Port forwarding over OpenVpn

Question

I wanted to host few gameservers on my home network to play with my buddies, the thing is having a public ip is like begging to get DDoS'ed, so what ive done is i have set up a OpenVPN server on a DDoS protected vps with ip 98.158.113.x. My home server public ip is 143.12.44.x.

I have used these iptables rules to forward traffic from the vps to my home server via OpenVPN:

IVSS 7730

iptables -t nat -A PREROUTING -d 98.158.113.x -p udp --dport 7730 -j DNAT --to-dest 10.8.0.2:7730 iptables -t nat -A POSTROUTING -d 10.8.0.2 -p udp --dport 7730 -j SNAT --to-source 10.8.0.1

10.8.0.1 is the OpenVPN gateway i think and 10.8.0.2 is the ip my home server has got from the OpenVPN server.

The problem here is that when someone connects to the server his ip is listed as 10.8.0.1 instead of his real ip.

Is there any way i can fix that?

Answer 1

If your gameserver is running Linux then yes.

You need to get rid of the SNAT rule, unfortunately when you do so you create another problem, there is no longer anything to force traffic that came from the VPN to go back over the VPN.

To fix this you can use policy routing on the game server. I belive you would set this up roughly as follows (but this is from memory, not a tested example)

First lets create a named routing table by adding an entry "100 openvpn" to /etc/iproute2/rt_tables

Then we can add a rule to send all traffic from the gameserver's VPN IP address to our new routing table.

ip rule add from 10.8.0.2 table openvpn

And add a route in the new routing table to send everything back to the openvpn server.

ip route add default dev tun0 table openvpn

(assuming your openvpn tunnel is tun0)

See https://lartc.org/howto/lartc.rpdb.multiple-links.html for a more detailed explanation.