1

I have VNC Server that run on VPN client's computer, port 5900 and will connect to my VPN Server (ppp) which it is accessible via Internet users. The VPN server is CentOS 6.8 x64.

However, the current VPN Client ISP (not the VPN Server) isnt allow incoming connections from external/internet. In other word, they have secured and do something with the firewalls. For now, my VPN client is able to:

  • Connect to the Internet without VPN Server
  • Connect to the Internet with VPN Server
  • Port 5900 is open for VNC Server so that everyone can connect from LAN/MAN/WAN
  • Able to receive 5900 (LAN only) due ISP blocked the ports

My VPN Server is able to: - Receive and Transmit from VPN and internet

In VPN Server, which is the Centos 6.8, these are the iptables, which my VPN client is able to access to the Internet via VPN Server:

-A POSTROUTING -o eth0 -j MASQUERADE
-A INPUT -p tcp -m tcp --dport 5900 -j ACCEPT
-A FORWARD -d 210.48.222.2/32 -i eth0 -o ppp+ -p tcp -m tcp --dport 5900 -j ACCEPT
-A FORWARD -i ppp+ -o eth0 -j ACCEPT
-A FORWARD -i eth0 -o ppp+ -j ACCEPT

And these are the ifconfig in CentOS

eth0      Link encap:Ethernet  HWaddr 04:01:4C:C5:81:02
          inet addr:128.199.210.115  Bcast:128.199.255.255  Mask:255.255.192.0
          inet6 addr: 2400:6180:0:d0::45c:c001/64 Scope:Global
          inet6 addr: fe80::601:4cff:fec5:8701/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:163888 errors:0 dropped:0 overruns:0 frame:0
          TX packets:171866 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:178131279 (169.8 MiB)  TX bytes:179452807 (171.1 MiB)

eth1      Link encap:Ethernet  HWaddr 04:01:4C:C5:67:01
          inet addr:10.130.133.116  Bcast:10.130.255.255  Mask:255.255.0.0
          inet6 addr: fe80::601:4cff:fec5:8702/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 b)  TX bytes:566 (566.0 b)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:24797 errors:0 dropped:0 overruns:0 frame:0
          TX packets:24797 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2914752 (2.7 MiB)  TX bytes:2914752 (2.7 MiB)

ppp0      Link encap:Point-to-Point Protocol
          inet addr:128.199.210.115  P-t-P:210.48.222.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1396  Metric:1
          RX packets:33106 errors:0 dropped:0 overruns:0 frame:0
          TX packets:43985 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:3997842 (3.8 MiB)  TX bytes:39318955 (37.4 MiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00                                                                                        -00
          inet addr:10.50.0.1  P-t-P:10.50.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

I've reviewed iptables: How to forward packets with destination port 80 from eth0 to eth1?, it does works from eth0 to eth1, and try to apply from eth0 to ppp+, but it doesnt works. Or maybe I need to do add some more in iptables.

For the VPN, I've followed the steps in the article https://www.photonvps.com/billing/knowledgebase.php?action=displayarticle&id=58 is works (VPN client able to connect to VPN server)

However, I still unable to connect to my VPN client's VNC (port 5900) from the internet/other ISP without connecting the VPN Server. Is there any mistakes or missing in the iptables?

These are my plan:-

My PC (not the VPN user) > Remotely Access to > CentOS + VPN Server > Client (connected to the CentOS VPN)
Improve this question
5
  • This is confusing. If the Client's ISP blocks port 5900, then it won't be reachable. Using the VPN as you seem to have defined does allow My PC to reach port 5900 of the Client's but why don't you just use an unblocked port if you want to give public access? (Note that in either case it could possibly be a breach in the ISP's terms, justifying the block.)
    – Julie Pelletier
    Sep 26, 2016 at 6:06
  • Yes, its due of the term, they (the ISP) disallow incoming connections toward their clients / disallow their clients to give public access to the internet. They want their IPs' privated/closed-ports. In other words, they didnt just block the port, but their disable the incoming connection port-forwarding. I've never experienced this, but somehow with iptables especially the NAT things logically might solve this problem (for sure the drop/loss-rates with decreased to 10-20% (getting slower) due VPN), if it possible then it might be caused of my failure in iptables. Otherwise, its fine then.
    – Marhazk
    Sep 26, 2016 at 7:13
  • What exact IP address are you connecting to when trying to use RDP on the client machine?
    – Tero Kilkanen
    Sep 26, 2016 at 9:41
  • Your comment about packets loss does not relate well with the rest of the context. Either you have two separate issues, or we are missing the big picture.
    – Julie Pelletier
    Sep 26, 2016 at 17:01
  • Well, the VPN client, which is also working as VNC server IP address returned 210.48.222.2 and when I did the "whats my ip" via google, its returned 128.199.210.115. The VPN server which is the middleware (CentOS, IP address 128.199.210.115, also PPTP IP address 210.48.222.1) of my own PC to this VNC server/VPN user. However, my own PC basically dynamic IP. For now, Im still try to figure out by try-and-error, if its works, I'm gladly will post it here. If not, then still no solution yet at the moment.
    – Marhazk
    Sep 27, 2016 at 7:59

1 Answer 1

Reset to default
1

Its okay, problem solved, Its working fine (make the server to public access on blocked ISP via VPN) I just need to add these in /etc/sysconfig/iptables:

-A PREROUTING -p tcp -m tcp --dport 5900 -j DNAT --to-destination 210.48.222.2:5900
-A POSTROUTING -o ppp+ -j MASQUERADE
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .