I have a router on Tomato (shibby) running an OpenVPN server (with TAP; interface is
tap21 on the router). Various resources (including some workstations) are physically connected to
eth0 on this router. I have another physical device across the country which is running nginx and other services. Now, I know this isn't a great topographical setup, but unalterable circumstances require that the device running nginx must be a client of the router VPN and all of this device's inbound traffic and outbound traffic on ports 80 and 443 must be tunnelled through this VPN connection.
So basically, what needs to happen is:
- example.com resolves to IP of WAN on the router
- router forwards ports 80 and 443 through
tap21interface to nginx server
- nginx server response comes back through
tap21and is routed back through WAN
The #2 part is what I'm having trouble with.
The server is currently able to communicate with other devices on the subnet (able to ping other resources on the VPN as well as resources physically connected to
eth0 on the router) and can access the internet through the VPN. However, I've been unable to forward ports from WAN to the server's address on the VPN. The first attempt I made was simply trying the port forwarding GUI in Tomato (but this seems not to work for IPs on the VPN, only those on
wlan0). When that didn't work, I tried adding iptables rules, but as I'm still largely uncomfortable with iptables I've only been able to find snippets from other answers for questions that don't really relate to this weird and problematic networking setup. Here's what I'm trying (using 10000 as a test port with
iptables -t nat -I PREROUTING -p tcp -m tcp --dport 10000 -j DNAT --to-destination 192.168.12.53:10000 iptables -I FORWARD -d 192.168.12.53 -p tcp --dport 10000 -j ACCEPT
However, I can't figure out what's happening to packets being re-routed in this way--they're certainly not reaching the server. Essentially, my question is how can I forward inbound connections on particular ports to a particular device on a VPN? Outbound traffic on ports 80 and 443 from other resources on the router's
eth0 must, of course, not be affected.
Thanks for any help you can provide!