2

I ran into a problem which seems I can't solve. I have a VPN server on a VPS. I can connect with my client PC(home lan). It works as it should. I get the VPS IP address on the client PC.

However I would like to be able to connect through the VPN to the client PC using a specific port. I have a MineCraft server and I would like to be able to connect to MC server through the VPN.

I enabled IP forwarding:

sysctl -w net.ipv4.ip_forward=1

Tried to forward the specific port:

iptables -t nat -A PREROUTING -d 50.x.x.x -p tcp --dport 25565 -j DNAT --to-dest 10.98.0.2:25565

50.x.x.x is my VPN public IP address. 10.98.0.2 is the client's local(tun0) IP address.

For some reason its not working. tcpdump port 25565 shows this on the VPN server when I try to connect to the client:

20:49:58.345498 IP MyInternetPublicIP.62336 > VPNPublicIP.25565: Flags [S], seq 2320085851, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
20:50:01.344059 IP MyInternetPublicIP.62336 > VPNPublicIP.25565: Flags [S], seq 2320085851, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
20:50:07.342439 IP MyInternetPublicIP.62336 > VPNPublicIP.25565: Flags [S], seq 2320085851, win 8192, options [mss 1460,nop,nop,sackOK], length 0

On the client side nothing shows up. I'm sure I'm missing something just don't know what.

2

You have to allow forwarding in the filter table (in the FORWARD chain or a chain called from there) with something like this:

iptables -I FORWARD 1 -d 10.98.0.2 -p tcp --dport 25565 -j ACCEPT

Without special configuration on the client side which makes sure that the response packets are sent through the VPN you also have to configure SNAT:

iptables -t nat -A POSTROUTING -m conntrack --ctstate DNAT -d 10.98.0.2 -p tcp --dport 25565 -j SNAT --to-source 10.98.0.1

Assuming that 10.98.0.1 is the VPS VPN address.

| improve this answer | |
  • Thank you. I was able to make it work with your examples. – Doctor Who Mar 20 '18 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.