0

I have Ubuntu 18.04.2 with l2tp vpn server, installed by a script. My client runs Windows 7 and connects to this server, internet works perfectly, connection is secured. I need to forward the rdp port from the external vpn server's ip. Local connection to this client works clear, but not from the outside. I use this:

iptables -t nat -A PREROUTING -i eth0 -d 5.253.x.x -p tcp --dport 55658 -j DNAT --to-destination 192.168.42.10:3389

port 55658 is opened on the router

result of iptables-save:


*filter
:INPUT ACCEPT [731:39193]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [126833:135018308]
-A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol none -j DROP
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m multiport --dports 500,4500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol ipsec -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -j DROP
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -i eth0 -o ppp+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ppp+ -o eth0 -j ACCEPT
-A FORWARD -s 192.168.42.0/24 -d 192.168.42.0/24 -i ppp+ -o ppp+ -j ACCEPT
-A FORWARD -d 192.168.43.0/24 -i eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.43.0/24 -o eth0 -j ACCEPT
-A FORWARD -j DROP
COMMIT

*nat
:PREROUTING ACCEPT [100:6028]
:INPUT ACCEPT [31:1477]
:OUTPUT ACCEPT [13:910]
:POSTROUTING ACCEPT [13:910]
-A PREROUTING -d 5.253.x.x/32 -i eth0 -p tcp -m tcp --dport 55658 -j DNAT --to-destination 192.168.42.10:3389
-A POSTROUTING -s 192.168.42.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.168.43.0/24 -o eth0 -m policy --dir out --pol none -j MASQUERADE
COMMIT

Help me please, I'm stuck

1

This might be nothing, but I've never seen *nat below *filter. What documentation or guides are you following?

Here is an example, using Minecraft, its port and additional port:

*nat
...
-A PREROUTING -i eth0 -p tcp -m multiport --dports 25565,8888 -j DNAT --to-destination 192.168.1.20
...
*filter
...
-A INPUT -i eth0 -p tcp -m multiport --dports 25565,8888 -m state --state NEW,ESTABLISHED -j ACCEPT
...
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
...
-A FORWARD -i eth0 -p tcp -m multiport --dports 25565,8888 -d 192.168.1.20 -j ACCEPT
...

First, we allow for the PREROUTING from this port, to the same port at the destination. You can use --to-destination 192.168.1.20:NNNN if you wish to adjust the port. Then, we have to create a filter to ensure we don't DROP or REJECT these packets. We limit this to NEW,ESTABLISHED, and have a rule to allow for all RELATED,ESTABLISHED traffic. This results in new and existing connections being allowed.

I do not see a local, or lo rule. Typically local traffic is -j ACCEPT early in the chain. You will likely run into issues if you do not handle lo properly. Be sure you're properly loading these new rules, and confirming the rules match your intent:

sudo iptables -L

Remember, you may want to iptables --flush before loading new tables to test. This will prevent issues with stale information messing up your changes, as well as ensure you understand how the tables will look fresh, such as when rebooting the system.

  • thank you for your answer, I've just removed FORWARD -j DROP and it worked out. So I need to put PREROUTING -d 5.253.x.x/32 -i eth0 -p tcp -m tcp --dport 55658 -j DNAT --to-destination 192.168.42.10:3389 above it, but I don't know where it stored. All these instructions were made by the script. Don't you know where that magic place could be? – Rosario Agro May 24 at 14:36
  • computingforgeeks.com/… I used this script – Rosario Agro May 24 at 14:42
  • I added this string to /etc/iptables.rules but it doesn't work – Rosario Agro May 24 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.