I have a raspberry pi with raspbian os which is connected to an openvpn server. Openvpn server has public IP and runs Ubuntu. I am able to reach a web application which runs on raspberry pi via public ip address of the vpn server if I enable port forwarding on the vpn server this way (XXX.XXX.XXX.XXX is a public ip):

iptables -t nat -A PREROUTING -d XXX.XXX.XXX.XXX -p tcp --dport 8765 -j DNAT --to-dest

But I would like to reach also an IP camera which is on the same LAN as the raspberry is. Unfortunately I can't run openvpn client on the ip camera, so the IP camera has only local IP and it listens on port 80. Is it possible to forward a port on the public IP to raspberry pi openvpn client and then forward further to the ip camera on the local lan?

  • so let me understand this better, 1) you're saying that you're running openvpn client on raspberry pi to connect to the ubuntu server, correct? 2) You're also saying that the raspberry pi and the camera are on the same remote network, correct? 3) so the setup of openvpn is really road warrior rather than peer to peer, correct? it would help if you also provided the routes pushed by the vpn server, the local ips of the raspberry pi machine and the local ip of the camera. They don't need to be the actual ips, you write anything you want as long as it reflects the topology. Commented Oct 10, 2017 at 22:25
  • @AlexAustin 1) Yes, raspberry pi runs raspbian linux and use openvpn to connect to the ubuntu server 2) Yes, ip camera and the raspberry are on the same LAN and use the same subnet 3) Raspberry pi and the ip camera are using internet connection which does not have public IP and this is the reason raspberry is connecting to the VPN server which has public IP. Then I can make portforward on the VPN server and I reach raspberry pi via VPN server's public IP.
    – user241281
    Commented Oct 11, 2017 at 7:03
  • @AlexAustin And this is the route which on raspberry pi: $ ip route show via dev tun0 default via dev wlan0 src metric 302 dev tun0 proto kernel scope link src XXX.XXX.XXX.XXX via dev wlan0 via dev tun0 dev wlan0 proto kernel scope link src metric 302
    – user241281
    Commented Oct 11, 2017 at 7:04

2 Answers 2


Try to do the following on raspberry:

# echo 1 > /proc/sys/net/ipv4/ip_forward
# iptables -t nat -I PREROUTING -p tcp --dport 8088 -j DNAT --to <cameraip>:<camera port>
# iptables -t nat -I POSTROUTING -s <cameraip>/ -j MASQUERADE

Then access the camera the same way you access the app on the pi, but use port 8088 instead of 8765. Good luck.


Another solution without enabling IP forwarding on your machine.

  1. Forward a port from your OpenVPN server to your Raspberry,
iptables -t nat -A PREROUTING \ 
   -d XXX.XXX.XXX.XXX -p tcp --dport 8888 \
   -j DNAT --to-dest
  1. On your Raspberry, forward incoming connections to your camera using something like socat
socat TCP-LISTEN:8888,fork TCP:

The upside of this is that you do not enable IP fowarding on your machine which might have side effects. By enabling IP fowarding on your local machine (without adding firewall rules), you might allow machines on your LAN to attack machines on your OpenVPN server network (assuming this is allowed by the OpenVPN server).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .