OpenVPN Server - No direct internet connection

inzanez

Hi

I'm running an OpenVPN Server, and I currently use TCP as protocol. The server has no direct internet connection, that's why I used an NGINX reverse proxy in front of the OpenVPN box. So the setup looks like this:

Internet | Nginx <--> OpenVPN

Now I wanted to switch to UDP protocol, but...I currently don't see what's going to take the role that Nginx plays for the TCP connection? How would I do that, forwarding the UDP traffic to OpenVPN so that OpenVPN knows to talk back to the "forwarder"?...

ste123

I don't know what the best approach is: these are merely possible options, and may not be 100% correct or even work.

Below assumes the IP address of your OpenVPN server is 192.168.100.10 and it is running on port 1194.

iptables

On your nginx box, run the following commands.

sysctl net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -p udp --dport 1194 -j DNAT --to-destination 192.168.100.10:1194
iptables -t nat -A POSTROUTING -d 192.168.100.10 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.100.10 -j MASQUERADE

This enables IP forwarding and creates the rules to mask the IP address to/from the OpenVPN server.

You could possibly replace the two POSTROUTING rules with a single one to cover all traffic but I'm not sure what other issues that could introduce (if any).

socat

You may be able to create a reverse UDP proxy using socat.

On your nginx box, install or compile socat, then start an instance like so:

socat -d -d -lmlocal2 UDP4-RECVFROM:1194,su=nobody,fork,reuseaddr UDP4-SENDTO:192.168.100.10:1194

Sources:
http://www.dest-unreach.org/socat/doc/socat.html
http://mattryall.net/blog/2011/09/udp-port-forwarding-with-socat

You just need to ensure the socat process is always running.

Both or neither of these may work. In any event, please post your findings.