I've got an issue with forwarding ports via vpn.
I have openvpn server, pfsense which works as a client and virtual machines on esx host.
When i logon to my openvpn server i can telnet to required port on clients machine without any problem
10.8.0.1 (ip of vpn server) > 10.8.0.10 (client's ip) = works
If i try to telnet to the port via external ip of pfsense, this works too, so I know port forwarding works fine
telnet > 2.2.2.2 (pfsense external ip) = works
However when i try to telnet to client's machine using openvpn server external ip, this doesn't work
telnet > 1.1.1.1 (server external ip) = not working
I am very convinced it will be routing/iptables issue but not sure if that will be on pfsense end or the vpnserver
I have forwarding enabled (echo 1 > /proc/sys/net/ipv4/ip_forward)
My iptables
# Generated by iptables-save v1.4.8 on Mon Dec 3 16:25:31 2012
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [73567:12322231]
:FORWARD ACCEPT [145057:14167096]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -j ACCEPT
-A OUTPUT -j ACCEPT
-A OUTPUT -j ACCEPT
-A POSTROUTING -j ACCEPT
COMMIT
# Completed on Mon Dec 3 16:25:31 2012
# Generated by iptables-save v1.4.8 on Mon Dec 3 16:25:31 2012
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:In_RULE_0 - [0:0]
:In_RULE_1 - [0:0]
:In_RULE_2 - [0:0]
:In_RULE_3 - [0:0]
:In_RULE_4 - [0:0]
:In_RULE_5 - [0:0]
:In_RULE_6 - [0:0]
:In_RULE_7 - [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT
-A INPUT -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p udp -m udp --dport 33434:33523 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -d 10.8.0.1/32 -i eth0 -p tcp -m tcp --dport 32005 -m state --state NEW -j In_RULE_0
-A FORWARD -d 10.8.0.1/32 -i eth0 -p tcp -m tcp --dport 34000 -m state --state NEW -j In_RULE_0
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
-A FORWARD -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -j ACCEPT
-A In_RULE_0 -j LOG --log-prefix "RULE 0 -- ACCEPT " --log-level 6
-A In_RULE_0 -j ACCEPT
COMMIT
# Completed on Mon Dec 3 16:25:31 2012
# Generated by iptables-save v1.4.8 on Mon Dec 3 16:25:31 2012
*nat
:PREROUTING ACCEPT [1746:107636]
:POSTROUTING ACCEPT [1431:77504]
:OUTPUT ACCEPT [13:865]
-A PREROUTING -d vpnip/32 -p tcp -m tcp --dport 32005 -j DNAT --to-destination 10.8.0.10:32005
-A PREROUTING -d vpnip/32 -p tcp -m tcp --dport 34000 -j DNAT --to-destination 10.8.0.10:34000
-A POSTROUTING -o eth0 -j SNAT --to-source vpnip
COMMIT
# Completed on Mon Dec 3 16:25:31 2012
