1

My current network setup consists of a physical nic eth1 receiving my public ip from the modem. Next I have kvm/qemu virtual machines running on a virtual network using the ip range 192.168.122.0 - 200 witch is the default NAT network created by kvm. My issue is that I have a virtual server running my OpenVPN server that needs to be accessible outside the LAN. The VPN server has a static ip of 192.168.122.4. I would like to port forward ports 943,1194 to my vpn server, how would i do this in the linux iptables?

NOTE: the following rules were added to the iptables by kvm: I also have other rules for filtering but I don't think those are necessary to show.

:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
-A POSTROUTING -p udp -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -p tcp -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 -d 255.255.255.255/32 -j RETURN
-A POSTROUTING -s 192.168.122.0/24 -d 224.0.0.0/24 -j RETURN
-A POSTROUTING -s 192.168.122.93/32 -j SNAT --to-source (my public ip)    
0

The following should do the trick, it will take all traffic on you public interface coming in for the VPN ports and change the destination to your VPN machine.

iptables -t nat -A PREROUTING -i eth1 -p tcp -m multiport --dports 943, 1194 -j DNAT --to 192.168.122.4
iptables -t nat -A PREROUTING -i eth1 -p tcp -m multiport --dports 943, 1194 -j DNAT --to 192.168.122.4

This asummes you don't have any rules filtering your forward. If you do the following line will allow all traffic from the outside to your VPN machine.

iptables -A FORWARD -i eth1 -d 192.168.122.4 -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.