Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For simplicity purposes, assume that a network has two computers behind a gateway and firewall, computer A and computer B.

Computer A is running openvpn as a client. Its traffic is forwarded to an openvpn server at a remote location. Accordingly, computer A has two IP addresses: (eth0) and (tap). Computer A's openvpn config file is displayed at the bottom. Computer A runs windows 7.

Computer B does not run open vpn. It just has IP (eth0). Computer B runs linux. It is accessible to the outside world.

How does one forward a single port from Computer A to Computer B? (Using putty or otherwise). There is a service running on Computer A, port XYZ that needs to be accessible to the outside world. Accessing it on the openvpn-server's endpoint is not possible. So, it is possible to forward a single port from A to B over putty? Users could then access Computer B from the outside world, whose connection to port XYZ would then be routed to Computer A. Thus, although Computer A is still connected to the openvpn tunnel, its can be reached from Computer B on the local network.

Please let me know if you have a solution, thanks.

dev tun
proto tcp
remote XX.XX.XXX.XXX 443
resolv-retry infinite
ca ca.crt
remote-cert-tls server
verb 1
reneg-sec 0
share|improve this question

migrated from Dec 14 '12 at 8:45

This question came from our site for professional and enthusiast programmers.

up vote 1 down vote accepted

Lats assume that computer B is running Linux (distro does not meter). Lats assume that computer B has 2 interfaces. eth0 one that have IP address and internet interface (as you mention it is accessible from internet.) Lats assume that we need to redirect port XY from internet to computer A XY port.

On computer B we will need to activate ipv4 forwarding (from previous comment)

 sysctl net.ipv4.ip_forward=1

now we need to redirect all traffic coming to Internet interface (eth1) to port XY to computer A interface eth0 port XY

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport XY  -j DNAT --to COMPA_ETH0_IP:XY

this configuration already will work, if default gateway of computer A is computer B If not then we will need to hide our source IP from computer A.

iptables -t nat -A POSTROUTING -j MASQUERADE

after this command all visible traffic on port XY on computer A will be visible as from IP address of computer B.

share|improve this answer
Awesome, thanks! – Oddworld Dec 14 '12 at 18:14

Here is solution

sysctl net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -p tcp --dport port -j DNAT --to-destination ip:port
iptables -t nat -A POSTROUTING -j MASQUERADE
share|improve this answer
Yes, worked, thank you! – Oddworld Dec 14 '12 at 17:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.