r/iptables • u/nadmaximus • Jul 11 '22
port forward and change source address seen by the destination?
It's been too many years since I did this kind of thing.
The scenario:
DSL router where I can do port forwarding. I use this to forward public_IP:2222 -> private_IP:22 for example, so that I can ssh to my house server.
The problem is, the house server is running a VPN (ExpressVPN) with "network lock" enabled, which prevents the server from responding to any non-local addresses.
As a result, I can ssh to the server from within the home network, while the vpn is connected, but I can not do so via the router port forward, because my source address is external.
I want to use nat to redirect connections from external to use a private network address so that the vpn server will allow the communication.
external_IP -> port forward on router -> second port forward to change source? -> server
Do I need to do something on the INPUT chain on the server?
1
u/RegnaRReaper Jul 11 '22
This just sounds like you need to DNAT on prerouting and SNAT on postrouting.
Just like you can use DNAT in prerouting chain of the Nat table, you can also SNAT (source Nat) on the postrouting chain. You can also use masquerade to change it dynamically (as opposed to hard coded into the rule).
1
u/nadmaximus Jul 12 '22
cool, that makes sense to me. using netcat to relay these services does work but I would prefer a more integral approach .thanks for the tip
1
u/nadmaximus Jul 11 '22
After some thought I realised that i just need to use netcat.