iptable rules VPN and PBR

Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking
View previous topic :: View next topic  
Author Message
alexsmith2709
DD-WRT Novice


Joined: 25 Nov 2011
Posts: 8
PostPosted: Fri Jan 20, 2023 20:13    Post subject: iptable rules VPN and PBR Reply with quote
Hi,
I had this all working perfectly for months and earlier today my router started rebooting itself and the only way out of it was to reset it. I have no idea why this started doing it, i wasnt changing any settings or even logged in to the router admin at the time.

I have a VPN which is set up and appears to be working properly. I followed the guide from the VPN provider. I set this up to use PBR as i only want my NAS behind the VPN.
This provider has the option for port forwarding and has a guide for doing so on DD-WRT.

They had some example iptables rules which i have tailored to my ports and my firewall rules are
Code:
iptables -t nat -I PREROUTING -i tun+ -p tcp --dport 57055 -j DNAT --to 192.168.1.2:57055
iptables -t nat -I PREROUTING -i tun+ -p tcp --dport 59539 -j DNAT --to 192.168.1.2:35357
iptables -t nat -I PREROUTING -i tun+ -p tcp --dport 62340 -j DNAT --to 192.168.1.2:32400
iptables -t nat -I PREROUTING -i tun+ -p udp --dport 57055 -j DNAT --to 192.168.1.2:57055

However, these ports dont appear to be open and i am using exactly the same rules as as i was before my router issue. My NAS has a static IP of 12.168.1.2 so i know that is not the issue.

Stupidly i didnt have a recent backup of DD-WRT so i couldnt just restore i had to set things up again.

Here is the output of iptables -t nat -vnL PREROUTING
Code:

Chain PREROUTING (policy ACCEPT 3233 packets, 861K bytes)
 pkts bytes target     prot opt in     out     source               destination                                                                             
    0     0 DNAT       tcp  --  *      *       192.168.1.2          0.0.0.0/0                                                                                         tcp dpt:53 to:10.14.0.1
   93  5945 DNAT       udp  --  *      *       192.168.1.2          0.0.0.0/0                                                                                         udp dpt:53 to:10.14.0.1
    0     0 DNAT       udp  --  tun+   *       0.0.0.0/0            0.0.0.0/0                                                                                         udp dpt:57055 to:192.168.1.2:57055
    0     0 DNAT       tcp  --  tun+   *       0.0.0.0/0            0.0.0.0/0                                                                                         tcp dpt:62340 to:192.168.1.2:32400
    0     0 DNAT       tcp  --  tun+   *       0.0.0.0/0            0.0.0.0/0                                                                                         tcp dpt:59539 to:192.168.1.2:35357
   14   776 DNAT       tcp  --  tun+   *       0.0.0.0/0            0.0.0.0/0                                                                                         tcp dpt:57055 to:192.168.1.2:57055
  573 38833 DNAT       udp  --  br0    *       0.0.0.0/0            0.0.0.0/0                                                                                         udp dpt:53 to:192.168.1.1
 1053 54756 DNAT       tcp  --  br0    *       0.0.0.0/0            0.0.0.0/0                                                                                         tcp dpt:53 to:192.168.1.1
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            my.wan.ip                                                                                      tcp dpt:2709 to:192.168.1.1:443
    1    52 DNAT       tcp  --  *      *       0.0.0.0/0            my.wan.ip                                                                                      tcp dpt:2202 to:192.168.1.1:2202
    0     0 DNAT       icmp --  *      *       0.0.0.0/0            my.wan.ip                                                                                      to:192.168.1.1
    0     0 DNAT       tcp  --  eth0   *       0.0.0.0/0            my.wan.ip                                                                                      tcp dpt:23524 to:192.168.1.89:4000
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            my.wan.ip                                                                                      tcp dpts:47303:47311 to:192.168.1.2
  977 82968 TRIGGER    all  --  *      *       0.0.0.0/0            my.wan.ip                                                                                     TRIGGER type:dnat match:0 relate:0

and here is the output from iptables -t nat -vnL PREROUTING
Code:

Chain PREROUTING (policy ACCEPT 3233 packets, 861K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  *      *       192.168.1.2          0.0.0.0/0                                                                                         tcp dpt:53 to:10.14.0.1
   93  5945 DNAT       udp  --  *      *       192.168.1.2          0.0.0.0/0                                                                                         udp dpt:53 to:10.14.0.1
    0     0 DNAT       udp  --  tun+   *       0.0.0.0/0            0.0.0.0/0                                                                                         udp dpt:57055 to:192.168.1.2:57055
    0     0 DNAT       tcp  --  tun+   *       0.0.0.0/0            0.0.0.0/0                                                                                         tcp dpt:62340 to:192.168.1.2:32400
    0     0 DNAT       tcp  --  tun+   *       0.0.0.0/0            0.0.0.0/0                                                                                         tcp dpt:59539 to:192.168.1.2:35357
   14   776 DNAT       tcp  --  tun+   *       0.0.0.0/0            0.0.0.0/0                                                                                         tcp dpt:57055 to:192.168.1.2:57055
  573 38833 DNAT       udp  --  br0    *       0.0.0.0/0            0.0.0.0/0                                                                                         udp dpt:53 to:192.168.1.1
Chain PREROUTING (policy ACCEPT 5413 packets, 1397K bytes)
 pkts bytes target     prot opt in     out     source               destination
 1053 54756 DNAT       tcp  --  br0    *       0.0.0.0/0            0.0.0.0/0                                                                                         tcp dpt:53 to:192.168.1.1
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            my.wan.ip                                                                                      tcp dpt:2709 to:192.168.1.1:443
    0     0 DNAT       tcp  --  *      *       192.168.1.2          0.0.0.0/0            tcp dpt:53 to:10.14.0.1    1
  52 DNAT       tcp  --  *      *       0.0.0.0/0            my.wan.ip                                                                                      tcp dpt:2202 to:192.168.1.1:2202
    0     0 DNAT       icmp --  *      *       0.0.0.0/0        176 11202 DNAT       udp  --  *      *       192.168.1.2          0.0.0.0/0            udp dpt:53 to:10.14.0.1      my.wan.ip                                                                                      to:192.168.1.1
    0     0 DNAT       tcp  --  et  128  9740 DNAT       udp  --  tun+   *       0.0.0.0/0            0.0.0.0/0            udp dpt:57055 to:192.168.1.2:57055h0   *
      0.0.0.0/0            my.wan.ip                                                                                     tcp dpt:23524 to:192.168.1.89:4000
    3   180 DNAT       tcp  --  tun+   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:62340 to:192.168.1.2:32400
    0     0 DNAT       tcp  --  tun+   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:59539 to:192.168.1.2:35357
  341 19724 DNAT       tcp  --  tun+   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:57055 to:192.168.1.2:57055
  674 45556 DNAT       udp  --  br0    *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 to:192.168.1.1
 1611 83772 DNAT       tcp  --  br0    *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 to:192.168.1.1
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            my.wan.ip         tcp dpt:2709 to:192.168.1.1:443
    1    52 DNAT       tcp  --  *      *       0.0.0.0/0            my.wan.ip         tcp dpt:2202 to:192.168.1.1:2202
    0     0 DNAT       tcp  --  *      *          2    68 DNAT       icmp --  *      *       0.0.0.0/0            my.wan.ip         to:192.168.1.1 0.0.0.0/
0            my.wan.ip                                                                                      tcp dpts:47303:47311 to:192.168.1.2
    0     0 DNAT       tcp  --  eth0   *       0.0.0.0/0            my.wan.ip         tcp dpt:23524 to:192.168.1.89:4000
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            my.wan.ip         tcp dpts:47303:47311 to:192.168.1.2
 1377  105K TRIGGER    all  --  *      *       0.0.0.0/0            my.wan.ip        TRIGGER type:dnat match:0 relate:0
  977 82968 TRIGGER    all  --  *      *       0.0.0.0/0            my.wan.ip                                                                                     TRIGGER type:dnat match:0 relate:0


I used nmap to test the lan ip and port 57055 is open as well as the 2 other local ports, so i'm fairly confident this is a firewall issue. No other firewall is on the NAS.

Both the NAS and router have been rebooted since setting up the VPN.

Does anyone have any ideas what could be wrong?
Back to top View user's profile Send private message
Sponsor
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12889
Location: Netherlands
PostPosted: Fri Jan 20, 2023 21:19    Post subject: Reply with quote
What router and what buildnumber are you using?

OpenVPN documentation see: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398

Portforwarding needs a DNAT rule but also a FORWARD ACCEPT rule.
_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Back to top View user's profile Send private message
alexsmith2709
DD-WRT Novice


Joined: 25 Nov 2011
Posts: 8
PostPosted: Fri Jan 20, 2023 21:28    Post subject: Reply with quote
Ah sorry, i forgot the useful information.
I am using a Linksys WRT1900ACS v2 build DD-WRT v3.0-r48646 std (04/12/22)

I'll have a read through of those posts in the morning, but im just confused why it was working fine and now not with the same rules
Back to top View user's profile Send private message
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12889
Location: Netherlands
PostPosted: Fri Jan 20, 2023 21:54    Post subject: Reply with quote
You need both a PREROUTING DNAT rule and a FORWARD ACCEPT rule (or disable the firewall which is not a good idea) e.g.:
Code:
iptables -t nat -I PREROUTING -i tun1 -p tcp --dport 12345 -j DNAT --to 192.168.1.89:8081
iptables -I FORWARD -i tun1 -p tcp -d 192.168.1.89 --dport 8081 -j ACCEPT

While you are at it I would upgrade and then reset to defaults *after* upgrading, put settings in manually and if everything works make screenshots, most browsers can print to PDF Smile
_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Back to top View user's profile Send private message
alexsmith2709
DD-WRT Novice


Joined: 25 Nov 2011
Posts: 8
PostPosted: Fri Jan 20, 2023 21:57    Post subject: Reply with quote
Thanks, i just went through the PDF for setting up OpenVPN clients and saw the section about my provider which was different to what they said so i have edited those settings as well as adding the FORWARD rule and now it appears to be working.

I'll backup the settings as well as saving the firewall rules and VPN settings separately and upgrade over the weekend.

Thanks for the help
Back to top View user's profile Send private message
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum