I have a Raspberry Pi connected to the internet via wlan0 that is logged into my VPN server (tun0). And there is a piece of equipment connected to eth0 that I am trying to communicate with on port 42000.
On the other end, I have a PC logged into my VPN server. I can connect to the Pi over VPN using SSH or VLC just fine. But I need to be able to redirect any traffic coming into the Pi on port 42000 of tun0 to eth0, and any traffic from eth0 back out tun0.
The equipment connected to eth0: 192.168.10.3
My remote PC: 10.8.0.30
iptables -t nat -A PREROUTING -p tcp -dport 42000 -i tun0 -j DNAT --to 192.168.10.3:42000
That didn't work, so I added:
iptables -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
From my PC I try loading 10.8.0.10:42000 in a browser, which I expected to be redirected by the Pi to the equipment, but I get no response.
Clearly, I'm not a networking expert. What am I missing??
The expectation is that:
- The Pi will use wlan0 for all internet activity - which it does
- tun0 is used for SSH and VNC (ports 22 & 5900) - which it does
- eth0 is used to connect to the equipment - which is working
- The Pi should allow the remote client (over tun0) to communicate with the equipment on eth0 via port 42000 - This is the problem
After a LOT of trial and error, I think I got it. The HTTP Request is coming in on the 10.8.0.x domain (tun0), and it gets nat'd to the 192.168.10.1 (eth0). A tcpdump on that device shows the request from 10.8.0.x is getting there, but there is no return path because that device is not on the 10.8.0.x domain.
So it seemed I need another rule of some sort on the Pi to get the packets from 10.8.0.x to 192.168.10.x first, then forward them to the device plugged into eth0. For lack of any better ideas, I added a MASQUERADE and it works..!
Current iptables commands (I switched to port 80 for simplicity):
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.10.3:80 iptables -t nat -A POSTROUTING -p tcp -d 192.168.10.3 --dport 80 -j SNAT --to-source 10.8.0.10
Now I can see the packets hitting 192.168.10.3 (the external device) from 192.168.10.2 (eth0 on the Pi), so the response has a defined path to get back to the client..
Hope this helps someone some day...