Re: iptables not forwarding port 443

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Hello,

J. Webster a écrit :
> I have an openvpn server running on port 1194 successfuly.
> The box is 1 server split into 2 IP addresses xx.xx.xx.198 and xx.xx.xx.199.
> A proxy server runs on the 198 server and the VPN on 199.
> I have been trying to set up a port forward from port 443 on the 199 server to 1194 so that users cn use the VPN when they are in hotels or behind work firewalls. Althought the packets are reaching the server, the VPN will not connect on port 443. 
> I have tried the OpenVPN mailing list and after extensive testing, they cannot see why the packets are not being received so something must be wrong with the routing.
> Any ideas on what the problem could be?
> I have included the iptables rules below.
> 
> # Generated by iptables-save v1.3.5 on Wed Jun 30 16:44:05 2010
> *filter
[...]
> -A INPUT -d xx.xxx.xxx.199 -p tcp -m tcp --dport 1194 -m state --state NEW -j ACCEPT
[...]
> *nat
[...]
> -A PREROUTING -d xx.xxx.xxx.199 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 1194

Just a thought : the iptables manpage says that REDIRECT changes the
destination address to the *primary* address of the incoming interface.
If the primary address is xx.xxx.xxx.198 while the openvpn server
listens on xx.xxx.xxx.199, I'm afraid it won't do what you expect. I'd
suggest to replace REDIRECT with DNAT and specify the new destination
address explicitly.

> -A PREROUTING -d xx.xxx.xxx.199 -p udp -m udp --dport 443 -j REDIRECT --to-ports 1194

(Why redirect UDP if you don't accept it ?)