Here's my scenario:

  1. Remote OpenVPN server v2.3.2, 1 public IP, CentOS 6.4, 2.6.32-042stab079.6
  2. Tunnelblick (OpenVPN client)

What I want to do is route all the client traffic through the VPN - and I accomplished that. I'm however experiencing problems in port forwarding clients port through the VPN.

e.g. I need port 5780 for hosting a game match on the client, but I'm behind the VPN, therefore the VPN gets the packets. I'd like the VPN to forward every packet on port 5780 to my client IP address.

How can I do so? Please note that the remote server runs CSF+LFD.

  • "I'm however experiencing problems in port forwarding clients port through the VPN." What have you tried here? What config settings? Where have they failed? What's in the logs? – 89c3b1b8-b1ae-11e6-b842-48d705 Nov 27 '13 at 15:51

You should NAT the packets to your client via iptables:

iptables -t nat -A PREROUTING -p tcp --dport 5780 -i $external_Interface -j DNAT --to-destination $VPN_client_IP
iptables -t nat -A POSTROUTING -o $vpn_Interface -j MASQUERADE

Update: You will also need a FORWARD rule in place if your FORWARD policy is set to DROP. As you can see here, the FORWARD takes place between the PREROUTING and POSTROUTING, therefore the DNAT is already done. This should work:

iptables -I FORWARD -i $external_Interface -d $VPN_client_IP --dport $port -j ACCEPT
  • I added the following rules: sbin/iptables -t nat -A PREROUTING -p tcp --dport 51413 -i eth0 -j DNAT --to-destination /sbin/iptables -t nat -A PREROUTING -p udp --dport 51413 -i eth0 -j DNAT --to-destination /sbin/iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE but the packets don't seem to get forwarded looking at tcpdump. – markkuit Nov 27 '13 at 15:51
  • Is IP forwarding enabled? Check cat /proc/sys/net/ipv4/ip_forward. As you're running CSF+LFD , there are probably a lot more rules, you should check your whole iptables configuration. – etagenklo Nov 27 '13 at 20:50
  • Yes, it is. It's in sysctl.conf as well – markkuit Nov 27 '13 at 21:05
  • Check your iptables config. What else is in there? – etagenklo Nov 27 '13 at 21:08
  • As iptables -L states: sprunge.us/jjFP – markkuit Nov 27 '13 at 23:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.