Ryno
Hello all,
I have a DD-WRT router configured as an openVPN client. While the Openvpn client is connected I can no longer remotely SSH into the router nor SSH to a server connected to the said router. (If i'm on the LAN i can SSH both)
My network is as follows:
ISP connection ----->
WRT54Gv8 WAP
DD-WRT v24-sp2 (10/10/09) micro -build 13064
192.168.1.1/25----wireless link--->
WNR3500L Repeater running as openVPN client
DD-WRT v24-sp2 (08/12/10) mega -build 14929
192.168.1.130/25 ------>
server (static 192.168.1.250)
Local IP address are as follows
WAP - 192.168.1.1/25
Repeater - 192.168.1.130/25 (the WAP assigns a static IP address of 192.168.1.25 which shows up as the repeater's WAN IP)
Server - 192.168.1.250 (static ip address assigned by the repeater)
For example purposes:
1. The repeater's SSH is listening on port 75 and the server's SSH is listening on port 85.
2. The WAP's WAN address is 111.111.111.111 and ports 75 and 85 are forwarded to 192.168.1.25
3. The vpn client connects to a VPN server and all the nodes connected to it get the same IP of 222.222.222.222. Port 75 is forwarded to 192.168.1.130 and port 85 is forwarded to 192.168.1.250.
Ultimately I would like to be able to remotely SSH into the repeater and server through the WAP WAN IP. For example "ssh user@111.111.111.111 -p 65 (or 85)"
The reason being, my VPN address changes and I don't have access to the server to set up DDNS for it.
Through forum research, I'm almost certain the solution lies in the iptables, but I cannot, for the life of me figure it out.
Here's my current firewall script for the repeater:
iptables -I FORWARD -i br0 -o tap0 -j ACCEPT
iptables -I FORWARD -i tap0 -o br0 -j ACCEPT
iptables -I INPUT -i tap0 -j REJECT
iptables -t nat -A POSTROUTING -o tap0 -j MASQUERADE
iptables -t nat -I PREROUTING -p tcp --dport 85 -j DNAT --to 192.168.1.250:85
iptables -I FORWARD -p tcp -d 192.168.1.250 --dport 85 -j ACCEPT
iptables -t nat -I PREROUTING -p tcp -d 192.168.1.25 --dport 75 -j DNAT --to 192.168.1.130:75
iptables -I FORWARD -p tcp -d 192.168.1.130 --dport 75 -j ACCEPT
