Port forwarding into OpenVPN client LAN address

[Mikael Johansson]

I've now finally managed to setup a bidirectional site-to-site OpenVPN using two RT-AC66U routers running Merlin.

Some info
Router 1 (OpenVPN server)
Local range: 10.55.55.0/24
(tun: 10.8.8.1)

Router 2 (OpenVPN client)
Local range 10.22.22.0/24?
(tun: 10.8.8.2)

Connectivity is working fine now - The 10.55.55.x network can access the 10.22.22.x network and vice versa.

What I would like to do now
Unfortunately, router 2 is behind NAT, and I would like to forward a port on the external address of router 1 into the LAN of router 2 (e.g. <Router1Ext>:10022 -> 10.22.22.200:22)

However, adding such a port forwarding rule in the GUI on router 1 doesn't seem to work - No connection is established. I suspect this is due to the router NAT:ing only into the interface of its own local network instead of through the tunnel, even though the routing table works well from the 10.55.55 network into the 10.22.22 network otherwise. Is that true? Is it possible to fix through some iptables magic? How?

Thanks,
Mikael

 

[Mikael Johansson]

It took quite a bit of research and failed attempts to solve this, so I'm posting the solution here for reference:

iptables -t nat -A PREROUTING -p tcp --dport 10022 -j DNAT --to-dest 10.22.22.200:10022
iptables -t nat -A POSTROUTING -d 10.22.22.200 -p tcp --dport 10022 -j SNAT --to-source 10.8.8.1

The key here is the SNAT entry, which usually isn't required for port forwarding, but is required in this case for the return path to go through the VPN rather than through the normal gateway on the 10.22.22 network. So unfortunately this kind of forwarding can't be done through the normal GUI.

Credits go to this post:
https://unix.stackexchange.com/ques...lient?newreg=402a5635c65145a8bb731bf73f740488