remote in to a client behind a VPN

[gdallas]

Evening,

I have a local client 192.168.0.37 , Raspberry Pi, running Tranmsisson Torrent. I intend to sit it behind my VPN on the RT-AC86U. right now, I am able to remote in using a Transmission android remote app, with a NOIP DDNS pointing at the correct port. Will I still be able to remote in when I sit the client behind the VPN on the router?

 

[ColinTaylor]

With the standard interface options you have to decide whether the client's traffic is going through the VPN or the WAN. One or the other.

However, it is possible to use a script to selectively route specific ports.

https://github.com/RMerl/asuswrt-merlin/wiki/Policy-based-Port-routing-(manual-method)

 

[gdallas]

Thanks for your response. Can I just check I have understood it correctly?

1. I didn't have a nat-start file so I created one by first navigating to jffs/scripts/, then 'nano nat-start' to create the file.
2. I believe example 2 was what Im after, so I created as script as follows, noting that iv added iptable rules to the end of that script to for my local IP 192.168.0.37:9092. is that correct?
3. then chmod a+rx /jffs/scripts/nat-start to make the script executable.
   
   
4. anything else? have I understood this correctly?

#!/bin/sh

sleep 10  # During the boot process nat-start may run multiple times so this is required              

# Ensure duplicate rules are not created
for VPN_ID in 0 1 2 3 4 5
   do
      ip rule del prio 999$VPN_ID  2>/dev/null
   done

# Create the RPDB rules
ip rule add from 0/0 fwmark "0x8000/0x8000" table main   prio 9990        # WAN   fwmark
ip rule add from 0/0 fwmark "0x7000/0x7000" table ovpnc4 prio 9991        # VPN 4 fwmark
ip rule add from 0/0 fwmark "0x3000/0x3000" table ovpnc5 prio 9992        # VPN 5 fwmark
ip rule add from 0/0 fwmark "0x1000/0x1000" table ovpnc1 prio 9993        # VPN 1 fwmark
ip rule add from 0/0 fwmark "0x2000/0x2000" table ovpnc2 prio 9994        # VPN 2 fwmark
ip rule add from 0/0 fwmark "0x4000/0x4000" table ovpnc3 prio 9995        # VPN 3 fwmark

# iptables rule to Selectively route the desired Ports via the designated VPN Client
iptables -t mangle -A PREROUTING -i br0 -m iprange --src-range 192.168.0.37 -p tcp -m multiport --sport 9092 -j MARK --set-mark 0x8000/0x8000

 

[ColinTaylor]

My firmware works differently to yours so don't know for sure whether it will work. All I know is what I read on the wiki. But my understanding is that you've done everything correctly. The only thing that remains is for you to setup a port forwarding rule for 192.168.0.37:9092 in the router's GUI.

 

[gdallas]

My firmware works differently to yours so don't know for sure whether it will work. All I know is what I read on the wiki. But my understanding is that you've done everything correctly. The only thing that remains is for you to setup a port forwarding rule for 192.168.0.37:9092 in the router's GUI.

Thanks. I will give that a go and see what happens

 

[gdallas]

My firmware works differently to yours so don't know for sure whether it will work. All I know is what I read on the wiki. But my understanding is that you've done everything correctly. The only thing that remains is for you to setup a port forwarding rule for 192.168.0.37:9092 in the router's GUI.

Actually seems to be working! well I never! Again, can I just run my firewall config past you to ensure its right/safe!?

for my firewall rule, I made my external port the same as the WAN IP rule in that script, 9990. presume thats right? internal port is 9092 which is what I set my PI with.

Service Name External Port Internal Port Internal IP Address Protocol
Transmission 9990 9092 192.168.0.37 BOTH

 

[ColinTaylor]

That looks good. The only change I'd make is to set the Protocol to "TCP" instead of "BOTH" as the remote interface doesn't use UDP (AFAIK).

 

[gdallas]

That looks good. The only change I'd make is to set the Protocol to "TCP" instead of "BOTH" as the remote interface doesn't use UTP (AFAIK).

great, will do.

Thanks for you help with this.

 

[ColinTaylor]

Sorry, just to add...

for my firewall rule, I made my external port the same as the WAN IP rule in that script, 9990. presume thats right? internal port is 9092 which is what I set my PI with.

The "9990" is the packet priority, it is not a port number. For your purposes you can ignore that. You can set the external port to anything you like.

 

[gdallas]

ah ok cool. made them both 9092 and it still works. Thanks