Iptables Port-forwarding while preserving client IP

Question

TL;DR: How can I get the client ip connecting to a remotely hosted VPS to be the IP that gets forwarded/natted, via iptables, to a game server running at my house?

I have a Rust game server that I am hosting at my house. I want that to be public, however I don't necessarily want to give out my IP address to everyone. So I am renting a small VPS that intend to use basically as a reverse proxy. I am currently using nginx to forward traffic over a clinet-server VPN, which works fine. However, on the game server every players IP is that of the tunnel address of the VPS, not the actual client IP. I tried using proxy_pass $remote_addr:28015 transparancy; proxy_responses 0 in my nginx config, no change. So i then switched to doing it via iptables.

I can get it work 99% the way I want, doing exactly this:

sysctl net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -p tcp --dport 28015 -j NAT --to-destination my_ip:28015
iptables -t nat -A PREROUTING -p udp --dport 28015 -j NAT --to-destination my_ip:28015
iptables -t nat -A PREROUTING -p tcp --dport 28016 -j NAT --to-destination my_ip:28016
iptables -t nat -A PREROUTING -p udp --dport 28016 -j NAT --to-destination my_ip:28016
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -p tcp -d my_ip --dport 28015 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p ucp -d my_ip --dport 28015 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
ufw disable
ufw enable
vps reboot \

What this does is basically the same as nginx, where it works fine, but everyone just has the public ip of the VPS(note, that the LAN and Public ip address of the VPS are the same). If I omit the masqurade, it does not work.

Some info on the setup:
VPS has a single interface: eth0
VPS is running Ubuntu 20.04
At my house, modem is in passthru mode to pfsesne. On pfsense i have port forwarding rules to pass 28015/28016 tcp/udp to gameserver.

Sidenote: I'm not sure why nginx did not work for this. It was almost as if nginx was doing nothing with the proxy_pass $remote_addr directive.

Answer 1

You cannot do this with IPTables. For bi-directional packet forwarding to work properly, the source IP address of the packets sent from your VPS must contain the VPS address. Otherwise the reply packets wouldn't be sent to the VPS, which forwards them to clients.

You need layer 7 protocol support to relay the original IP address to your application. In HTTP / HTTPS, this is done as follows:

1. nginx reverse proxy works on your VPS.
2. The reverse proxy adds header X-Forwarded-For: <clientip> to request it sends to origin servver.
3. Origin server reads the header and uses it as client IP address instead of using the IP address associated with the TCP socket.

Another possibility is to use SOCKS proxy between the VPS and origin server. SOCKS proxy encapsulates the traffic from client, and adds additional metadata such as client IP address.