I've gotten a Private Internet Access VPN setup on a Mythbuntu 14.04 machine and I am at wits end trying to get port forwarding working with rTorrent (and ruTorrent). My setup is rTorrent running under a dedicated user account with all internet traffic for that user only directed through the VPN via OpenVPN and some iptables rules. I receive a forwarded port from PIA but using that port number with rTorrent doesn’t show the port as being forwarded in the ruTorrent web GUI. I've tried a plethora of iptables forwarding rules to no avail – no matter what I try the ruTorrent web GUI shows the rtorrent port as being blocked. I've used port scanners and I can see that the allocated port on the external VPN IP address is open and I can also see that rTorrent is listening on the allocated port. I have tried the port forwarding with OpenVPN running system wide and the ruTorrent webUI shows the port as forwarded – so I'm guessing my issue stems from the fact that the VPN is only active for one user and that I'm using iptables to achieve this – but I can't figure out how to make it work.
The command I'm using to start OpenVPN (note the --route-nopull argument):
sudo openvpn --config /home/prime/.pia/Russia.ovpn --auth-user-pass /home/prime/.pia/passwd --script-security 2 --up /home/prime/.pia/up.sh --down /home/prime/.pia/down.sh --route-nopull --ca /home/prime/.pia/ca.crt --crl-verify /home/prime/.pia/crl.pem
My up.sh file which sets up the iptable rules for the 'torrent' user:
#!/bin/bash iptables -t mangle -I OUTPUT -m owner --uid-owner torrent -j MARK --set-mark 42 iptables -t mangle -I OUTPUT -d 192.168.1.0/24 -m owner --uid-owner torrent -j RETURN iptables -t nat -I POSTROUTING -o tun0 -j MASQUERADE ip rule add fwmark 42 table 42 for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 0 > $f done ip route add default via $(ifconfig -a tun0 | grep -o 'P-t-P:[^ ]*' | cut -d : -f 2) table 42 sleep 1 ip route flush cache ....applications load from here on
The iptables rule I am using (I've tried a great deal more too) to no avail:
#!/bin/bash PORT=45829 IPADDRESS=$(ifconfig tun0|grep -oE "inet addr: *10\.[0-9]+\.[0-9]+\.[0-9]+"|tr -d "a-z :") sysctl -w net.ipv4.ip_forward=1 iptables -t nat -I PREROUTING -i tun0 -p tcp -j DNAT --to $IPADDRESS:$PORT iptables -t nat -I PREROUTING -i tun0 -p udp -j DNAT --to $IPADDRESS:$PORT #iptables -t nat -I PREROUTING -i tun0 -p tcp --dport $PORT -j DNAT --to-destination $IPADDRESS:$PORT #iptables -t nat -I PREROUTING -i tun0 -p udp --dport $PORT -j DNAT --to-destination $IPADDRESS:$PORT iptables -I FORWARD -i tun0 -p udp -d $IPADDRESS --dport $PORT -j ACCEPT iptables -I FORWARD -i tun0 -p tcp -d $IPADDRESS --dport $PORT -j ACCEPT iptables -A INPUT -p udp -m state --state NEW --dport $PORT -i tun0 -j ACCEPT iptables -A INPUT -p tcp -m state --state NEW --dport $PORT -i tun0 -j ACCEPT