I want to set up UDP port forwarding in order to access an OpenVPN server. The setup is a bit weird, there is a little bit of context here but to sum up:

  • Home I have a Raspberry Pi, IP address (static) + one given by a different private OpenVPN network (I can't rely on it never changing from since it's DHCP)
  • Public address I am gaining from an AWS setup. It's an EC2 instance, it's 18.157.x.y (never changing). Also private IP of the same instance, (it's the only host in its VPC). In the tunnel between hosts, it's
  • On my Raspberry Pi I want to run another OpenVPN server, listening on the regular 1194 port UDP (not gonna do TCP, even though socat solves the part where a TCP port needed to be forwarded.
  • As such, I need to somehow forward the Pi's port to a port of my EC2 instance.

In short, I want the UDP packets going to port 53 of my AWS instance to arrive on my Pi at port 1194 (VPN server listens on so the interface doesn't truly matter) AND the return packets to arrive back correctly.

I think I need to mention what I've already tried (and didn't work). I've tried several kinds of iptables rules.

One of the attempts that failed me was this:

iptables -t nat -A PREROUTING -i eth0 -p udp --dport 53 -j DNAT --to-destination

If there is a solution that can use IPv6 then I wouldn't really mind it. It's just that the typical client and the VPN server listen on UDP on IPv4. Doing 2 layers of 4-to-6 and then 6-to-4 translation is acceptable. My Raspberry Pi has a public IPv6 address (SLAAC, but the prefix isn't stable and might change). My EC2 host has IPv6 connectivity (fixed, public IP, though I don't think I need to share it). Clients may lack it. Running a reverse-NAT64 on the AWS is acceptable if that helps.

  • Why bother with a second tunnel? You already have one, just route your stuff through it. // This isn’t working because the response packages come from your home connection instead of the EC2 instance. – Daniel B Sep 3 '20 at 13:31
  • I want different levels of security for the two tunnels, and I want TAP access (instead of TUN) to my home network. I.E. I want to actually do, for example, broadcasts in order to detect local devices such as e.g. a printer that would otherwise only be visible in the router's DHCP table. – Paul Stelian Sep 3 '20 at 13:59
  • Should I have a second instance of OpenVPN running on AWS that is TAP and bridges to my home network (which is under CGNAT, see context link) and just allow any devices to merely connect to that? – Paul Stelian Sep 3 '20 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.