Can not forward port

Question

I have Ubuntu 18.04.2 with l2tp vpn server, installed by a script. My client runs Windows 7 and connects to this server, internet works perfectly, connection is secured. I need to forward the rdp port from the external vpn server's ip. Local connection to this client works clear, but not from the outside. I use this:

iptables -t nat -A PREROUTING -i eth0 -d 5.253.x.x -p tcp --dport 55658 -j DNAT --to-destination 192.168.42.10:3389

port 55658 is opened on the router

result of iptables-save:

*filter
:INPUT ACCEPT [731:39193]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [126833:135018308]
-A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol none -j DROP
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m multiport --dports 500,4500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol ipsec -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -j DROP
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -i eth0 -o ppp+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ppp+ -o eth0 -j ACCEPT
-A FORWARD -s 192.168.42.0/24 -d 192.168.42.0/24 -i ppp+ -o ppp+ -j ACCEPT
-A FORWARD -d 192.168.43.0/24 -i eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.43.0/24 -o eth0 -j ACCEPT
-A FORWARD -j DROP
COMMIT

*nat
:PREROUTING ACCEPT [100:6028]
:INPUT ACCEPT [31:1477]
:OUTPUT ACCEPT [13:910]
:POSTROUTING ACCEPT [13:910]
-A PREROUTING -d 5.253.x.x/32 -i eth0 -p tcp -m tcp --dport 55658 -j DNAT --to-destination 192.168.42.10:3389
-A POSTROUTING -s 192.168.42.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.168.43.0/24 -o eth0 -m policy --dir out --pol none -j MASQUERADE
COMMIT

Help me please, I'm stuck

Answer 1

This might be nothing, but I've never seen *nat below *filter. What documentation or guides are you following?

Here is an example, using Minecraft, its port and additional port:

*nat
...
-A PREROUTING -i eth0 -p tcp -m multiport --dports 25565,8888 -j DNAT --to-destination 192.168.1.20
...
*filter
...
-A INPUT -i eth0 -p tcp -m multiport --dports 25565,8888 -m state --state NEW,ESTABLISHED -j ACCEPT
...
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
...
-A FORWARD -i eth0 -p tcp -m multiport --dports 25565,8888 -d 192.168.1.20 -j ACCEPT
...

First, we allow for the PREROUTING from this port, to the same port at the destination. You can use --to-destination 192.168.1.20:NNNN if you wish to adjust the port. Then, we have to create a filter to ensure we don't DROP or REJECT these packets. We limit this to NEW,ESTABLISHED, and have a rule to allow for all RELATED,ESTABLISHED traffic. This results in new and existing connections being allowed.

I do not see a local, or lo rule. Typically local traffic is -j ACCEPT early in the chain. You will likely run into issues if you do not handle lo properly. Be sure you're properly loading these new rules, and confirming the rules match your intent:

sudo iptables -L

Remember, you may want to iptables --flush before loading new tables to test. This will prevent issues with stale information messing up your changes, as well as ensure you understand how the tables will look fresh, such as when rebooting the system.