Tunnel ports, thru VPS running OpenVPN, into my home network via Tomato Router

Question

Long-story-short, my ISP has me double-NAT'ed = I can't open ANY ports.

My router is running Tomato firmware, and I have its OpenVPN client linked to a VPS running OpenVPN. I can divert my home network's internet thru OpenVPN, thru the VPS, and everything seems to work.

BUT

I want to open ports, so I can get back into my network from outside: 3389 for Remote Desktop, 32400 for PLEX, my IP camera... All my stuff.

Can someone give me a "For Dummies" explanation how to do this?

Answer 1

My condolences on the double NAT.

If you have root access on the VPS, try using destination port forwarding with iptables (DNATing). On the VPS, run the following commands

sysctl -w net.ipv4.ip_forward=1   #see link above to make this setting survive reboots
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 3389 -j DNAT --to-destination x.y.z.w

where eth0 is the internet-facing interface on the VPS, and x.y.z.w is the IP of your home computer through the OpenVPN tunnel. You may need to repeat the above commands with -p tcp replaced by -p udp if the service you are forwarding requires both TCP and UDP. If you have a default policy of DROP in your FORWARD chain (unlikely), you need something like iptables -A FORWARD -i eth0 -p tcp --dport 80 -d x.y.z.w -j ACCEPT

A completely different way to accomplish TCP port forwarding is to use ssh with the -R option. Issue the following command on your home computer

ssh -N -R *:3389:x.y.z.w:3389 [email protected]

where x.y.z.w is as above, m.n.o.p is the IP of your VPS, and user is your ssh login on the VPS. You need to set GatewayPorts yes in /etc/ssh/sshd_config (and restart sshd) on the VPS.