Forwarding an incoming port from OpenVPN to a local LAN IP

[NetSetGo]

Hi!
I have a possibly trivial scenario, which, after searching and reading some vaguely related threads would probably be solvable with iptables and some jffs scripts, but I found nothing that would cover my scenario:

1. I have a VPN service provider, where I configure portforwarding of port 50001
2. On RT-AC5300 I successfully configured and enabled VPN Client 1 to connect to that VPN service provider. I have also enabled strict tunnelling policy and set up three local static IPs to explicitly use this VPN client and disconnect if the tunnel goes down.
3. I now want to set up portforwarding in such a way that port 50001 from the VPN connection (and not from WAN) is forwarded to one of those three LAN IPs.

Could someone help with this, please?

 

[eibgrad]

First, make sure you have jffs and custom scripts enabled in Administration->System. Reboot after making any changes. Then open a shell (ssh) to the router using Putty and copy/paste (right-click) the following script into the window. Use the vi editor to make your specific changes to the script (/jffs/scripts/nat-start) for the port forward. Finally, reboot.

SCRIPTS_DIR="/jffs/scripts"
SCRIPT="$SCRIPTS_DIR/nat-start"

mkdir -p $SCRIPTS_DIR

cat << "EOF" > $SCRIPT
#!/bin/sh

DEV="tun11"
PROTO="tcp"
EXT_PORT="50001"
INT_IP="192.168.1.100"
INT_PORT="22"

ipt() {
    # precede insert/append w/ deletion to avoid dupes
    while iptables ${@/-[IA]/-D} 2> /dev/null; do :; done
    iptables $@
}

# create internal port forward
ipt "-t nat -I PREROUTING -i $DEV -p $PROTO --dport $EXT_PORT \
    -j DNAT --to $INT_IP:$INT_PORT"
ipt "-I FORWARD -i $DEV -p $PROTO -d $INT_IP --dport $INT_PORT \
    -j ACCEPT"

exit 0
EOF

chmod +x $SCRIPT

 

[NetSetGo]

Thank you, and especially for the install-friendly way
I'll test it tonight. Will VPN Client1 interface always be on "tun11" or do I have to look it up and change?

 

[eibgrad]

Will VPN Client1 interface always be on "tun11" ?

Yes. All OpenVPN client network interface names are predictable (tun11, tun12, etc.) as you move from OpenVPN client #1, to OpenVPN client #2, etc.

 

[NetSetGo]

Thanks again! Writing to say that it works perfectly!