Cannot port forward to a machine behind the VPN

[madfusker]

I have a NAS server running subsonic and have been excluding it from the VPN, mostly just for crashplan backup speed. But now with my 86U I should be able to put it behind the VPN as well. My router that is not inside the VPN does a port forward to the service port of the NAS, and life is good until I put the NAS inside the VPN. How can I still port forward if it goes inside the VPN?

VPN Policy Rules (strict):
All LAN 192.168.1.0/24 0.0.0.0 VPN
router 192.168.1.1 0.0.0.0 WAN
NAS 192.168.1.10 0.0.0.0 WAN

Port forward on the WAN:
Subsonic 4041 192.168.1.10 4041 TCP

 

[ColinTaylor]

How can I still port forward if it goes inside the VPN?

You can't, it's a contradiction. Port forwarding forwards traffic arriving on the router's WAN IP address to an internal server. The server replies through the same route. If your NAS traffic is being redirected through a VPN service then the incoming traffic would have to come in through this route also.

The only way I can see where it might work would be if you could somehow create a VPN rule that excluded traffic to and from port 4041 on the NAS. AFAIK that's not an option.

 

[madfusker]

Ah, I see. It looks like the NAS will have to stay outside the VPN then. I don't really trust port forwarding on the VPN service, but believe it's possible.

 

[Martineau]

Ah, I see. It looks like the NAS will have to stay outside the VPN then. I don't really trust port forwarding on the VPN service, but believe it's possible.

If the NAS is routed via the VPN, can you try:

ip rule del fwmark 0x7000/0x7000 2> /dev/null
ip rule add fwmark 0x7000/0x7000 table 100 prio 9990
ip route flush cache

NAS_Server='192.168.1.10'

# Remember port 4041 must also already be port forwarded using the normal GUI rules!
iptables -t mangle -D PREROUTING -i br0 --src $NAS_Server -p tcp -m multiport --sport 4041 -j MARK --set-mark 0x7000/0x7000 2> /dev/null
iptables -t mangle -A PREROUTING -i br0 --src $NAS_Server -p tcp -m multiport --sport 4041 -j MARK --set-mark 0x7000/0x7000