How to forward port from a remote server to a local machine behind NAT?

Question

Scenario:

Remote: CentOS 6, has public IP Remote<-->Internet

Local: Win10, behind NAT Local<--->Local Router--->ISP NAT--->Internet

Problem:

• Local wants to run a Service listening port 1234, but it's behind NAT so Local is not reachable to the public.
• The Service will attempt to obtain public IP automatically.

Desired result:

• Anyone visiting the Remote:1234 will be redirected to Local:1234.

If not, what are the other options ?

Thanks in advance !

Answer 1

This requirement is generally handled by a network security Engineer.

As per your post I understand that your internal hosted server wants to communicate to a remote server hosted in another network right?

Your internal hosted server should source NAT to an available static public IP allocated by ISP and we need to frame an outbound security policy in firewall as:

Source interface : inside interface of firewall
Destination interface : outside interface of firewall
Source address : server private IP(local IP)
Destination : remote server public IP
Service :TCP-1234
Action : allow
Security profiles :on

At the same time the server source NAT IP needs to be whitelisted at teh remote client, so that our traffic is allowed through the vendor firewall

Let's see the traffic flow

Step 1

When local server initiates traffic

1. source IP is local server private IP
2. destination IP is remote server public IP
3. port tcp-1234

Step 2

When traffic reaches the local hosted servers network perimeter firewall, the server local private IP is translated with the sourced NAT'd public IP

The source will be a local server source NAT'd public IP and destination will be remote server public IP with port tcp-1234

Now traffic will reach to the vendor. The vendor has already whitelisted our source NAT'd IP so traffic is allowed and will access the remote server on port tcp-1234

In the same way, reverse traffic flows and our local server will be able to access resources on the remote server.

Answer 2

Your can use any static public ip provided by your isp . If you don't have extra static ip from isp . You can use destination nat public ip for source nat as well . In case if server is not having destination nat public ip . Then your can use internet access ip

Example if your server is having internet access provided by your isp . In server go to browser and type "wat is my ip address " you whitelist same public ip at vendor. This is only in case when you don't have source or destination natted ip.

Answer 3

• I have no control to the ISP main router so source NAT won't work
• The Service will attempt to obtain public ip, so reverse ssh tunnel won't work

Solution

• Remote: VPN server (I use WireGuard)
• Local Router: VPN client
• Remote: Port forwarding to Local Router (iptables / firewalld)
• Local: DSCP tagging the Service
• Local Router: Policy routing the DSCP tag to VPN interface