forwarding Ports via VPN ??

forwarding Ports via VPN ??

[Cestonaro Thilo]

Hey,

i have a vpn established and working via a Linux (Debian) Box and a
Windows with openvpn. 
The tap devices have the following ips:
linux 192.168.200.201
windows 192.168.200.202

My intern network address at linux net is 
192.168.1.0/24
and under windows it's
192.168.0.0/24

now my question:
I want to forward the ports 2005 2006 7064 from the Linux net into the
Windows net ( enough when the packets appear at the vpn endpoint in
Windows net)
I get at the Linux VPN box the packets via eth0 
these packets are send to 255.255.255.255:2005 for example.
Now I want them to go into the tap0 dev and appear at the windows box.

I tried following rules for iptable at the linux box:

iptables -A INPUT -i tap0 -j ACCEPT
iptables -A OUTPUT -o tap0 -j ACCEPT

iptables -t nat -A PREROUTING -p udp -i eth0 --dport 2005 -j DNAT --to
192.168.200.202:2005
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 2005 -j DNAT --to
192.168.200.202:2005
iptables -t nat -A PREROUTING -p udp -i eth0 --dport 2006 -j DNAT --to
192.168.200.202:2006
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 2006 -j DNAT --to
192.168.200.202:2006
iptables -t nat -A PREROUTING -p udp -i eth0 --dport 7064 -j DNAT --to
192.168.200.202:7064
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 7064 -j DNAT --to
192.168.200.202:7064

iptables -A FORWARD -p udp -i eth0 --dport 2005 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 2005 -j ACCEPT
iptables -A FORWARD -p udp -i eth0 --dport 2006 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 2006 -j ACCEPT
iptables -A FORWARD -p udp -i eth0 --dport 7064 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 7064 -j ACCEPT


Could anyone say why this is not working?
I looked at the tap0 dev for outgoing packets with "iptraf -i tap0 -u".
But there are nor outgoing neither incoming packets :(

Ciao Thilo

Re: forwarding Ports via VPN ??

[Alexander Samad]

[-- Attachment #1: Type: text/plain, Size: 2306 bytes --]

On Tue, Mar 23, 2004 at 07:44:07PM +0100, Cestonaro Thilo wrote:
> Hey,
> 
> i have a vpn established and working via a Linux (Debian) Box and a
> Windows with openvpn. 
> The tap devices have the following ips:
> linux 192.168.200.201
> windows 192.168.200.202
> 
> My intern network address at linux net is 
> 192.168.1.0/24
> and under windows it's
> 192.168.0.0/24
> 
> now my question:
> I want to forward the ports 2005 2006 7064 from the Linux net into the
> Windows net ( enough when the packets appear at the vpn endpoint in
> Windows net)
> I get at the Linux VPN box the packets via eth0 
> these packets are send to 255.255.255.255:2005 for example.

I think you will find that broadcast packets can't be NAT in this
fashion, there are a few app's (daemon) out there that re route these in
the fashion that you want, but you need the deamon at both ends of the
tunnel.


> Now I want them to go into the tap0 dev and appear at the windows box.
> 
> I tried following rules for iptable at the linux box:
> 
> iptables -A INPUT -i tap0 -j ACCEPT
> iptables -A OUTPUT -o tap0 -j ACCEPT
> 
> iptables -t nat -A PREROUTING -p udp -i eth0 --dport 2005 -j DNAT --to
> 192.168.200.202:2005
> iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 2005 -j DNAT --to
> 192.168.200.202:2005
> iptables -t nat -A PREROUTING -p udp -i eth0 --dport 2006 -j DNAT --to
> 192.168.200.202:2006
> iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 2006 -j DNAT --to
> 192.168.200.202:2006
> iptables -t nat -A PREROUTING -p udp -i eth0 --dport 7064 -j DNAT --to
> 192.168.200.202:7064
> iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 7064 -j DNAT --to
> 192.168.200.202:7064
> 
> iptables -A FORWARD -p udp -i eth0 --dport 2005 -j ACCEPT
> iptables -A FORWARD -p tcp -i eth0 --dport 2005 -j ACCEPT
> iptables -A FORWARD -p udp -i eth0 --dport 2006 -j ACCEPT
> iptables -A FORWARD -p tcp -i eth0 --dport 2006 -j ACCEPT
> iptables -A FORWARD -p udp -i eth0 --dport 7064 -j ACCEPT
> iptables -A FORWARD -p tcp -i eth0 --dport 7064 -j ACCEPT
> 
> 
> Could anyone say why this is not working?
> I looked at the tap0 dev for outgoing packets with "iptraf -i tap0 -u".
> But there are nor outgoing neither incoming packets :(
> 
> Ciao Thilo
> 
> 
> 

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]