I want to set up UDP port forwarding in order to access an OpenVPN server. The setup is a bit weird, there is a little bit of context here but to sum up:
- Home I have a Raspberry Pi, IP address 192.168.1.72 (static) + one given by a different private OpenVPN network (I can't rely on it never changing from 10.88.53.2 since it's DHCP)
- Public address I am gaining from an AWS setup. It's an EC2 instance, it's 18.157.x.y (never changing). Also private IP of the same instance, 172.31.5.117 (it's the only host in its VPC). In the tunnel between hosts, it's 10.88.53.1.
- On my Raspberry Pi I want to run another OpenVPN server, listening on the regular 1194 port UDP (not gonna do TCP, even though
socatsolves the part where a TCP port needed to be forwarded.
- As such, I need to somehow forward the Pi's port to a port of my EC2 instance.
In short, I want the UDP packets going to port 53 of my AWS instance to arrive on my Pi at port 1194 (VPN server listens on 0.0.0.0 so the interface doesn't truly matter) AND the return packets to arrive back correctly.
I think I need to mention what I've already tried (and didn't work). I've tried several kinds of iptables rules.
One of the attempts that failed me was this:
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 53 -j DNAT --to-destination 192.168.1.72:1194
If there is a solution that can use IPv6 then I wouldn't really mind it. It's just that the typical client and the VPN server listen on UDP on IPv4. Doing 2 layers of 4-to-6 and then 6-to-4 translation is acceptable. My Raspberry Pi has a public IPv6 address (SLAAC, but the prefix isn't stable and might change). My EC2 host has IPv6 connectivity (fixed, public IP, though I don't think I need to share it). Clients may lack it. Running a reverse-NAT64 on the AWS is acceptable if that helps.