Port forwarding with OpenVPN

Question

Set up an openvpn server but having trouble getting ports forwarded to the client.

Below is what I am trying to do:

WAN: 123.45.67.89:4444 -> [OpenVPN Server] -> CLIENT: 192.168.1.10:4444

Seen many different answers on how to do this but no matter what I try it doesn't seem to work and port tests always show the port as closed.

Solution

I assume you're using OpenVPN in routed mode and are NATting its clients onto the WAN. If so, you'll want to do the following:

iptables -t nat -A PREROUTING -i eth0 -d 123.45.67.89 -p tcp --dport 4444 -j DNAT --to-destination 192.168.1.10 (change eth0 to whatever interface your WAN is actually on).

If you're not using NAT, then it's just a matter of making sure the host you're trying to connect from knows to route packets destined for 192.168.1.10 through 123.45.67.89 (which obviously won't work to an RFC1918 IP over the Internet). In any case, the only other requirements are that you have IPv4 routing enabled (I'd assume that the VPN wouldn't be working at all if you didn't) and that you don't have any other firewall rules that would block this traffic.

Comments

[Red Spider]

Thanks for the reply. Tried the above but still port tests still show port is closed. Made sure to iptables -A INPUT -p tcp --dport 4444 -j ACCEPT so port should be able on the OpenVPN server.

[Joseph Sible-Reinstate Monica]

You need to use the FORWARD chain, not the INPUT chain.

[ptica]

i needed to add -A POSTROUTING -p tcp -d 192.168.1.10 --dport 4444 -j MASQUERADE rule as well

[Joseph Sible-Reinstate Monica]

@ptica that rule would only be needed for NAT reflection (and its scope could be made a bit narrower).

[ptica]

hi @JosephSible, thanks for the remark, i couldn't telnet into 123.45.67.89:4444 without that POSTROUTING rule, however I still do not understand the need for it as I already route 192.168.1.0/24 to openvpn's gateway 10.8.0.2