/24"

if_lcl="lo0"
if_public="re0"
if_vpn="tun0"
if_vbox1="vboxnet0"

table <blockedips> persist file "/etc/blocked_ips.conf"

## Default handling
set block-policy return
set skip on lo0
scrub in all

rdr pass on $if_vpn proto {udp, tcp} from any to any port 20000 -> 192.168.56.10 port 22


block all
block drop in log quick on $if_public from <blockedips> to any


## Outgoing traffic
pass out on $if_public inet from $ip_public to any

## VM Traffic
pass out on $if_vbox1 inet from $if_vbox1 to $net_vbox1
pass in on $if_vbox1 inet proto tcp from any to $net_vbox1
pass in on $if_vbox1 inet proto udp from any to $net_vbox1
pass in on $if_vbox1 inet proto icmp from any to $net_vbox1 icmp-type echoreq

## VPN traffic
pass in on $if_vpn inet proto tcp from any to any
pass in on $if_vpn inet proto udp from any to any
pass in on $if_vpn inet proto icmp from any to any

## Incoming public trafic
pass in on $if_public inet proto tcp from any to $ip_public port $tcp_services
pass in on $if_public inet proto udp from any to $ip_public port $udp_services
pass in on $if_public inet proto icmp from any to $ip_public icmp-type echoreq

I've also tried redirecting HTTP via port 8080. That too didn't work. What am I doing wrong here? Thank you very much for any advice you might have.

share|improve this question
    
I found a workaround for now by using VirtualBox NAT. There's a great resource here. Since I'm using phpVirtualBox settings this up was really easy. Still I'm trying to make the redirect working as I'll sure need it at some point. –  please delete me Aug 27 '13 at 16:39
    
You might also push a route to 192.168.56.x in your openvpn configuration. –  arved Aug 31 '13 at 19:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.