Router – Server over VPN

Well, I'm not sure why you're discounting OpenVPN as a viable option. It is not only one of the most simple VPN servers to set up, but it is also one of the most secure. If you are not able to grok OpenVPN setup, then perhaps you ought to consider hiring someone to help you out and give you some training along the way.

If these remote employees only need access to a couple of applications, then perhaps you could consider getting them set up with SSH tunnels. That would be very simple, but probably not as flexible as you'd like.

The moral of the story here is that VPN systems have quite a bit of complexity, regardless of which system you choose. Short of outsourcing VPN to something like Hamachi, you're going to have to do a bit of setup.

iptables -t nat -A PREROUTING -p tcp -i eth1 -d 10.10.1.0/24 \
  --dport 12345 -j DNAT --to-destination 123.123.123.123:12345

Locally generated traffic will never pass through the PREROUTING chain. You can verify this by adding a rule like this:

iptables -t nat -A PREROUTING -j log -m limit --limit 1/s

If you're not familiar with iptables, the above rule means:

• Log (at a maximum rate of 1 message/second) any packets traversing the PREROUTING chain.

Watch your log files while you make outbound connections, and you'll see that nothing is passing through this chain. The PREROUTING chain only comes into play for traffic coming into your system from an outside source.

You might think you could do this in the OUTPUT chain:

iptables -t nat -A OUTPUT ... -j DNAT ...

But by the time a packet hits the OUTPUT chain the routing decision has already been made. You can probably get you want by using a REDIRECT rule in the OUTPUT chain and then running a tcp proxy on a local port that redirects connections to your destination. That is, you can add a rule like this:

iptables -t nat -A OUTPUT -p tcp -d 10.10.1.0/24 --dport 12345 \
  -j REDIRECT --to-ports 12345

And then run a tcp proxy locally on port 12345.