Exposing a port on the LAN behind a VPN Client

2

I have the following network layout:

enter image description here

With the VPN connection established, I want a user on the internet to be able to connect to port 555 on server 192.168.1.24, by using the IP address of the VPS server; i.e. 189.182.5.5:555.

What are the firewall/iptable rules I need in place on Ubuntu and DD-WRT to enable this? I have full control over both the DD-WRT router as well as the Ubuntu VPS, and the VPS provider allows me to open ports on their firewall.

Edit 1:
To clarify, 555 is an arbitrary port number. The reality is there are bout 7 ports (both TCP and UDP) that need to be reached, but I'm sure if I can be shown how to do one I'll figure the rest out. I'm also not against implementing a SOCKS proxy or SSH tunnel between DD-WRT and the VPS if that is an easier way of going about this.

Edit 2:
I've done some more testing. As a first step, I just want the VPS server to forward packets received on eth0 on port 555 to the VPN (tun0). Here's what I have:

I enabled tracing on the PREROUTING and OUTPUT raw tables for port 555 with these commands: 

iptables -t raw -A PREROUTING -p tcp -m tcp --dport 555 -j TRACE  
iptables -t raw -A OUTPUT -p tcp -m tcp --dport 555 -j TRACE

The raw table now looks like this:

-P PREROUTING ACCEPT
-P OUTPUT ACCEPT
-A PREROUTING -p tcp -m tcp --dport 555 -j TRACE
-A OUTPUT -p tcp -m tcp --dport 555 -j TRACE

The NAT table looks like this (I only added the last line, the rest I'm assuming is added by the OpenVPN server)

-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to-source 189.182.5.5
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o tun0 -j MASQUERADE

The default iptables look like this:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -j ACCEPT

Now I run a port-specific TCP traceroute in nmap with this command:

nmap -sT -sU -p T:[555] -n --traceroute 189.182.5.5

The following entries appear in the VPS log:

Sep 13 08:09:01 ubuntu-768mb kernel: [480631.284612] TRACE: raw:PREROUTING:policy:2 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=244 ID=32647 DF PROTO=TCP SPT=31881 DPT=555 SEQ=953464685 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 08:09:01 ubuntu-768mb kernel: [480631.284671] TRACE: nat:PREROUTING:policy:1 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=244 ID=32647 DF PROTO=TCP SPT=31881 DPT=555 SEQ=953464685 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 08:09:01 ubuntu-768mb kernel: [480631.284704] TRACE: filter:INPUT:policy:6 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=244 ID=32647 DF PROTO=TCP SPT=31881 DPT=555 SEQ=953464685 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 08:09:01 ubuntu-768mb kernel: [480631.284722] TRACE: nat:INPUT:policy:1 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=244 ID=32647 DF PROTO=TCP SPT=31881 DPT=555 SEQ=953464685 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 08:09:02 ubuntu-768mb kernel: [480631.956697] TRACE: raw:PREROUTING:policy:2 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=244 ID=32649 DF PROTO=TCP SPT=31881 DPT=555 SEQ=953464685 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 08:09:02 ubuntu-768mb kernel: [480631.956750] TRACE: nat:PREROUTING:policy:1 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=244 ID=32649 DF PROTO=TCP SPT=31881 DPT=555 SEQ=953464685 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 08:09:02 ubuntu-768mb kernel: [480631.956773] TRACE: filter:INPUT:policy:6 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=244 ID=32649 DF PROTO=TCP SPT=31881 DPT=555 SEQ=953464685 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 08:09:02 ubuntu-768mb kernel: [480631.956783] TRACE: nat:INPUT:policy:1 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=244 ID=32649 DF PROTO=TCP SPT=31881 DPT=555 SEQ=953464685 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 08:09:02 ubuntu-768mb kernel: [480632.150981] TRACE: raw:PREROUTING:policy:2 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=244 ID=32651 DF PROTO=TCP SPT=31882 DPT=555 SEQ=137592908 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 08:09:02 ubuntu-768mb kernel: [480632.151061] TRACE: nat:PREROUTING:policy:1 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=244 ID=32651 DF PROTO=TCP SPT=31882 DPT=555 SEQ=137592908 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 08:09:02 ubuntu-768mb kernel: [480632.151095] TRACE: filter:INPUT:policy:6 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=244 ID=32651 DF PROTO=TCP SPT=31882 DPT=555 SEQ=137592908 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 08:09:02 ubuntu-768mb kernel: [480632.151113] TRACE: nat:INPUT:policy:1 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=244 ID=32651 DF PROTO=TCP SPT=31882 DPT=555 SEQ=137592908 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 08:09:03 ubuntu-768mb kernel: [480632.824527] TRACE: raw:PREROUTING:policy:2 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=244 ID=32653 DF PROTO=TCP SPT=31882 DPT=555 SEQ=137592908 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 08:09:03 ubuntu-768mb kernel: [480632.824583] TRACE: nat:PREROUTING:policy:1 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=244 ID=32653 DF PROTO=TCP SPT=31882 DPT=555 SEQ=137592908 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 08:09:03 ubuntu-768mb kernel: [480632.824614] TRACE: filter:INPUT:policy:6 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=244 ID=32653 DF PROTO=TCP SPT=31882 DPT=555 SEQ=137592908 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 08:09:03 ubuntu-768mb kernel: [480632.824633] TRACE: nat:INPUT:policy:1 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=244 ID=32653 DF PROTO=TCP SPT=31882 DPT=555 SEQ=137592908 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)

Edit 3:
I've got the VPS to forward packets received on port 555 to the tun0 device, using the following command:

iptables -t nat -A PREROUTING -p tcp --dport 555 -j DNAT --to 10.8.0.2

This works because the VPN Server already creates a route for the 10.8.0/24 subnet targeting the tun0 interface:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         185.181.9.1     0.0.0.0         UG    0      0        0 eth0
10.8.0.0        *               255.255.255.0   U     0      0        0 tun0
185.181.9.0     *               255.255.255.0   U     0      0        0 eth0

Now in the log I can see the following entries:

Sep 13 11:55:03 ubuntu-768mb kernel: [ 6330.222757] TRACE: nat:PREROUTING:rule:2 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=189.182.5.5 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=4482 DF PROTO=TCP SPT=38891 DPT=555 SEQ=3082300013 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 11:55:03 ubuntu-768mb kernel: [ 6330.222778] TRACE: mangle:INPUT:policy:1 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=10.8.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=4482 DF PROTO=TCP SPT=38891 DPT=555 SEQ=3082300013 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 11:55:03 ubuntu-768mb kernel: [ 6330.222789] TRACE: filter:INPUT:policy:1 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=10.8.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=4482 DF PROTO=TCP SPT=38891 DPT=555 SEQ=3082300013 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 11:55:03 ubuntu-768mb kernel: [ 6330.222799] TRACE: nat:INPUT:policy:1 IN=eth0 OUT= MAC=00:16:3e:0a:d3:67:80:71:1f:ca:8c:01:08:00 SRC=129.232.161.114 DST=10.8.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=4482 DF PROTO=TCP SPT=38891 DPT=555 SEQ=3082300013 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)
Sep 13 11:52:28 ubuntu-768mb kernel: [ 6175.035548] TRACE: mangle:POSTROUTING:policy:1 IN= OUT=tun0 SRC=129.232.161.114 DST=10.8.0.2 LEN=52 TOS=0x00 PREC=0x00 TTL=116 ID=4265 DF PROTO=TCP SPT=38840 DPT=555 SEQ=3344052408 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405060103030801010402)

You'll see I'm currently using a DNAT rule to change the destination of the packet to 10.8.02, which is the IP address of tun0 on the client's side. I'm not sure if it should be 10.8.0.1, which is the tun0 address of the VPN Server?

staterium

Posted 2017-09-12T15:42:48.757

Reputation: 151

What service protocol is this 'port' 555 traffic? If it is http/https then it would be easier to run a proxy on your VPS that proxies the traffic to the internal address. – Zoredache – 2017-09-12T17:45:48.363

Zoredache, the 555 is for illustrative purposes only, to make the question easier to answer. In reality there is about 6 ports, both tcp and udp – staterium – 2017-09-12T18:04:38.567

Answers

1

I solved this as follows:

On the VPS server, I use the following command on the PREROUTING chain. It takes all the packets that arrive on port 555 of the eth0 interface (WAN), and changes its destination to the IP address of the VPN client on the DD-WRT router:

iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 555 -j DNAT --to-destination 10.8.0.2

Note that for this to work you need to configure the OpenVPN client on the DD-WRT router to always use the same IP Address when it connects, 10.8.0.2 in my case.

The result of this command is that the packet will now follow the FORWARD path when it reaches a routing decision, as the server can see by the new IP address that the packet is not meant for itself.

Note that this PREROUTING command only works because the VPN Server creates a route when it launches that tells the server where to find the 10.8.0.1/24 subnet (number in first column added by me for clarity):

Kernel IP routing table
Number    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
1         default         185.181.9.1     0.0.0.0         UG    0      0        0 eth0
2         10.8.0.0        *               255.255.255.0   U     0      0        0 tun0
3         185.181.9.0     *               255.255.255.0   U     0      0        0 eth0

Rule 2 tells the VPS server that the packet I've now marked for destination 10.8.0.2 needs to be routed through the tun0 interface.

Then on the DD-WRT router, I use the same type of rule to change the destination address of packets arriving on port 555 of tun0 to that of the internal server:

iptables -t nat -A PREROUTING -i tun0 -p tcp -m tcp --dport 555 -j DNAT --to-destination 192.168.1.24

Again, this only works because the VPN Client creates a route when it connects telling the router to find the 192.168.1.0/24 subnet on the br0 interface (LAN) (rule 5 below)

Kernel IP routing table
Number     Destination     Gateway         Genmask         Flags Metric Ref      Use Iface
1          default         10.230.0.1      0.0.0.0         UG    0      0        0   ppp0
2          10.230.0.1      *               255.255.255.255 UH    0      0        0   ppp0
3          127.0.0.0       *               255.0.0.0       U     0      0        0   lo
4          169.254.0.0     *               255.255.0.0     U     0      0        0   br0
5          192.168.1.0     *               255.255.255.0   U     0      0        0   br0

And that's it. Packets arriving on port 555 on the VPS' WAN interface will now be routed all the way to the server on my LAN.

I made use of the following resources while I figured this all out:

Debugging iptables with TRACE
Comprehensive tutorial on iptables and specifically this image in that tutorial:

Tables Traverse

staterium

Posted 2017-09-12T15:42:48.757

Reputation: 151

-1

Right click on "Network" then click properties, click change adapter settings, right click on your Local Area connection, make sure Obtain IP address automatically is selected and obtain DNS automatically. Restart your machine and try to reconnect.

androidrobo

Posted 2017-09-12T15:42:48.757

Reputation: 1

Asked: 2017-09-12T15:42:48.757

Viewed: 1 119 times

Active: 2018-04-29T03:47:42.940