Iptables – Setting up iptables for port forwarding of incoming requests over a OpenVPN Client on a Router

iptablesopenvpnport-forwardingrouter

I have a Router that runs DD-WRT and a OpenVPN Client that connects and redirects every request over the VPN. My VPN provider supports port forwards, the problem is my router does not forward anything that comes in over the OpenVPN connection (tun1 im my case) (the rules set in the port forwarding Web-UI only apply to incomming WAN requests)

Basically what I want is to set port forwards for requests that come in from tun1 to specific local ips. (like forward everything from tun1 that comes on port 443 to ip 192.168.3.2). Could anybody give me a hint how such a rule can look?

Her is my ifconfig if that helps

br0       Link encap:Ethernet  HWaddr D8:XX:XX:XX:XX:XX  
          inet addr:192.168.3.1  Bcast:192.168.3.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:184989 errors:0 dropped:739 overruns:0 frame:0
          TX packets:299334 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:15114971 (14.4 MiB)  TX bytes:375616298 (358.2 MiB)
br0:0     Link encap:Ethernet  HWaddr D8:XX:XX:XX:XX:XX  
          inet addr:169.xxx.xxx.1  Bcast:169.xxx.xxx.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
eth0      Link encap:Ethernet  HWaddr D8:50:E6:A8:96:58  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:313063 errors:0 dropped:0 overruns:0 frame:0
          TX packets:189454 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:405150390 (386.3 MiB)  TX bytes:32540499 (31.0 MiB)
          Interrupt:4 Base address:0x2000 
eth1      Link encap:Ethernet  HWaddr D8:XX:XX:XX:XX:XX  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:8965 errors:0 dropped:0 overruns:0 frame:317140
          TX packets:15180 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1740984 (1.6 MiB)  TX bytes:10307605 (9.8 MiB)
          Interrupt:3 Base address:0x8000 
eth2      Link encap:Ethernet  HWaddr D8:XX:XX:XX:XX:XX  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:174192 errors:0 dropped:0 overruns:0 frame:4639
          TX packets:294914 errors:3 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:16061187 (15.3 MiB)  TX bytes:370101050 (352.9 MiB)
          Interrupt:5 Base address:0x8000 
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING MULTICAST  MTU:65536  Metric:1
          RX packets:18 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:5800 (5.6 KiB)  TX bytes:5800 (5.6 KiB)
tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.x.xxx.xx  P-t-P:10.x.xxx.xx  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:296786 errors:0 dropped:0 overruns:0 frame:0
          TX packets:175296 errors:0 dropped:551 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:368032646 (350.9 MiB)  TX bytes:13584147 (12.9 MiB)
vlan1     Link encap:Ethernet  HWaddr D8:XX:XX:XX:XX:XX  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:12400 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12456 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1939124 (1.8 MiB)  TX bytes:2585990 (2.4 MiB)
vlan2     Link encap:Ethernet  HWaddr D8:XX:XX:XX:XX:XX  
          inet addr:192.168.0.2  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:300663 errors:0 dropped:0 overruns:0 frame:0
          TX packets:176998 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:396323880 (377.9 MiB)  TX bytes:29196693 (27.8 MiB)

Best Answer

How to forward ports in DD-WRT & Tomato with iptables: https://airvpn.org/topic/9270-how-to-forward-ports-in-dd-wrt-tomato-with-iptables/

iptables -I FORWARD -i tun1 -p udp -d {destIP} --dport {port} -j ACCEPT
iptables -I FORWARD -i tun1 -p tcp -d {destIP}--dport {port} -j ACCEPT

iptables -t nat -I PREROUTING -i tun1 -p udp --dport {port} -j DNAT --to-destination {destIP}
iptables -t nat -I PREROUTING -i tun1 -p tcp --dport {port} -j DNAT --to-destination {destIP}

Web server behind DDWRT router: https://airvpn.org/topic/10269-web-server-behind-ddwrt-router/