iptables : DNAT to openvpn tunnel doesn't work

mgai7755 · 02-06-2014, 08:29 AM

Hi,

I use this rule to redirect ip traffic coming on port 143 to go to address 10.9.0.10, same port, which is at the other end of an established VPN tunnel.

Code:

-A PREROUTING -p tcp -m tcp --dport 143 -j DNAT --to-destination 10.9.0.10:143

Result :

Code:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       tcp  --  anywhere             anywhere            tcp dpt:imap2 to:10.9.0.10:143

It doesn't work. The port looks open (connection isn't immediately refused), but the connection times out.

A tcpdump on the tun0 interface shows no activity at all on port 143.

Connecting directly (telnet 10.9.0.10 143) works.

Help anybody ?

Thanks

Matt

mgai7755 · 02-06-2014, 09:26 AM

Ok, reply to self.

1°) enable forwarding looks mandatory :

Code:

sudo sysctl -w net.ipv4.ip_forward=1

2°) it is needed to add a way back for the packets using those two lines :

Code:

sudo iptables -A FORWARD --in-interface eth0 -j ACCEPT # accepts packets
sudo iptables -t nat -A POSTROUTING --out-interface tun0 -j MASQUERADE # provides a way back from the server