I'm working on a configuration that will let a client access a web server in a remote private LAN without having to establish a VPN connection of any sort. (The EdgeRouter with a dynamic WAN address may be behind a NAT firewall that we have no access to or control over, so a dynamic DNS isn't an option.) Presently, the VPN connection between the EdgeRouter and OpenVPN Server is working perfectly: clients on the Internet who do connect a VPN to the OpenVPN server have full access to the remote client LAN and web server (as they should) through the EdgeRouter.
The final puzzle piece I'm missing is how to configure the OpenVPN server to allow a client WITHOUT a VPN connection to access only the web server in the remote private LAN (port 80).
Since I can't upload a drawing here, this is the best way to visualize it:
- Client, OpenVPN Server (1.2.3.4), and Eth0 (Dynamic WAN) of EdgeRouter all connected to Internet.
- Remote private LAN is connected to Eth1 of EdgeRouter (192.168.1.1). Web server is on this private LAN and has IP 192.168.1.21.
- Want client to be able to go to 1.2.3.4:80 and be directed to 192.168.1.21.
Note:
I've tried adding these lines to the OpenVPN iptables, but it hasn't worked yet:
sysctl -w netipv4.ip_forward=1
iptables -t nat -A PREROUTING -d 1.2.3.4 -p tcp --dport 80 -j DNAT --to-dest 192.168.1.21:80
iptables -t nat -A POSTROUTING -d 192.168.1.21 -p tcp --dport 80 -j SNAT --to-source 192.168.1.1
A picture may be seen here at the UBNT forum:
http://community.ubnt.com/t5/EdgeMAX/Client-Access-to-LAN-Subnet-w-o-VPN/m-p/1293912/highlight/false#M70820
