0

I wanted to host few gameservers on my home network to play with my buddies, the thing is having a public ip is like begging to get DDoS'ed, so what ive done is i have set up a OpenVPN server on a DDoS protected vps with ip 78.128.113.x. My home server public ip is 212.5.59.x.

I have used these iptables rules to forward traffic from the vps to my home server via OpenVPN:

IVSS 7730

iptables -t nat -A PREROUTING -d 78.128.113.x -p udp --dport 7730 -j DNAT --to-dest 10.8.0.2:7730 iptables -t nat -A POSTROUTING -d 10.8.0.2 -p udp --dport 7730 -j SNAT --to-source 10.8.0.1

10.8.0.1 is the OpenVPN gateway i think and 10.8.0.2 is the ip my home server has got from the OpenVPN server.

The problem here is that when someone connects to the server his ip is listed as 10.8.0.1 instead of his real ip.

Is there any way i can fix that?

0

If your gameserver is running Linux then yes.

You need to get rid of the SNAT rule, unfortunately when you do so you create another problem, there is no longer anything to force traffic that came from the VPN to go back over the VPN.

To fix this you can use policy routing on the game server. I belive you would set this up roughly as follows (but this is from memory, not a tested example)

First lets create a named routing table by adding an entry "100 openvpn" to /etc/iproute2/rt_tables

Then we can add a rule to send all traffic from the gameserver's VPN IP address to our new routing table.

ip rule add from 10.8.0.2 table openvpn

And add a route in the new routing table to send everything back to the openvpn server.

ip route add default dev tun0 table openvpn

(assuming your openvpn tunnel is tun0)

See https://lartc.org/howto/lartc.rpdb.multiple-links.html for a more detailed explanation.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.