RASPBERRY behind the firewall one one NETWORK to be visible over another network via VPN

Question

I want one RASPBERRY "SERVER" behind the firewall in a PRIVATE/COMPANY NETWORK with only VPN PPTP open

to be "visible to the internet"

using another NETWORK (OWN NETWORK/ HOME Fritzbox NETWORK) and if needed a RASPBERRY RELAY on a HOME NETWORK (as configurable "relay").

My thoughts:

1. Query1 to Fritzbox1 (Router1) over PORT 80 should be forwarded onto RASPBERRY RELAY behind the Fritzbox1 (HOME NETWORK).

2. This RASPBERRY RELAY should be connected over the Internet WITH RASPBERRY SERVER on another PRIVATE NETWORK (either as VPN Clinet OR RASPBERRY SERVER connected as Client to RELAY (VPN Server).

3. The RASPBERRY SERVER on the PRIVATE NETWORK must ACTUALLY process the original Query1/Request.

Questions:

A. Do I have to configure RASPBERRY RELAY as VPN SERVER? So the reverse connection from RASPBERRY SERVER to RASPBERRY RELAY is created (imho a clean solution).

B. Would a SOCKS proxy (or any other than VPN mechanism) be of any help?

ROUGH IDEAS and EXPERIENCES are WELCOME!

Caveats:

I. PRIVATE NETWORK supports only PPTP VPN so no direct VPN connection from Fritzbox is possible (it can only IKEv1). The PRIVATE NETWORK doesn't have any port forwarding options, only connecting as a client over PPTP is supported (this is what's known). II. I eventually need multiple "ports" to be "relayed". Say 80, 443, 22 and others.

NB: I'm a bit familiar with network terminology, but not very well with VPN internal mechanisms and don't clearly understand how RASPBERRY can forward traffic over VPN to a computer on the other Network. I want to configure everything by my own means, without public VPN services or any 3d parties. So if there are another questions differently formulated, please advise! Thank you all.

Related:

https://networkengineering.stackexchange.com/questions/20990/connection-between-client-and-remote-raspberry-pi-thats-behind-a-router

ssh reverse proxy? https://medium.com/dev-tricks/reverse-port-forwarding-220030f3c84a#.1quisbour

Answer 1

No VPN Server on Raspi Relay needed. Connect from the Client Raspi with Services to Fritzbox via VPN. Add routing on the Relay Raspi behind the Fritzbox to the Raspi with Services, which has now a Local IP in the Fritzbox network.

iptables -t nat -A PREROUTING -p tcp --match multiport --dports 22,80,443,3389 -j DNAT --to-destination <IP_RASPI_SERVICES_IN_FRITZBOX_LAN>:22,80,443,3389

iptables -t nat -A POSTROUTING -p tcp -d <IP_RASPI_SERVICES_IN_FRITZBOX_LAN> --match multiport --dports 22,80,443,3389 -j SNAT --to-source <IP_RELAY>

That's it. No need for VPN Server or Nginx Proxing.