0

I have a NAS server which I should do port forwarding for it in order to make its services accessible from internet. However my ISP is blocking ports, so I've managed to buy myself a cheap Ubuntu VPS to run an OpenVPN server there and then somehow redirect the whole NAS traffic and the required ports to there.

My setup is as the following:

                                        +--------------------------------+
                                        |            Raspi               |
                      (192.168.0.101/24)|                                |(192.168.1.1/24)
 (192.168.0.1/24) AP<>=================={wlan0                       eth0}================<>NAS (192.168.1.102/24)
                                        |   \                        /   |
                                        |    +----------------------+    |
                                        |    |     iptables and     |    |
                                        |    |    routing engine    |    |
                                        |    +-----------+----------+    |
                                        |                |               |
                                        |             {tun0}             |
                                        |            10.8.0.6            |
                                        +--------------------------------+

The VPS side is configured correctly I guess, as I am able to SSH into my Raspberry Pi using my VPS IP. That's what I've done there in order to make it work:

iptables -t nat -A PREROUTING -d A.B.C.D -p tcp --dport 22 -j DNAT --to-dest 10.8.0.6:22
iptables -t nat -A POSTROUTING -d 10.8.0.6 -p tcp --dport 22 -j SNAT --to-source 10.8.0.1

My OpenVPN server config:

port X
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

I have also done:

sysctl -w net.ipv4.ip_forward=1

and put DEFAULT_FORWARD_POLICY="ACCEPT" in /etc/default/ufw and also added

# START OPENVPN RULES
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0] 
# Allow traffic from OpenVPN client to eth0
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
COMMIT
# END OPENVPN RULES

to

/etc/ufw/before.rules

OpenVPN client config:

client
dev tun
proto udp
remote A.B.C.D X
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ns-cert-type server
comp-lzo
verb 3

<ca>
XXX
</ca>
<cert>
YYY
</cert>
<key>
ZZZ
</key>

How do I redirect eth0 traffic to tun0 and forward ports Y and Z through the tunnel?

I just know that for the other ports I should reconfigure my VPS accordingly as I did for port 22.

  • If you've found a solution that answers your question, post it as a separate answer (rather than adding it to your question) and then choose your answer as the accepted answer. – Ouroborus Apr 3 '16 at 18:17
0

I've managed to redirect the traffic on my Raspi with the following command:

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o tun0 -j MASQUERADE

When I traceroute out of my NAS it goes through the tunnel. Now I only need to forward ports in this tunnel.

UPDATE (solving the whole project):

I finally found the correct port forwarding commands after hours of searching. I've ran the following commands on my Raspi:

iptables -t nat -I PREROUTING -p tcp -i tun0 -d 10.8.0.6 --dport <port> -j DNAT --to 192.168.1.102:<port>
iptables -I FORWARD -p tcp -i tun0 -d 192.168.1.102 --dport <port> -j ACCEPT

And also these commands on my VPS as I've done at first for port 22 at the beginning of this thread:

iptables -t nat -A PREROUTING -d 217.160.14.45 -p tcp --dport <port> -j DNAT --to-dest 10.8.0.6:<port>
iptables -t nat -A POSTROUTING -d 10.8.0.6 -p tcp --dport <port> -j SNAT --to-source 10.8.0.1

So now I've bypassed the firewall of my ISP and I am able to access my NAS and its services using port forwarding on the VPS side. You can use this as a tutorial :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.