1

I have an Ubuntu 14 server that is running OpenVPN gateway and ufw. Let's call it Server A.

I have an IP reservation for a permanently connected server (Server B). It always connects to OpenVPN and gets an IP of 10.8.0.10.

I need to forward connections to port 5010 on Server A to Server B's port 22 (SSH).

I have the following in before.rules:

# NAT table rules
*nat
:PREROUTING ACCEPT [0:0]
# Route SSH to archimedes
-A PREROUTING -p tcp -i eth0 --dport 5010 -j DNAT --to-destination 10.8.0.10:22

:POSTROUTING ACCEPT [0:0]
# Allow traffic from OpenVPN client to eth0
-A POSTROUTING -s 10.8.0.0/8 -o tun0 -j MASQUERADE
# END OPENVPN RULES
COMMIT

DEFAULT_FORWARD_POLICY="ACCEPT" is set in /etc/default/ufw net.ipv4.ip_forward=1 is set in /etc/ufw/systl.conf

If I SSH into Server and and try to SSH from it directly to 10.8.0.10 (Server B's VPN assigned IP on tun0 interface), I can connect just fine.

Any attempt to connect to Server A's port 5010 fails with a timeout. What did I miss?

3
  • Did you allow port 5010 in the INPUT chain of iptables? – Zalmy Aug 17 '15 at 2:10
  • @Zalmy I did UFW allow 5010 from anywhere to anywhere. But I think PREROUTING happens before what I have added. I don't know if it affected INPUT chain though. – Maxim V. Pavlov Aug 17 '15 at 7:25
  • thi s happens with the vpn active AND you connected to the vpn ? the vpn have vpn routing policies ? – Yonsy Solis Dec 30 '15 at 14:42
0
  1. Instead of a prerouting magic, why not connect directly using the VPN ?
  2. If you can't connect using the VPN, then better do an SSH config using ProxyCommand in your ~/.ssh/config file to directly connect to VPN (and this will need to be another question if you don't know how do this)
  3. Your VPN have more route policies for several networks ? we need more details to see if we have more route policies that can be the problem's origin. Check with iptables with:

sudo iptables -L -t nat

and check if the prerouting policy is applied.

1
  • this is not what was asked. – shadowbq May 13 '16 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.