2

I have been trying to properly port-forward my VPN server to no avail. I run an OpenVPN Access Server (made following a guide here) on Azure and would like users to connect to the VPN Public IP, which would forward them to my actual server public IP (a visual explanation at the end).

There are already VERY similar posts about this here and there. As a result of that, I have tried a bunch of things and researched a bunch of questions before, namely this, this, this, this (and probably even more), as well as certain articles like this, this and that, others as well probably. I have tried running this based on my situation, to no avail as well.

I have tried adding the Public IP of the VPN server in the User Permissions of the Access Server, to no avail:

51.x.x.x:tcp/63394
51.x.x.x:udp/63394
51.x.x.x:tcp/23394
51.x.x.x:udp/23394
51.x.x.x:tcp/29339
51.x.x.x:udp/29339

I have also tried running the game server on both the public and lan IP, but that didn't make a difference. I can access the OpenVPN AS admin web UI via 10.0.1.4, which makes me think that the setup is correct. I have also added port-forwarding and traffic rules on my router for testing, but that had no effect either (tun0 interface port-forward to lan interface lan IP of PC, traffic rule vpn zone to lan zone - accept).

I have also added inbound and outbound rules in Azure for the VM. That hasn't helped either. I am not sure whether it's due to the OS or due to Azure. I am also not sure whether OpenVPN listens on port 63394, but even with DMZ on that port I am not able to connect to that port.

The current router and VPN Server routing can be viewed here.

The amount of information is a bit overwhelming, and I cannot seem to wrap my head around it alone anymore.

A visual representation of my setup is here: Server Setup

EDIT: I have come to the point where I am able to ping the Game Server PC from the outside (by pinging the public IP of the VPN Server) and from within the VPN server (by pinging 10.0.2.25). I am also able to connect to the server with the 10.0.2.25 IP, however, I cannot connect with the public IP of the VPN Server. Any thoughts?

Improve this question
2
  • As far as your users are concerned, the game server is actually on 51.x.x.x.x, and they don't need to know anything about your OpenVPN tunnel. Is that correct? Or do they use OpenVPN to connect to the OpenVPN SERVER too? Have you got a route from OpenVPN SERVER to the subnet (or host) 192.168.x.x? If not, there's no way traffic will head down the OpenVPN tunnel from OpenVPN SERVER to the Game Server PC.
    – roaima
    Apr 12, 2021 at 14:49
  • @roaima Yes, you are correct. As for a routes, I used iptables as given in the post to open ports and redirect traffic to 10.0.1.25, while also setting up a rule to accept traffic on the given ports from 10.0.1.25. I couldn't find a server.conf file in the Access Server to put routes in. I have also tried to do that with route add, but I couldn't find any significant information that could give me an understanding for that. I could try using route add 10.0.1.4 255.255.255.0 10.0.1.25, but I don't know if that would accomplish anything or not, since I couldn't find any help on that..
    – Patrikas King
    Apr 12, 2021 at 15:06

2 Answers 2

Reset to default
1

As mentioned in some posts here and there, apparently all I had to do was enable DMZ on the client user permissions by adding the following:

{Router_Public_IP}:{tcp or udp}/{port}
{VPN_Public_IP}:...
{VPN_Private_IP}:...
{VPN_Client_Private_IP}:...

The reason it didn't work at first is because I didn't realize (to be precise - I didn't find any information on that) that connecting with a game client to the VPN Public IP from the Game Server PC, I would not be able to establish a connection (for reasons that are beyond my scope of knowledge).

What helped me understand the problem is the fact that I realized I should ping each part of this scheme and see where my problem lies. By pinging 10.0.2.25 from VPN Server and 10.0.2.4 from PC/Router I understood the connection was fine. Using nmap from VPN Server to 10.0.2.25 I found out whether the ports opened, and altered my router port-forwarding to make them work properly. By using nmap from Router/VPN Server to the VPN Server Public IP I got a general idea whether ports are filtered/open when the Game Server is running. When I found out that pinging actually arrived at the Game Server, I understood the problem was on my end.

Coming back to the beginning, what I ended up doing, was this:

89.xx.xx.xx:{tcp or udp}/63394
51.xx.xx.xx:{tcp or udp}/63394
10.0.2.4:{tcp or udp}/63394
10.0.2.25:{tcp or udp}/63394

I don't know why, but this solved my problems with the port.

Thank you everyone for helping and providing suggestions. Also thanks to those outside the forum who helped me out as well.

Improve this answer
0

It sounds like you haven't got a route set up, so the traffic from the OpenVPN SERVER has no idea how to get to Game Server PC.

On the OpenVPN SERVER you need to extend your OpenVPN configuration to provide a route to 192.168.x.x/24. Similarly, unless your OpenWRT device handles the default route for Game Server PC you need to add a route on Game Server PC 10.0.1.0/24 via 10.0.1.25. Also you much ensure that Game Server PC always connects with the same tunnel IP address (10.0.1.25 in your example).

Server configuration:

route 192.168.x.x 255.255.255.0 10.0.1.25

Game Server PC configuration could be this if Linux-based. Replace ?.? with the appropriate address octets for the OpenWRT device,

route add 10.0.1.0/24 gw 192.168.?.?
Improve this answer
4
  • I am not sure if I understand this right, but I'll clear it up just in case - Game Server PC and VPN Server are in different locations. Can I still address the Game Server PC LAN IP in that case? If yes, then I have tried that by putting in the server config directives, and I have also (just in case) added a static route in the OpenWRT router here according to what you have told me (also added source IP 10.0.2.25). Since the last time, I have reinstalled the Access Server, so the IPs are now 10.0.2.0. I have also included VPN Server routing table in the link.
    – Patrikas King
    Apr 12, 2021 at 15:51
  • I have come to the point where I can receive the ping from the VPN server on the Game Server PC, I also receive the ping from outside (by pinging the Public IP of the VPN Server). However, when I try to connect using the Game Client (that I launch on the Game Server PC) to the Public VPN IP, I cannot do so. I can only connect via 10.0.2.25.
    – Patrikas King
    Apr 12, 2021 at 17:41
  • Sounds like you need SNAT inbound on the OpenVPN SERVER. It's a complicated set-up you've chosen here. Is there any particular reason people can't just connect to your home(?) network and let your router's port forwarding do the heavy lifting for you?
    – roaima
    Apr 12, 2021 at 18:33
  • 1
    There is a reason only for the purpose of occasionally hosting a server for quite a lot of people. During that, I don't want to expose my real IP from the get-go as a preventive measure. I have managed to get it working, but it was only with DMZ, nothing else.
    – Patrikas King
    Apr 12, 2021 at 20:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .