I am having the following problem with iptables. My situation is as follows:

Client which uses an ISP with a Linux machine(Server 1) with two network cards. Eth0 with ip 1.1.1.2 and gateway 1.1.1.1 these ip's is not public ip's and falls unders the isp's internal range, eth1 with the internal ip range. OpenVPN listen on eth0 for incomming connections. We want to connect to Server1 from external networks. Due to different reasons the isp could not get the routing sorted and give us an public ip on his network. We had to setup another bos (Server2) with eth0 2.2.2.5 and gateway 2.2.2.1 which is public ip's and eth1 with ip 3.3.3.5. Server 2 can communicate via the ISP internal network with server 1. I use DNAT to forward all incomming connections on server 2 to server 1 but the problem I have is that server uses its default gateway for the return packages and does not sent the reply back to server 2. My iptables rules looks as follows on server 2.

/usr/sbin/iptables -t nat -A PREROUTING -p udp -i eth0 -d 196.25.157.135 --dport 1194 -j DNAT --to 192.168.100.170:1194
/usr/sbin/iptables -A FORWARD -p udp -i eth0 -d 192.168.100.170 --dport 1194 -j ACCEPT

Any help on how I can solve the problem would be appreciated.

Thanks

Isak

iptables -t nat -A PREROUTING -p udp -i eth0 -d 196.25.157.135 --dport 1194 -j DNAT --to 192.168.100.170:1194

By this you tell iptable, that any UDP packets witch come to eth0 with destination address 196.25.157.135:1194 NAT has to change destination address to 192.168.100.170:1194, then ou tell FORWARD them.

Have noticed, that you gave only ONE WAY order.

Packets witch goes back is not TRANSIT packets for iptable!

Thats why I am not sure which other iptables to add. I am missing the point here myself.

Let put the example ip's in my configuration for you and not the ones I just copy and paste from the test server, may be someone can help to build the right iptables.

/usr/sbin/iptables -t nat -A PREROUTING -p udp -i eth0 -d 2.2.2.5 --dport 1194 -j DNAT --to 1.1.1.2:1194
/usr/sbin/iptables -A FORWARD -p udp --dport 1194 -j ACCEPT

Now as per my explanation the reply from server1 does not comes back to 2.2.2.5 but goes to the default gateway of server1 which is 1.1.1.1

Not sure if I have to add specific iptables on server1 as well?

Thanks

Packets will go back to sender.

To the sender's IP.

As long as it works it doesn't matter which path the returning packages take, no ?

Thanks everyone, got it working. Fault in another firewall rule caused my problem.

Thanks again.