Why doesen't this work?

John

iptables -A FORWARD -p tcp -i venet0 -d IP --dport 5555 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -d 10.8.2.1 --dport 5555 -j DNAT --to-destination IP:5555

I execute this, it shows no error, I restart OpenVPN the server and the client but it does not work, I attempt to listen to the port and when testing with CANYOUSEEME.org I get:

Error: I could not see your service on IP on port (5555)
Reason: Connection refused

janjust

what are you trying to achieve and what does it have to do with OpenVPN?

the 'nat' rule matches only for traffic destined for 10.8.2.1 - that's local only, so I'm not surprised that a website does not "see" that port as opened.

John

I am trying to forward the port 5555 so while I am on my own computer and while I am connected to the VPN, canyouseeme.org will show that the port 5555 is open, I'm also using a TCP Listener which is listening on the port 5555 yet it shows as it cant reach it.

And can you tell me what I need to use to make this work?

I used this as a base: https://forums.openvpn.net/topic7823.html

janjust

I'd use something like

/sbin/iptables -t nat -I PREROUTING -p tcp --dport 55555 -j DNAT --to-dest $VPN-IP:55555

where VPN-IP is the IP address of the VPN client.

John

iptables -t nat -I PREROUTING -p tcp --dport 5555 -j DNAT --to-dest WANIP:5555

Gives:
Error: I could not see your service on WANIP on port (5555)
Reason: Connection refused

iptables -t nat -I PREROUTING -p tcp --dport 5555 -j DNAT --to-dest $WANIP:5555

Gives:
Error: I could not see your service on WANIP on port (5555)
Reason: Connection timed out

John

Nevermind it works I used WANIP I should of used the client IP.

Is it also possible to open all ports?

janjust

I'm not sure about 'all' but IIRC you can specify port ranges:

/sbin/iptables -t nat -I PREROUTING -p tcp --dport XX:YY -j DNAT --to-dest $VPN-IP

(note that I did not specify a destination port)

John

Thank you janjust, also will it work for UDP?

janjust

yep should work for udp also, even for icmp

John

so

/sbin/iptables -t nat -I PREROUTING -p tcp --dport 1000:2000 -j DNAT --to-dest 10.8.2.1

Would open ports from 1000 to 2000 for the IP?

Also is it possible to forward an entire subnet? 10.8.1.0 to forward all IPs

janjust

how would you forward an entire subnet? it would be a one-to-many mapping and it would be very hard to tell which port needs to go to which VPN client. You'd be better off looking at a proper routing setup.