I'm using proxmox hypervisor to setup a ubuntu VPN VM (Mullvad VPN) that effectively acts as gateway for all other VMs. Here is my setup illustrated:

enter image description here

In VPN VM, I'm using these command to route the traffic between the vpn tunnel interface (wg-mullvad is the mullvad wireguard interface):

iptables -t nat -A POSTROUTING -o wg-mullvad -j MASQUERADE
iptables -A FORWARD -i eth1 -o wg-mullvad -j ACCEPT

At the moment everything seems to be working, running several of these iptables command to route my traffic so that I can SSH into the VM1 and VM2, as well as accessing the webserver on them across different subnet, originated from home network:

iptables -t nat -A PREROUTING -d -p tcp --dport 22221 -i eth0 -j DNAT --to-destination
iptables -t nat -A PREROUTING -d -p tcp --dport 22222 -i eth0 -j DNAT --to-destination
iptables -t nat -A PREROUTING -d -p tcp --dport 80 -i eth0 -j DNAT --to-destination

However, I got an issue where port forwarding in VM1 and VM2 is not working. I have opened a port in the mullvad vpn service iteself following this guide. I could verify that it's indeed working in VPN VM itself, but not on the subnet (VM1 & VM2).

I thought that port forwarding should happens automatically in vpn tunnel, without requiring any additional settings on the VPN VM itself, am I wrong? Any idea how to properly handle this? Thanks in advance.


Seems like running

iptables -t nat -A PREROUTING -p tcp --dport 58787 -j DNAT --to-destination

works. Given my "special" setup of VPN VM (single NIC, routing VPN traffic), I'm not sure is this is the correct way to do it. Since I'm not very good with networking, will this cause any traffic leak from the VPN (for example, the traffic directly goes from eth0 to eth1 without going through wg-mullvad)?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy