Hi folks,

my ISP has assigned multiple IP's to my WAN interface. I wish to use eth0:1 to port forward to a web server who is on the other end of an openvpn tunnel (bridge mode - tap0)

I've tried:

iptables -t nat -A PREROUTING -p tcp --dport 80 -d xx.xx.xx.xx -i eth0 -j DNAT --to-destination 10.87.0.14:80

which doesn't work. The web browser just hangs on "Connecting to". From this server, I can ping 10.87.0.14.

Looking at tcpdump, I see port 80 traffic comming into the box but no sign of it leaving via tap0.

Since openvpn is in bridge mode, tap0 has an IP from the local subnet where the web server is.

There are no other iptables rules running on the box

Thanks

No
Iptables cannot work with sub-interfaces.
you can work around this by

1. You can create a bridge br0 and enslave the main interface in the bridge
2. create a tun/tap device and enslave that too in the bridge
3. now use iptables on the tun/tap device

Hi There,

Actually I found that my post above does indeed work, I just had to enable IP forwarding and change the default gateway on the linux box!

However, bhaslinux, could I maybe get an example of how to put the interfaces in bridges? Do I really need to? Is my way unsafe?

Thanks