port forwarding through tun0

towme

First of all hi everyone.
Second, before you send me to hell with my question I have tried to search the forums for my problem, but all my words were "too common" and did not produce any results.
So the scenario:
I have connected my home gateway (ubuntu 12.04) through an openvpn tunnel to my workplace gateway (also ubuntu 12.04).
The setup is working perfectly I can ping and ssh into any computer on each side.
The only problem I have is that if I try to forward port 22 from one of our public ips at the workplace to my home gateway it does not work. (If I change the destination ip in the rule to be internal network at my workplace then everything works perfectly)
I have tried with my home internal address as destination, or the tun address as destination. Neither works, but both addresses are pingable.
In numbers:
work internal network: 192.168.57.0/24
home internal network: 192.168.112.192/26
tun network: 192.168.162.0/24
public ip: 1.2.3.4
the goal is to forward packets from 1.2.3.4 to 192.168.112.254, or 192.168.162.6

What iptables rules need to be in place?

thanks and regards
tom

derdigge

Hi towne!

Welcome to the Forum.

this should work on Server(work) side:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 22 -j DNAT --to 192.168.162.23:22

for example, if you want to forward to 192.168.162.23. Maybe you need to change port to anotherone
to avoid conflicts with local running services.

Also i can sugest a tool named rinetd. Yust install it, edit /etc/rinetd.conf and be happy 🙂.
For port forwards between bridged nets a easy soulution.

regards
derdigge

towme

Ok, first of all thanks for the reply, but
- ip_forward is already enabled since there are a couple of port forward rules in place
- the rule suggested looks like a completely normal port forward rule, which seem to work for the internal network but not the vpn network. (which is my problem in the first place)

Maybe I was not clear enough about my problem:
I have 2 subnets connected through openvpn (tun) Home subnet and Work subnet.
Port forwarding in the work subnet works beautifully (SNAT, DNAT also)
The openvpn connection between the two subnets is also perfect (I can ssh into any of the machines on either side)
The only thing that does not work is that when I try to ssh into my home router, through my work public IP, even though port forwarding rule is in place.

1. The main problem is I do not understand which IP to forward to. Shall I use the tun address, or the "normal" internal address of my home router, or the p-t-p address (ok I don't really think that the last one is the solution 🙂 )
2. It can be that some left over firewall rule is blocking the traffic but I do not know if this kind of traffic is inbound or outbound or whichever.

Taking from your answer port forwarding should work just as if it was forwarded between "real" interfaces.

thx
tom

markymarrow

towme wroteI have connected my home gateway (ubuntu 12.04) through an openvpn tunnel to my workplace gateway (also ubuntu 12.04).
The setup is working perfectly I can ping and ssh into any computer on each side.
The only problem I have is that if I try to forward port 22 from one of our public ips at the workplace to my home gateway it does not work. (If I change the destination ip in the rule to be internal network at my workplace then everything works perfectly)

Is the machine where 1.2.3.4 resides a different machine to the one with the openvpn link?
As it sounds like the machine you're doing the port forwarding on doesn't know how to route to either the tun network or your home one, you'd need to make sure that knows that 192.168.112.192/26 and/or 192.168.162.0/24 are routed to via 192.168.57.your-tun-server

you could try using tcpdump on the tun interfaces at both ends to see if the packets are at least getting that far

tcpdump -i tun0 -nn src or dst port 22

towme

thanks markymarrow for the suggestion.
So to clearify my setup, some ascii drawing
------------------- ---------------------------- ---------------------------- --------------------------
|box0 - VPS | | box1 - work router | | box2 - home router | |box3 - home client |
| 5.6.7.8 | | 1.2.3.4 | | 2.3.4.5 | | |
| | | 192.168.57.11 | | 192.168.112.254 |======= | 192.168.112.253 |
| | | 192.168.162.1 | ========== | 192.168.162.6 | | |
------------------- ---------------------------- ---------------------------- -------------------------

The conections with the = sign work perfectly, either way. What I want to achieve is to ssh from box0 to box2 or box3
Trying with tcpdump shows me that packet arrive to box2 from box0.
So now I think that because the default route on box is 2.3.4.5, then instead of returning the packets through tun0 they go through 2.3.4.5, which is not good. Can this be correct?
If yes then how do I tell the packets to return through tun0 instead of 2.3.4.5.
Please don't suggest to override the default route with openvpn, beacuse that means that my whole home internet traffic would pass through my workplace, which is not desired.
I even have an option on the workplace firewall to override source address, which turned on. So I thought that the packets should originate from 192.168.57.11, but they don't. They seem to come from 5.6.7.8