0

Been through several Superuser and ServerFault questions and I am not able to get this working with iptables. I am trying to port forward a specific port 12345 through OpenVPN running on my Linux VPS (currently on Ubuntu 18.04) to the connected client (also Ubuntu 18.04). For all examples below the external IP of the VPS is 123.45.67.89 and internal IPs of 10.8.0.1 for VPS on the OpenVPN network and 10.8.0.2 for client. (Note this is a NAT VPS and I only have a few ports to work with in case that makes a difference, but I have full use of my assigned ports.)

I have tried the following on the VPS,

iptables -I FORWARD 1 -d 10.8.0.2 -p tcp --dport 12345 -j ACCEPT
iptables -t nat -A POSTROUTING -m conntrack --ctstate DNAT -d 10.8.0.2 -p tcp --dport 12345 -j SNAT --to-source 10.8.0.1
iptables -I FORWARD 1 -d 10.8.0.2 -p udp --dport 12345 -j ACCEPT
iptables -t nat -A POSTROUTING -m conntrack --ctstate DNAT -d 10.8.0.2 -p udp --dport 12345 -j SNAT --to-source 10.8.0.1

as well as,

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 12345 -j DNAT --to-destination 10.8.0.2
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 12345 -j DNAT --to-destination 10.8.0.2

but after all of these, online port checkers still report port 12345 as closed.

From the VPS I have also tried telnet 10.8.0.2 12345 which outputs the following,

Trying 10.8.0.2...
Connected to 10.8.0.2.
Escape character is '^]'.
Connection closed by foreign host.

compared to telnet 10.8.0.2 8945 (or any other port I'm not running a service on) outputs,

Trying 10.8.0.2...
telnet: Unable to connect to remote host: Connection refused

Any help is appreciated. I have basically no experience with iptables so I am trying to get this working following various guides but none of them are opening the port.

Thanks

1 Answer 1

0

Resolved by reinstalling Ubuntu on my VPS (lots of iptables rules that may have been misconfigured could have broken newer rules that would have worked). After reinstall the following iptables rule worked,

iptables -t nat -A PREROUTING -p tcp --dport 12345 -j DNAT --to-destination 10.8.0.2:12345

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .