How to forward a port to openvpn client

talk2rp

I have a openvpn server running on a cent OS 5.5 x64 VPS. There is one problem, I am not able to forward any port to clients.
For example,
If xxx.xxx.xxx.xx1 is server IP and 192.168.1.2 is client IP then,
When someone tries to connect to xxx.xxx.xxx.xx1:777, I want the connection to be forwarded to 192.168.1.2:777.

Is it possible to do this? If so please guide me.

Thanks in advance.

janjust

that is an iptables question , not an OpenVPN question.
You could use something like

iptables -t nat -I POSTROUTING --dport 777 --to-dest <ip>:<port>

but you might be better off using an SSH tunnel

talk2rp

janjust wrotethat is an iptables question , not an OpenVPN question.
You could use something like

iptables -t nat -I POSTROUTING --dport 777 --to-dest <ip>:<port>

but you might be better off using an SSH tunnel

That didn't work!

[root@server ~]# iptables -t nat -I POSTROUTING --dport 777 --to-dest 192.168.1.7:777
iptables v1.3.5: Unknown arg `--dport'
Try `iptables -h' or 'iptables --help' for more information.

janjust

oops, I typed the iptables stuff by heart - read the man page for what it should have been. Try

iptables -t nat -I PREROUTING -p tcp --dport 777 -j DNAT --to <IP>:<PORT>

instead

talk2rp

janjust wroteoops, I typed the iptables stuff by heart - read the man page for what it should have been. Try

iptables -t nat -I PREROUTING -p tcp --dport 777 -j DNAT --to <IP>:<PORT>

instead

I tried it.
But didn't work. The port is still closed and nothing is forwarded to the client IP. 🙁

janjust

perhaps the server OS is blocking access to that port? try adding

iptables -I INPUT -p tcp --dport 777 -j ACCEPT

talk2rp

janjust wroteperhaps the server OS is blocking access to that port? try adding

iptables -I INPUT -p tcp --dport 777 -j ACCEPT

Error: I could not see your service on 2xx.xxx.xx.xx on port (777)
Reason: Connection timed out

🙁

gloner

As you understand:
0. the xxx.xxx.xxx.xx1 must be a router (ip forward must be enabled)
1. the vpn connection by client with vpn ip 192.168.1.2 must be established
2. service on port 777 on vpn client host must be started
3. firewall rules on host with vpn ip 192.168.1.2 must be allows connections to port 777 on it

Try something like that:

#!/bin/bash
IPT=`which iptables`
SYSCTL=`which sysctl`
ext_if="eth0" # The ethernet adapter for the ext_ip (xxx.xxx.xxx.xx1) of the OpenVPN server
int_if="tun0" # The tun-adapter for client with vpn ip 192.168.1.2
int_ip="192.168.1.2" # IP address in internal VPN network
$SYSCTL -w net.ipv4.ip_forward = 1 # Enable IP forwarding
# Some magic
$IPT -t nat -A PREROUTING -p tcp -i $ext_if --dport 777 -j DNAT --to $int_ip:777
$IPT -A FORWARD -p tcp -i $ext_if -o $int_if -d $int_ip --dport 777 -m state --state NEW -j ACCEPT
$IPT -A FORWARD -i $ext_if -o $int_if -d $int_ip -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i $int_if -s $int_ip -o $ext_if -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -t nat -A POSTROUTING -j MASQUERADE -o $int_if