I have managed to get openvpn setup and get it to issue static internal ips to clients. Now the trouble i have is I'm now trying to assign open port per client as they now have static internal ip it makes it easy be ready to add rules. Where im running into issues is with how to do this properly via iptables.

Client's pushed internal static ip example would be to have port 1234 forwarded

I have tried this with no luck vpn does use udp and on port 1194 but have tried the below rules modified as udp and as tcp and both together. Please note vpn already works and has the masquerade rules but other then that iptables is empty.

iptables -t nat -A PREROUTING -p tcp --dport 1234 -j DNAT --to-destination
iptables -A FORWARD -s -p tcp --dport 1234 -j ACCEPT

I have also tried being gateway and being client needing port all ports forwarded

iptables -t nat -A PREROUTING -d -j DNAT --to-destination

I'm trying to accomplish 2 things first being able to forward a port per client and if necessary a static public ip if they need all ports forwarded.

openvpn server.conf

local #- your_server_ip goes here
port 1194 #- port
proto udp #- protocol
client-config-dir /etc/openvpn/ccd
push "route"
ifconfig-pool-persist /etc/openvpn/openvpn.dhcp 30
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf
push redirect-gateway def1
push dhcp-option DNS
push dhcp-option DNS
keepalive 5 30
status 1194.log
verb 3


# Generated by iptables-save v1.3.5 on Sun Aug 26 14:27:12 2012
:PREROUTING ACCEPT [4834:503608]
:OUTPUT ACCEPT [1000:70847]
# Completed on Sun Aug 26 14:27:12 2012
# Generated by iptables-save v1.3.5 on Sun Aug 26 14:27:12 2012
:INPUT ACCEPT [21545:23742094]
:OUTPUT ACCEPT [14867:1938275]
# Completed on Sun Aug 26 14:27:12 2012

Works fine for me. A couple things to check:

  • This won't NAT connections made from the VPN server itself, for this you need the rule in the OUTPUT chain.
  • Is the client configured to route all traffic through the VPN? If not you may find that the response packets are not being sent back through the VPN.
  • Are you sure you're using the client side IP address, and not the server's side of that client's point-to-point connection?
  • You want to match a specific destination IP in the rule otherwise you'll catch other connections on that port number.
  • NATing all connections to is likely to cause problems, since all clients route traffic through this IP.
-A  PREROUTING -p tcp -m tcp --dport 1234 -j DNAT --to-destination

is what your looking for :)

went through this same issue myself

I see and assume your using the ccd file to push the static internal ip? if so the above rule should work when edited into your iptables

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.