I'm running an openvpn server on my VPS with a public IP. There is a backend server connected to the VPN. These are the IPs on the VPN: VPS: backend server: eth0 is the public interface, tun0 is the VPN interface

Now, I'd like to forward, for instance, port 22 on the backend server to port 2200 on the VPS. Here is what I did on the VPS (based on several tutorials and already asked questions):

  1. opened port 2200
  2. enabled IPv4 forwarding
  3. put this into /etc/ufw/before.rules (yes, I'm using ufw and it works correctly):




    -A PREROUTING -i eth0 -p tcp --dport 2200 -j DNAT --to-destination

    -A POSTROUTING -d -p tcp --dport 22 -j SNAT --to-source VPS-public-IP:2200


  4. Reloaded ufw or even rebooted everything...

  5. Tried other solutions, commenting some lines out (such as the first POSTROUTING rule above). Nothing -obviously- helped.

Output of nmap VPS-public-IP -p 2200 says the port is 'filtered' and when I try to ssh to port 2200, it just hangs and does nothing, I don't even get any error - that also happens when i try to ssh from the VPS to the backend server over the VPN (which normally works). What am I missing?

  • You may want to have the SNAT rule set the source to, otherwise the backend server wont route the packets over the tunnel.
    – Torin
    Commented Mar 19, 2018 at 21:12
  • Thanks, @TorinCarey , I've just fixed that, but there must be stg else wrong cause the behavior hasn't changed. Commented Mar 19, 2018 at 23:16

1 Answer 1


For people who might still be looking for a solution.

Depending on your FORWARD policy (assuming its DROP)

iptables -t nat -A PREROUTING -p tcp -d xx.xx.xxx.xxx --dport 80 
         -j DNAT --to-destination yyy.yyy.yy.yy:80
iptables -A FORWARD  -p tcp -d yyy.yyy.yy.yy --dport 80 -j ACCEPT
Result:  x:80 --> X --y:80--> Y

iptables -t nat -A POSTROUTING -p tcp -d yyy.yyy.yy.yy --dport 80
         -j SNAT --to-source xx.xx.xxx.xxx
Result:  x:80 --> X <--y:80--> Y

iptables -A FORWARD  -p tcp -s yyy.yyy.yy.yy --sport 80 -j ACCEPT
Result:  x:80 <--> X <--y:80--> Y

Also might add this rule for locally initiated connections: x --> x:80

iptables -t nat -A OUTPUT -p tcp --dport 80 -d xx.xx.xxx.xxx
         -j DNAT --to-destination yyy.yyy.yy.yy:80  
  x:80 ->- X <--y:80--> Y

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .