I'm trying to make a non internet-facing device accessible to the internet.
I have a OpenVPN Server setup on a Amazon AWS Instance. I have a OpenVPN Client successfully connected to the server in TUN mode.
I have added iptable rules to forward the port on the public-ip-server to the private-ip-client.
Nothing works 🙁
Can someone advise me on what I'm doing wrong?
Amazon AWS
Public IP: mydomain.io
OpenVPN IP: 10.8.0.1
Private Client
Public IP: None (Behind NAT)
Private OpenVPN IP: 10.8.0.2
Private IP: 192.168.1.5/255.255.255.0
Device Port: 8123
Amazon AWS ifconfig:
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 9001
inet 172.31.15.183 netmask 255.255.240.0 broadcast 172.31.15.255
inet6 fe80::44d:45ff:fed2:845f prefixlen 64 scopeid 0x20<link>
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.8.0.1 netmask 255.255.255.0 destination 10.8.0.1
inet6 fe80::7baa:4728:4923:e916 prefixlen 64 scopeid 0x20<link>
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
;push "redirect-gateway def1 bypass-dhcp"
;push "dhcp-option DNS 208.67.222.222"
;push "dhcp-option DNS 208.67.220.220"
client-to-client
keepalive 10 120
cipher AES-256-CBC
comp-lzo
# You can uncomment this out on
# non-Windows systems.
;user nobody
;group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
explicit-exit-notify 1
client
;dev tap
dev tun
;dev-node MyTap
;proto tcp
proto udp
remote mydomain.io 1194
;remote-random
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
;mute-replay-warnings
remote-cert-tls server
cipher AES-256-CBC
comp-lzo
verb 3
Iptable rules:
root@ip-172-31-15-183:~/client-configs/files# sudo iptables -A FORWARD -i eth0 -o tun0 -p tcp --syn --dport 11780 -m conntrack --ctstate NEW -j ACCEPT
root@ip-172-31-15-183:~/client-configs/files# sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 11780 -j DNAT --to-destination 10.8.0.2:11780
root@ip-172-31-15-183:~/client-configs/files# sudo iptables -t nat -A POSTROUTING -o tun0 -p tcp --dport 11780 -d 10.8.0.2 -j SNAT --to-source 10.8.0.1
root@ip-172-31-15-183:~/client-configs/files# sudo iptables -A FORWARD -i eth0 -o tun0 -p tcp --syn --dport 8123 -m conntrack --ctstate NEW -j ACCEPT
root@ip-172-31-15-183:~/client-configs/files# sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8123 -j DNAT --to-destination 10.8.0.2:8123
root@ip-172-31-15-183:~/client-configs/files# sudo iptables -t nat -A POSTROUTING -o tun0 -p tcp --dport 8123 -d 10.8.0.2 -j SNAT --to-source 10.8.0.1
End Result:
Goto: http://mydomain.io:8123 and have it work just like I was on the firewalled device's network at 192.168.1.5:8123
