LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 01-17-2014, 11:31 AM   #1
sousacanfly
LQ Newbie
 
Registered: Jan 2014
Posts: 28

Rep: Reputation: Disabled
ip forwarding with iptables - double forwarding with openVPN??


Hi guys,

i have one virtual machine at ServerA located in my office, to wich i am connected from home using openVPN

Server's ip address is 10.8.1.1 and i am able to make an iptables rule in order to establish a vnc connection:

Code:
iptables -t nat -A PREROUTING -p tcp -d 10.8.1.1 --dport 5900 -j DNAT --to-destination  192.168.1.25:5900

The problem is, i want to use RDP on that virtual machine, i loged in using VNC, and found the IP address (192.168.1.4)

So, i tried the obvious (for me at least) and defined a new set of preforwarding rules:

Code:
iptables -t nat -A PREROUTING -p tcp -d 10.8.1.1 --dport 3389 -j DNAT --to-destination  192.168.1.25:3389

iptables -t nat -A PREROUTING -p tcp -d 192.168.1.25 --dport 3389 -j DNAT --to-destination  192.168.1.4:3389

Unfortunately this doesn't work

Any ideais?


Thanks, to you all!

Last edited by sousacanfly; 01-17-2014 at 11:32 AM.
 
Old 01-17-2014, 01:09 PM   #2
nigerag
LQ Newbie
 
Registered: Feb 2008
Location: San Diego, CA
Distribution: Fedora 20, CentOS 6.5
Posts: 17

Rep: Reputation: 1
Did you open an iptables port? Something like below:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 3389 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 3389 -j ACCEPT

Also, instead of PREROUTING try FORWARD:

-A FORWARD -p tcp --dport 3389 -j ACCEPT

Hope that helps.
 
Old 01-17-2014, 04:04 PM   #3
sousacanfly
LQ Newbie
 
Registered: Jan 2014
Posts: 28

Original Poster
Rep: Reputation: Disabled
It seems the problem appears when i start the openVPN, after that, i can't connect through myserver.no-ip.biz (RDP directly).

If i turn off the ovenVPN, after that i can connect again through RDP... Why is that?

This is my server.conf content:


Quote:
local 192.168.1.25
port 1194
proto udp
dev tun1
ca ca.crt
cert servidor.crt
key servidor.key # This file should be kept secret
dh dh1024.pem
server 10.8.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
client-config-dir ccd
route 192.168.1.0 255.255.255.0
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
 
Old 01-17-2014, 04:40 PM   #4
sousacanfly
LQ Newbie
 
Registered: Jan 2014
Posts: 28

Original Poster
Rep: Reputation: Disabled
My setup:
Debian 7.0.3 with AMD-VT Enabled;
Qemu-Kvm installed and running smoothly;
X11VNC /Xvfb running my virtual screens;
Noip.com for static IP attribution;

What went fine:
This is important, and matters for the record: RDP works IF i stop the openVPN service;
In order for me to access the VM through RDP i had to make a rule at iptables:
Code:
iptables -t nat -A PREROUTING -p tcp -d 192.168.1.25 --dport 3389 -j DNAT --to-destination  192.168.1.4:3389
Where 192.168.1.25 is my server's IP and 192.168.1.4 is the VM's IP
After this, i could easily access the VM through RDP proto;

Here's where the problems started!

For me to access the VM and make sure RDP client was active i had to create another rule at iptables:
Code:
iptables -t nat -A PREROUTING -p tcp -d 10.8.1.1 --dport 5901 -j DNAT --to-destination  192.168.1.25:5901
This allowed me to access the VM through VNC, AND behind the openVPN this time.

But no matter what i do, i can't connect to the machine through RDP THROUGH the VPN

my server.conf:

Code:
local 192.168.1.25
port 1194
proto udp
dev tun1
ca ca.crt
cert servidor.crt
key servidor.key # This file should be kept secret
dh dh1024.pem
server 10.8.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
client-config-dir ccd
route 192.168.1.0 255.255.255.0
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log

I hope i've made myself clear enough to your understanding and let me thank you in advance for any hints you may have!
 
Old 01-17-2014, 06:14 PM   #5
sousacanfly
LQ Newbie
 
Registered: Jan 2014
Posts: 28

Original Poster
Rep: Reputation: Disabled
Somehow now it lets me connect directly through myserver.no-ip.biz , but still can't connect directly through vpn
 
Old 01-18-2014, 02:33 PM   #6
sousacanfly
LQ Newbie
 
Registered: Jan 2014
Posts: 28

Original Poster
Rep: Reputation: Disabled
Interesting... It seems to be sending a request to connect via RDP port 3389, but seems to be refusing it.

Listening to port 3389:

Quote:
user# cat /proc/net/nf_conntrack | grep 3389

ipv4 2 tcp 6 431972 ESTABLISHED src=188.250.52.21 dst=192.168.1.25 sport=56067 dport=3389 src=192.168.1.4 dst=188.250.52.21 sport=3389 dport=56067 [ASSURED] mark=0 zone=0 use=2

ipv4 2 tcp 6 42 SYN_RECV src=10.8.1.6 dst=10.8.1.1 sport=60370 dport=3389 src=192.168.1.4 dst=10.8.1.6 sport=3389 dport=60370 mark=0 zone=0 use=2
The first line indicates that i have established one connection, and it's true, i am connecting through the internet using the myserver.no-ip.biz domain.

The second line only appears when i'm trying unsuccessfully to connect through the VPN...
 
Old 01-19-2014, 12:15 AM   #7
sousacanfly
LQ Newbie
 
Registered: Jan 2014
Posts: 28

Original Poster
Rep: Reputation: Disabled
I'm in total desperation

Where can i find someone i can pay to do this for me? I am really struggling here with no results, unfortunately...


10.8.1.1 -> OpenVPN server's IP address
192.168.1.25 -> Local network real server's IP address
192.168.1.4 -> The VM IP address running Windows

This worked for me to access the Windows VM outside the lan using myserver.no-ip.biz domain:
http://rcritical.blogspot.pt/2011/01...m-virtual.html

But i can't manage to access it through the VPN...

I would appreciate any hint, probably what i am attempting to do is not even possible
 
Old 01-20-2014, 05:10 AM   #8
routers
Member
 
Registered: Aug 2005
Location: Malaysia - KULMY / CNXTH
Distribution: Slackware, Fedora, FreeBSD, Sun O/S 5.10, CentOS
Posts: 787
Blog Entries: 6

Rep: Reputation: 75
just give a try for testing.

after openvpn start try to masquerade all the device

-t nat -A POSTROUTING -o eth1 -j MASQUERADE

e.g. eth0 eth1 tun0 tun1 etc etc..
 
Old 01-20-2014, 08:49 AM   #9
sousacanfly
LQ Newbie
 
Registered: Jan 2014
Posts: 28

Original Poster
Rep: Reputation: Disabled
Thank you very much for your help, i really appreciate it .

But unfortunately i am unable to connect through the VPN... thought the problem could be related to openVPN, but it isn't, as i tried openswan (regular L2TP/IPsec VPN) and i have the very same problem happening.

I must admit that this is way over my head as i would be dealing with some intricate port/ip redirection/forwarding...

Last edited by sousacanfly; 01-20-2014 at 09:59 AM.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
openvpn ip forwarding is not working properly Gil@LQ Linux - Software 1 09-10-2013 01:01 PM
OPENVPN - Port Forwarding giannos Linux - Networking 4 10-12-2010 07:53 AM
Iptables + Forwarding + Vlan + OpenVPN & L2 junk switch /L3 extreme networks switch feloniousj Linux - Networking 3 03-15-2010 09:27 PM
port forwarding - multiple IP's and openvpn jonnytabpni Linux - Networking 2 09-19-2009 01:41 AM
IPCHAINS port forwarding and IPTABLES port forwarding ediestajr Linux - Networking 26 01-14-2007 07:35 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 07:38 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration