How to forward inbound (Internet) traffic hitting eth0 over OpenVPN tun0?

Hi there,

In order to route incoming traffic from your droplet’s public IP over the OpenVPN connection to your home server, you’ll need to setup IP forwarding and port forwarding on the Ubuntu droplet.

Here’s a broad step-by-step guide to configure the forwarding:

1. First, ensure that your system allows IP forwarding. You can check the status by running:

   sysctl net.ipv4.ip_forward
   

   If this returns a 0, you’ll need to enable it by editing the /etc/sysctl.conf file:

   sudo nano /etc/sysctl.conf
   

   Then, find the line that says #net.ipv4.ip_forward=1, uncomment it (remove the #), save, and close the file. Apply the changes with:

   sudo sysctl -p
   

2. Setup the iptables rules to forward the traffic from the public interface to the VPN interface. Here’s a generic format:

   sudo iptables -t nat -A PREROUTING -p tcp -i eth0 --dport <your_desired_port> -j DNAT --to-dest <VPN_internal_IP>:<destination_port>
   sudo iptables -A FORWARD -p tcp -d <VPN_internal_IP> --dport <destination_port> -j ACCEPT
   

   Replace <your_desired_port> with the port you want to forward (80 for HTTP, 21 for FTP, etc.), <VPN_internal_IP> with the internal IP address of the pfSense VPN client, and <destination_port> with the actual port of the service on the server side (usually the same as <your_desired_port> unless you have a specific port mapping).

   Here’s an example for forwarding HTTP traffic:

   sudo iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 80 -j DNAT --to-dest 10.8.0.2:80
   sudo iptables -A FORWARD -p tcp -d 10.8.0.2 --dport 80 -j ACCEPT
   

   Repeat this for every service you want to forward, changing the ports accordingly.

3. To keep the source IP information intact, you should avoid masquerading the packets on your droplet. Instead, on your home server (pfSense), set up a static route back to the source network (internet) over the OpenVPN tunnel.

4. Make the rules persistent across reboots. You can use iptables-persistent or manually write a script to reapply the rules at boot time. If you want to use iptables-persistent, install it with:

   sudo apt-get install iptables-persistent
   

   During installation, it will ask if you want to save the current iptables rules. If you’ve set up everything correctly, you should choose “Yes”. If you need to update the rules in the future, you can do so by running:

   sudo iptables-save > /etc/iptables/rules.v4
   

You need to ensure that your OpenVPN server configuration allows client-to-client communication if you have more than one client and they need to communicate with each other.

Best,

Bobby