0

I'm running an openvpn server on my VPS with a public IP. There is a backend server connected to the VPN. These are the IPs on the VPN: VPS: 10.8.0.1 backend server: 10.8.0.2. eth0 is the public interface, tun0 is the VPN interface

Now, I'd like to forward, for instance, port 22 on the backend server to port 2200 on the VPS. Here is what I did on the VPS (based on several tutorials and already asked questions):

  1. opened port 2200
  2. enabled IPv4 forwarding
  3. put this into /etc/ufw/before.rules (yes, I'm using ufw and it works correctly):

    *nat

    :PREROUTING ACCEPT [0:0]

    :POSTROUTING ACCEPT [0:0]

    -A PREROUTING -i eth0 -p tcp --dport 2200 -j DNAT --to-destination 10.8.0.2:22

    -A POSTROUTING -d 10.8.0.2 -p tcp --dport 22 -j SNAT --to-source VPS-public-IP:2200

    -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

  4. Reloaded ufw or even rebooted everything...

  5. Tried other solutions, commenting some lines out (such as the first POSTROUTING rule above). Nothing -obviously- helped.

Output of nmap VPS-public-IP -p 2200 says the port is 'filtered' and when I try to ssh to port 2200, it just hangs and does nothing, I don't even get any error - that also happens when i try to ssh from the VPS to the backend server over the VPN (which normally works). What am I missing?

  • You may want to have the SNAT rule set the source to 10.8.0.1, otherwise the backend server wont route the packets over the tunnel. – Torin Mar 19 '18 at 21:12
  • Thanks, @TorinCarey , I've just fixed that, but there must be stg else wrong cause the behavior hasn't changed. – Ondřej Kučera Mar 19 '18 at 23:16
0

For people who might still be looking for a solution.

Depending on your FORWARD policy (assuming its DROP)

iptables -t nat -A PREROUTING -p tcp -d xx.xx.xxx.xxx --dport 80 
         -j DNAT --to-destination yyy.yyy.yy.yy:80
iptables -A FORWARD  -p tcp -d yyy.yyy.yy.yy --dport 80 -j ACCEPT
Result:  x:80 --> X --y:80--> Y

iptables -t nat -A POSTROUTING -p tcp -d yyy.yyy.yy.yy --dport 80
         -j SNAT --to-source xx.xx.xxx.xxx
Result:  x:80 --> X <--y:80--> Y

iptables -A FORWARD  -p tcp -s yyy.yyy.yy.yy --sport 80 -j ACCEPT
Result:  x:80 <--> X <--y:80--> Y

Also might add this rule for locally initiated connections: x --> x:80

iptables -t nat -A OUTPUT -p tcp --dport 80 -d xx.xx.xxx.xxx
         -j DNAT --to-destination yyy.yyy.yy.yy:80  
Result:       
  x:80 ->- X <--y:80--> Y
     |_____V

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.