port forwarding to backend server

Question

I'm running an openvpn server on my VPS with a public IP. There is a backend server connected to the VPN. These are the IPs on the VPN: VPS: 10.8.0.1 backend server: 10.8.0.2. eth0 is the public interface, tun0 is the VPN interface

Now, I'd like to forward, for instance, port 22 on the backend server to port 2200 on the VPS. Here is what I did on the VPS (based on several tutorials and already asked questions):

1. opened port 2200
2. enabled IPv4 forwarding

3. put this into /etc/ufw/before.rules (yes, I'm using ufw and it works correctly):

   *nat

   :PREROUTING ACCEPT [0:0]

   :POSTROUTING ACCEPT [0:0]

   -A PREROUTING -i eth0 -p tcp --dport 2200 -j DNAT --to-destination 10.8.0.2:22

   -A POSTROUTING -d 10.8.0.2 -p tcp --dport 22 -j SNAT --to-source VPS-public-IP:2200

   -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

4. Reloaded ufw or even rebooted everything...

5. Tried other solutions, commenting some lines out (such as the first POSTROUTING rule above). Nothing -obviously- helped.

Output of nmap VPS-public-IP -p 2200 says the port is 'filtered' and when I try to ssh to port 2200, it just hangs and does nothing, I don't even get any error - that also happens when i try to ssh from the VPS to the backend server over the VPN (which normally works). What am I missing?

Answer 1

For people who might still be looking for a solution.

Depending on your FORWARD policy (assuming its DROP)

iptables -t nat -A PREROUTING -p tcp -d xx.xx.xxx.xxx --dport 80 
         -j DNAT --to-destination yyy.yyy.yy.yy:80
iptables -A FORWARD  -p tcp -d yyy.yyy.yy.yy --dport 80 -j ACCEPT
Result:  x:80 --> X --y:80--> Y

iptables -t nat -A POSTROUTING -p tcp -d yyy.yyy.yy.yy --dport 80
         -j SNAT --to-source xx.xx.xxx.xxx
Result:  x:80 --> X <--y:80--> Y

iptables -A FORWARD  -p tcp -s yyy.yyy.yy.yy --sport 80 -j ACCEPT
Result:  x:80 <--> X <--y:80--> Y

Also might add this rule for locally initiated connections: x --> x:80

iptables -t nat -A OUTPUT -p tcp --dport 80 -d xx.xx.xxx.xxx
         -j DNAT --to-destination yyy.yyy.yy.yy:80  
Result:       
  x:80 ->- X <--y:80--> Y
     |_____V