Server (A)

  • Have an interface eth0 with public IP
  • His default gateway is
  • It's an OpenVPN server with net on tun0 interface
  • At same time acts as client for a second OpenVPN server with net on tun1 interface

Client (A) for Server (A)

  • His default gateway is
  • Here this have a service listening on port 3150
  • Connected to ServerA and his IP is with tun0 interface, his outgoing traffic to internet go throuth his default gw no to the tun0 -vpn interface-

The Question

One user on internet connect to my public IP (ServerA) and need to forward to ClientA on ip

I make this change in iptables on ServerA

1 - Opening port listening on ServerA

iptables -I INPUT 1 -i eth0 -p udp -m state --state NEW,ESTABLISHED -m udp --dport 3150 -j ACCEPT

2- Change the destination ip to the ClientA

iptables -t nat -I PREROUTING -i eth0 -p udp --dport 3150 -j DNAT --to-destination

- So the packets is redirected to ClientA but no response packet to the ServerA from ClientA coming on the vpn tunnel in tun0 interface.

  • Anyone can help me? – Matias Mar 30 '18 at 14:53
  • rule 1 is never called (=useless): prerouting acted before and now the packet is forwarded and sees only the FORWARD chain in the filter table. The problem is about routing: client A has a gateway to internet that is not tun0/ServerA. so it dropped the incoming packet because of reverse path filter. Even if it didn't,reply would go via and fail . Solution would be alter ClientA's route for this connection (policy routing, difficult) or else, also SNAT the incoming connection so ClientA is happy (but blind to who is making a call). If you're still around and can tell what you wish? – A.B Apr 4 '18 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.