iptables - how to keep source IP after forwarding?

Question

1.1.1.1 - public IP of VPS
10.1.0.1 - internal IP of OpenVPN server running on VPS
192.168.1.0/24 - local subnet on the VPN client's side
192.168.1.101 - local server running on port TCP 1234

Main usage of VPN/VPS:

1. as a gateway to surf on specific sites
2. as a proxy for clients connecting to server 192.168.1.101

Current iptables settings:

-A PREROUTING -d 1.1.1.1 -p tcp -m tcp --dport 1234 -j DNAT --to-destination 192.168.1.101:1234
-A POSTROUTING -d 192.168.1.101 -p tcp -m tcp --dport 1234 -j SNAT --to-source 10.1.0.1
-A POSTROUTING -o eth0 -j SNAT --to-source 1.1.1.1

Two first lines are forwarding port TCP 1234 to the desired destination, and it works. The only problem is, that on the destination server I can't see real IP of connected clients. All clients have the same IP: 10.1.0.1. I tried to change the 2nd line to:

-A POSTROUTING -d 192.168.1.101 -p tcp -m tcp --dport 1234 -j SNAT --to-source 1.1.1.1

but then the clients are not connecting at all. The last line is used to let me surf through the Internet.

Question: How should I set the rules properly, so I can see real IPs of connected clients?

Solution

Ok it seems that you are trying to set-up port forwarding through a VPN, ie. 1.1.1.1:1234 -> 192.168.1.101:1234. Your openvpn config also seems ok.

As stated in the comments, in your second rule you are modifying the source IP by using -j SNAT --to-source 10.1.0.1. To achieve port forwarding, please replace your iptables rules with :

-A PREROUTING -t nat -i eth0 -d 1.1.1.1 -p tcp --dport 1234 -j DNAT --to-destination 192.168.1.101:1234
-A FORWARD -p tcp -d 192.168.1.101 --dport 1234 -j ACCEPT

• The first rule tell iptable to send all incoming tcp connections to port 1234 on interface eth0 with the destination set to 1.1.1.1, towards port 1234 of the internal machine 192.168.1.101.
• The second rule allow forwarding packets to port 1234 of 192.168.1.101

Source

Comments

[user1686]

Well, why are you using SNAT in the first place? You're telling iptables to hide those IP addresses.

[matiaszon]

OK, as I am totally not familiar with iptables, how I shoud use it to get what I want?

[user1686]

How about removing the 2nd rule completely?

[matiaszon]

Then clients are not connecting to the server at all.

[user1686]

Probably because the server doesn't have a route back to the VPN subnet.

[matiaszon]

OK, so put it more straight. Instead of 1.1.1.1let's use x.x.x.28 as the public address. Then, ip route: root@e8e064:~# ip route default via x.x.x.1 dev eth0 10.1.0.0/24 via 10.1.0.2 dev tun0 10.1.0.2 dev tun0 proto kernel scope link src 10.1.0.1 x.x.x.0/26 dev eth0 proto kernel scope link src x.x.x.28 192.168.1.0/24 via 10.1.0.2 dev tun0.

[matiaszon]

The routes are added in OpenVPN config.

[matiaszon]

So what my saved iptables would look like? I think I did what you said, but then clients haven't connected at all.

[vera]

Do you see SYN reaching the end server ? I think your server does not route correctly the original source IP back. You should also add the following default route on you server: ip route add default gw 10.1.0.1 ethx

[matiaszon]

Well, I don't know how to edit answer here to go to the next line, but here is my pastebin pastebin.com/M1pSttbd;x.x.x.28 is my publi IP

[vera]

Sorry, by server I didn't meant you openvpn server, but your machine located at 192.168.1.101. You then should add the default route in your 192.168.1.101 machine

[matiaszon]

pastebin here pastebin.com/9SgSFHtj (z.z.z.189 is public IP of the client, where the 192.168.1.0/24 subnet is connected)

[matiaszon]

Just came to my mind - maybe I should use "tap" instead of "tun" on OpenVPN?

[matiaszon]

OK, seem I got it sorted. I left only -A PREROUTING -t nat -i eth0 -d 1.1.1.1 -p tcp --dport 1234 -j DNAT --to-destination 192.168.1.101:1234 and added route of 192.168.1.101 to vpn gateway. And it works. Thank you all for yourt ime.