Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

For simplicity purposes, assume that a network has two computers behind a gateway and firewall, computer A and computer B.

Computer A is running openvpn as a client. Its traffic is forwarded to an openvpn server at a remote location. Accordingly, computer A has two IP addresses: 192.168.1.1 (eth0) and 10.20.10.20 (tap). Computer A's openvpn config file is displayed at the bottom. Computer A runs windows 7.

Computer B does not run open vpn. It just has IP 192.168.1.2 (eth0). Computer B runs linux. It is accessible to the outside world.

How does one forward a single port from Computer A to Computer B? (Using putty or otherwise). There is a service running on Computer A, port XYZ that needs to be accessible to the outside world. Accessing it on the openvpn-server's endpoint is not possible. So, it is possible to forward a single port from A to B over putty? Users could then access Computer B from the outside world, whose connection to port XYZ would then be routed to Computer A. Thus, although Computer A is still connected to the openvpn tunnel, its can be reached from Computer B on the local network.

Please let me know if you have a solution, thanks.

client
dev tun
proto tcp
remote XX.XX.XXX.XXX 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
tls-client
remote-cert-tls server
auth-user-pass
comp-lzo
verb 1
reneg-sec 0
share|improve this question

migrated from stackoverflow.com Dec 14 '12 at 8:45

This question came from our site for professional and enthusiast programmers.

2 Answers 2

up vote 1 down vote accepted

Lats assume that computer B is running Linux (distro does not meter). Lats assume that computer B has 2 interfaces. eth0 one that have IP address 192.168.1.2 and internet interface (as you mention it is accessible from internet.) Lats assume that we need to redirect port XY from internet to computer A XY port.

On computer B we will need to activate ipv4 forwarding (from previous comment)

 sysctl net.ipv4.ip_forward=1

now we need to redirect all traffic coming to Internet interface (eth1) to port XY to computer A interface eth0 port XY

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport XY  -j DNAT --to COMPA_ETH0_IP:XY

this configuration already will work, if default gateway of computer A is computer B If not then we will need to hide our source IP from computer A.

iptables -t nat -A POSTROUTING -j MASQUERADE

after this command all visible traffic on port XY on computer A will be visible as from IP address of computer B.

share|improve this answer
    
Awesome, thanks! –  Oddworld Dec 14 '12 at 18:14

Here is solution

sysctl net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -p tcp --dport port -j DNAT --to-destination ip:port
iptables -t nat -A POSTROUTING -j MASQUERADE
share|improve this answer
    
Yes, worked, thank you! –  Oddworld Dec 14 '12 at 17:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.