I have a Raspberry Pi connected to the internet via wlan0 that is logged into my VPN server (tun0). And there is a piece of equipment connected to eth0 that I am trying to communicate with on port 42000.

On the other end, I have a PC logged into my VPN server. I can connect to the Pi over VPN using SSH or VLC just fine. But I need to be able to redirect any traffic coming into the Pi on port 42000 of tun0 to eth0, and any traffic from eth0 back out tun0.


The equipment connected to eth0:
My remote PC:

I tried:

iptables -t nat -A PREROUTING -p tcp -dport 42000 -i tun0 -j DNAT --to

That didn't work, so I added:

iptables -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT

From my PC I try loading in a browser, which I expected to be redirected by the Pi to the equipment, but I get no response.

Clearly, I'm not a networking expert. What am I missing??

The expectation is that:

  • The Pi will use wlan0 for all internet activity - which it does
  • tun0 is used for SSH and VNC (ports 22 & 5900) - which it does
  • eth0 is used to connect to the equipment - which is working
  • The Pi should allow the remote client (over tun0) to communicate with the equipment on eth0 via port 42000 - This is the problem


After a LOT of trial and error, I think I got it. The HTTP Request is coming in on the 10.8.0.x domain (tun0), and it gets nat'd to the (eth0). A tcpdump on that device shows the request from 10.8.0.x is getting there, but there is no return path because that device is not on the 10.8.0.x domain.

So it seemed I need another rule of some sort on the Pi to get the packets from 10.8.0.x to 192.168.10.x first, then forward them to the device plugged into eth0. For lack of any better ideas, I added a MASQUERADE and it works..!

Current iptables commands (I switched to port 80 for simplicity):

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination
iptables -t nat -A POSTROUTING -p tcp -d --dport 80 -j SNAT --to-source

Now I can see the packets hitting (the external device) from (eth0 on the Pi), so the response has a defined path to get back to the client..

Hope this helps someone some day...

  • "For lack of any better ideas, I added a MASQUERADE and it works..!" Exactly this. Been working for 3 days for a different yet similar topology, 30 minutes until giving up I added a MASQUERADE and voila! "Hope this helps someone some day..." - you can live in peace now :) – Ulquiomaru Apr 27 '18 at 18:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.