i didnt understand ,
now i have vpn account and when i connect it take this ip 10.10.10.1
ok if i connect from more than vpn acount 2-3-4-5
so it will all take the ip 10.10.10.1 this will be conflict

No.
I will explain what this rule means.
In short this rule means:

All TCP packets that are destined to ip 184.173.180.202, to port 82, route to (translate, change destination address) 10.10.10.1

So, when somebody tries to open 184.173.180.202:82, he gets routed (DNAT) to 10.10.10.1

That's the what the DNAT is commonly used for, to enable access to the local servers that has a private ip address.

True. You can set the range for remote ip (check the guide in pptpd.conf)

localip 10.10.10.1
remoteip 10.10.10.2-245
so that the users will get ip between 2 and 245

but how i can open port for ips between 2 and 245

uhm.. No :)

better put like this:

localip 10.10.10.254
remoteip 10.10.10.1-10.10.10.253


If you want that a specific pptp user(let's say user: hack-back) always get the same remoteip (10.10.10.1 in your case, because you want to run the some kind of server software at your pptp remoteip), you can achieve this by editing the

/etc/ppp/chap-secrets

# client server secret IP addresses

Bob * pass123 *
hack-back * pass123 10.10.10.1


So, in this case study, user "Bob" will get random ip from specified remoteip range, while user "hack-back" will always get the same remoteip - 10.10.10.1

Also, while editing the file above please note that you must press the TAB key between client,server,secret,IP addresses fields.

ok good thanks and whats about the iptables

-A PREROUTING -d 184.173.180.202/32 -p tcp -m tcp --dport 1177 -j DNAT --to-destination 10.10.10.1


will be just for 10.10.10.1 or all vpn users ??

No, you should add one iptables DNAT rule per each user that is going to run some software that should be reachable from Internet.

The static remoteip applies to all those users who are going to run some software that listens at some port.

For other users that will not be running anything like I said, you should not add the DNAT rules.

...yeah be aware that you should not add the DNAT rules using same --dport for different --to-destination

e.g. adding the following two rules will be a mistake:

iptables -t nat -A PREROUTING -d 184.173.180.202 -p tcp --dport 82 -j DNAT --to 10.10.10.1
iptables -t nat -A PREROUTING -d 184.173.180.202 -p tcp --dport 82 -j DNAT --to 10.10.10.2

ok thank you man thats big for today,
thank you again bro

You are welcome, bye