There are various ways to implement what you want. Draw your network topology.
It requires only single DNAT rule on the S2 (server in the new DC) and additinal routing configuration on the S1 (server in the old DC). But it also requires what your app accept the requests on the VPN tunnel address too.
S2 server iptables configuration:
iptables -t nat -A PREROUTING \
-i eth0 --dst <S2.IP> \
-p tcp --dport <APP.PORT> \
-j DNAT --to-address <S1.TUN.IP>:<APP.PORT>
Also, you should enable the forwarding on the
S2 server (use the
sysctl -w net.ipv4.ip_forward=1 command to enable it).
Verification: use the
ip route get <S1.TUN.IP> from 18.104.22.168 iif <S2.IFACE> and
ip route get 22.214.171.124 from <S1.TUN.IP> iif <S2.TUN.IFACE> command. It should return the valid routes.
S1 server routing configuration:
ip route add 0/0 dev <TUN.IFACE> table 1
ip rule add from <S1.TUN.IP> lookup 1 pref 1000
LINUX replies on the request from the same ip address, on what request has been received.
Verification: use the
ip route get <S1.TUN.IP> from 126.96.36.199 iif <S1.TUN.IFACE> and
ip route get 188.8.131.52 from <S1.TUN.IP> commands. It also should return the valid routes. Maybe you will see something like
invalid cross-device link. In this case you should tune the
rp_filter on the vpn tunnel interface.
- Client sends the request in form of
<C.IP>:<SOME.PORT> -> <S2.IP>:<APP.PORT>.
S2 server receives this request, rewrites the destination to
<S1.TUN.IP>. It happens before routing, so after this step the packet will form of
<C.IP>:<SOME.PORT> -> <S1.TUN.IP>:<APP.PORT>.
S2 forwards the rewritten request through VPN tunnel due the routing table.
S1 receives the request through VPN tunnel to
- Your app on
S1 serves the request and replies to client with source address
<S1.TUN.IP>. The reply is
<S1.TUN.IP>:<APP.PORT> -> <C1.IP>:<SOME.PORT>.
- By routing rule all packets with source address
<S1.TUN.IP> routes by the routing table
1. So, the replied packets from your app will be sent through VPN tunnel to
S2 receives the replies, make reverse translation of source address, rewriting it from
<S2.IP>. After this reply becomes into
<S2.IP>:<APP.PORT> -> <C.IP>:<SOME.PORT>.
- The rewritten replies are being forwarded back to client to
<C.IP> destination address.
- The client receives the reply as expected.
To troubleshoot you can use the
There is other way, that is more complicated. I'll describe it if you need.