Ip forwarding via IPTABLES

Niksac

Hi guys

I am inexperienced with iptables and hope someone can help.
I have a p2p Openvpn connection running. I use it to reach (ssh) a computer who is behind a router on which i cannot port forward.
The other site is my server with a public ip.
What i currently do is:
I ssh on my server and ssh on my target from there. It works fine 🙂

My new aim is to ssh directly.
I want to be able to connect to myserver.com:11222 and be redirected to my target.
I tried to setup a port forwarding in iptables but it wont work.
I've read some port forwarding tutorials (also in this forum) but couldn't get it to work.

I use the following rules

iptables -A FORWARD -p tcp -i eth0 -d 88.100.100.200 --dport 11222 -j ACCEPT
iptables -t nat -I PREROUTING -d 88.100.100.200 -p tcp --dport 11222 -j DNAT --to-destination 10.130.212.2:11222

where 88.100.100.200 is the public ip and 10.130.212.2 is the openvpn ip of my target.

Unfortunately it doesn't work.
My theory is that the packages get lost on their way back from the target because he wont address the openvpn gateway but exit through his router.
I tried some snat rules but am going wrong somewhere.

Thanks for your help in advance!!

Nik

Bebop

If you read a guide from here I guess it was mine: https://forums.openvpn.net/topic7823.html

Its designed for a situation where your VPN clients want to open their ports and receive connections. Eg, clients want to open a port for P2P.

What you're asking for is something a little different is it not? (so the guide here might not apply).

Bebop

Niksac wrote
I use the following rules

iptables -A FORWARD -p tcp -i eth0 -d 88.100.100.200 --dport 11222 -j ACCEPT
iptables -t nat -I PREROUTING -d 88.100.100.200 -p tcp --dport 11222 -j DNAT --to-destination 10.130.212.2:11222

where 88.100.100.200 is the public ip and 10.130.212.2 is the openvpn ip of my target.

Unfortunately it doesn't work.

It looks like you have almost followed the guide I wrote, but I see a deviation from the formula. Try this instead:

iptables -A FORWARD -p tcp -i eth0 -d 88.100.100.200 --dport 11222 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -d 10.130.212.2 --dport 11222 -j DNAT --to-destination 88.100.100.200:11222

(see in the 2nd line, the order of remote/local IPs is changed now [to reflect the formula laid out in the guide])

Hope it works.. also remember to flush the old rules out before you make the change:

iptables -F
iptables -t nat -F
iptables -t mangle -F