Help with IPtables to provide public IP to client router

tristan_c

Goal: To replicate the functionality I have with StrongVPN on my own Debian VPS. With StrongVPN, seemingly, all ports on the public IP provided are forwarded to the client, meaning, e.g, ssh <publicIP>:22 from 'outside' connects to my router. Also upnp / NATPMP etc on my router's clients Just Works (skype, back to my mac). The caveat is that the server will need to 'keep' receiving traffic on certain ports (22, 80, etc) to maintain functionality, so these will need 'notched' out of any forwarding set up via IPtables.

Server: I have a VPS, latest Debian running OpenVPN and bind9. I have one NIC and one public IP. This server also runs apache, and I'll need access to it via ssh for configuration.

Client: a router running OpenWRT.

I have a basic config established as below. This works (clients attached to the route can access external sites) however I think there is a problem with my IPtables set-up as upnp traffic doesn't seem to get back to the inside clients; my experience is practically zero with configuring IPtables... In addition, I'd have to set a couple of bespoke forwards to point a random high port on the public side to 22 on the client (or change what port ssh listens on on the router).

client.conf:

remote 46.aaa.xxx.yyy 1194 udp
dev tun
ifconfig 172.19.233.2 172.19.233.1
secret static.key
redirect-gateway def1

server.conf:

dev tun
proto udp
port 1194
ifconfig 172.19.233.1 172.19.233.2
secret /etc/openvpn/static.key

ifconfig:

eth0      Link encap:Ethernet  HWaddr 52:XXXXXXXXXXXX
          inet addr:46.aaa.xxx.yyy  Bcast:46.aaa.xxx.xxx  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:34338527 errors:0 dropped:20 overruns:0 frame:0
          TX packets:747507 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:2697230329 (2.5 GiB)  TX bytes:577951758 (551.1 MiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:18947 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18947 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:2143690 (2.0 MiB)  TX bytes:2143690 (2.0 MiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:172.19.233.1  P-t-P:172.19.233.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:164495 errors:0 dropped:0 overruns:0 frame:0
          TX packets:166083 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:54062402 (51.5 MiB)  TX bytes:162532235 (155.0 MiB)

iptables-save:

# Generated by iptables-save v1.4.14 on Mon Mar 30 21:47:41 2015
*nat
:PREROUTING ACCEPT [2:344]
:INPUT ACCEPT [1:172]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING ! -d 172.19.233.0/24 -s 172.19.233.0/24 -j MASQUERADE
COMMIT
# Completed on Mon Mar 30 21:47:41 2015
# Generated by iptables-save v1.4.14 on Mon Mar 30 21:47:41 2015
*raw
:PREROUTING ACCEPT [413:36237]
:OUTPUT ACCEPT [190:21548]
COMMIT
# Completed on Mon Mar 30 21:47:41 2015
# Generated by iptables-save v1.4.14 on Mon Mar 30 21:47:41 2015
*filter
:INPUT DROP [5239:662523]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [11365:1381174]
:fail2ban-ssh - [0:0]
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -i lo -j ACCEPT
-A INPUT -i tun+ -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp -m multiport --dports 22,53,80,123,443,1194 -j ACCEPT
-A INPUT -p udp -m multiport --dports 53,123,1194 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o tun+ -j ACCEPT
-A OUTPUT -o eth+ -j ACCEPT
-A fail2ban-ssh -j RETURN
COMMIT
# Completed on Mon Mar 30 21:47:41 2015

I'd appreciate any help to get the IPtables configured correctly to achieve what I want.

Thanks,

Tristan

tristan_c

By way of update, I've modified my nat table to:

iptables -t nat -A POSTROUTING ! -d 172.19.233.0/24 -j SNAT --to-source 46.aaa.xxx.yyy

I read this as any traffic that is not going to the VPN tunnel change the source to the public IP address. This is the equivalent of the MASQUERADE line in the OP.

The following two rules allow traffic to flow to the router, but seems to break external access to devices connected to the router and the router itself (traceroutes don't work, can't access IMAP. But web works)

iptables -t nat -A PREROUTING -p tcp -m multiport ! --dports 22,53,80,123,443,1194 -j DNAT --to-destination 172.19.233.2
iptables -t nat -A PREROUTING -p udp -m multiport ! --dports 53,123,1194 -j DNAT --to-destination 172.19.233.2

In English I interpret this as 'forward anything that isn't in these ports [needed by the server] down the VPN to the router'. But how do pings / traceroutes etc work from the VPN client if they are diverted to the server by these rules? Do I need some sort of RELATED/ESTABLISHED rule for traffic originating from the tunnel so it gets marked to go back to the tunnel on its return?

tristan_c

To answer my own question, I needed to use the following iptables rules:

iptables -t nat -A POSTROUTING -o eth0 -s 172.19.233.0/24 -j SNAT --to-source <externalIP>
iptables -t nat -A PREROUTING -i eth0 -p tcp -m multiport ! --dports 22,53,80,123,443,1194 -j DNAT --to-destination 172.19.233.2
iptables -t nat -A PREROUTING -i eth0 -p udp -m multiport ! --dports 53,123,1194 -j DNAT --to-destination 172.19.233.2

The difference is the addition of '-i eth0' or '-o eth0' which is key.

I hope this is of use to someone.