Port Forwarding Not Working With PPTP Client VPN

[andersson.j]

My setup:
I’m running Asuswrt-Merlin 376.49 on a RT-N66U.

Scenario 1, port forwarding with VPN disabled:
With the following port forwarding Wireshark and tcpdump shows incoming traffic being forwarded, and traffic being returned. Everything works perfectly.

Destination     Proto. Port range  Redirect to     Local port  Chain  
ALL             TCP    5900        192.168.1.100   5900        VSERVER

Scenario 2, port forwarding with VPN enabled:
When I enable my VPN > PPTP/L2TP Clients > PPTP VPN, all outgoing traffic on the network is routed through the VPN, as expected.

When I connect back home, not through the VPN but directly to the routers external IP, as in scenario 1, Wireshark and tcpdump confirms incoming traffic on port 5900. But here’s the problem: the traffic is no longer forwarded to 192.168.1.100:5900! Traffic originating from inside the LAN is forwarded correctly.

I’ve been experimenting with routing tables and firewall rules all day, but I’m in over my head!

 

[andersson.j]

Since the port forwarding works in Scenario 1: VPN off but fails in Scenario 2: VPN on, I guess some of the changes made when turning on the VPN takes precedence over the port forwarding.

My debugging efforts using tcpdump + Wireshark tells me that the traffic is still arriving, but is no longer forwarded. How can I debug what's wrong with the routing rules? Which rule is rejecting the incoming traffic instead of forwarding it? Why doesn't port forwarding take precedence over the VPN rules? Any help on how to debug my ip route and iptables would be much appreciated!

 

[mattiL]

Since the port forwarding works in Scenario 1: VPN off but fails in Scenario 2: VPN on, I guess some of the changes made when turning on the VPN takes precedence over the port forwarding.

My debugging efforts using tcpdump + Wireshark tells me that the traffic is still arriving, but is no longer forwarded. How can I debug what's wrong with the routing rules? Which rule is rejecting the incoming traffic instead of forwarding it? Why doesn't port forwarding take precedence over the VPN rules? Any help on how to debug my ip route and iptables would be much appreciated!

I haven't done any debugging myself, but there seems to be some possibly useful help to find on the net:

http://www.jbahillo.com/debugging-iptables/#sthash.0o5fsEVN.dpbs
http://backreference.org/2010/06/11/iptables-debugging/

 

[andersson.j]

Thank you mattiL. But after yet many hours I'm still not getting anywhere.

Most iptable debugging guides use the TRACE module which doesn't seem to be included with our firmware. Same with the NFLOG module.

Nobody else having troubles with port forwarding and VPN?