I need to forward all traffic that goes to a specific port on a ClearOS IP to a the same port but on a client IP from PPTP VPN but I can't seem to be able to do this.
What I did was open the port (for example 444) on the "Incoming Firewall" (this worked, I tested it).
Then on "Port Forwarding" I set it to forward from and to the same port and in the IP I set the VPN client IP (192.168.200.100), but this doesn't seem to do anything.
If I telnet the 444 port on the client IP (192.168.200.100) from the ClearOS shell I get a response, if I telnet 444 from the ClearOS WAN IP the connection times out.
While searching online I saw some tutorials on how to do this manually:
sysctl -w net.ipv4.ip_forward=1 (this was already enabled)
iptables -t nat -A PREROUTING -d 123.123.123.123(WAN IP) -p tcp --dport 444 -j DNAT --to-dest 192.168.200.100:444
iptables -t nat -A POSTROUTING -d 192.168.200.100 -p tcp --dport 444 -j SNAT --to-source 192.168.200.1
But this didn't seem to do anything either.
What I did was open the port (for example 444) on the "Incoming Firewall" (this worked, I tested it).
Then on "Port Forwarding" I set it to forward from and to the same port and in the IP I set the VPN client IP (192.168.200.100), but this doesn't seem to do anything.
If I telnet the 444 port on the client IP (192.168.200.100) from the ClearOS shell I get a response, if I telnet 444 from the ClearOS WAN IP the connection times out.
While searching online I saw some tutorials on how to do this manually:
sysctl -w net.ipv4.ip_forward=1 (this was already enabled)
iptables -t nat -A PREROUTING -d 123.123.123.123(WAN IP) -p tcp --dport 444 -j DNAT --to-dest 192.168.200.100:444
iptables -t nat -A POSTROUTING -d 192.168.200.100 -p tcp --dport 444 -j SNAT --to-source 192.168.200.1
But this didn't seem to do anything either.
In VPN
Share this post:
Responses (5)
-
Accepted Answer
Where is the VPN between? If it is between your VPN client and the dicom server, then, as the VPN client is on your LAN you should not have to do anything to ClearOS to make it work. However the VPN will use completely different ports (typically 1194 for OpenVPN but you may need to change this if you also use ClearOS as an OpenVPN server). Once the VPN is established communication for your dicom data will be directly between the two devices and will be independent of your WAN IP. If you use OpenVPN then for communication to the dicom server for dicom data should come from the LAN IP which the OpenVPN server allocates to the VPN client.
For the moment I do not fully understand your setup so it is hard to make a definitive comment. It may help to have a diagram. Also you've only mentioned destination ports, not source ports. If your query and response uses ports 333 and 444 then you would not have VPN software listening on those ports at the same time, so I have a feeling there is a conceptual issue here. -
Accepted Answer
Maybe if I explain why I need this it'll be easier.
We use an dicom appliance that accepts inbound connections for queries and then makes outbound connections to send images. The way it works is we authorize an IP:PORT to do the queries and then the server makes an outbound connection to the same ip on a different port where a listen server is running. The problem is some of us have dynamic ips and we would like to work around it using a vpn. So to make it clear the way it works is
MY WAN IP -> DICOM SERVER IP:333 QUERY
DICOM SERVER IP -> MY WAN IP:444 RETRIEVE
So we authorized the VPN IP and we can do the queries but retrieving the images don't work. If I telnet the IP of the vpn client (192.168.200.100:444) from inside ClearOS i can get a response, so the issue I'm having is in tunneling the incoming connection from the DICOM Server on port 444 to my VPN local IP. -
Accepted Answer
I am wondering if we are at cross-purposes. Are you trying to use ClearOS as the VPN gateway so the remote machine connects to ClearOS but you are then accessing a machine behind ClearOS, or are you trying to VPN directly to a machine behind ClearOS? The answer I gave is for creating a VPN directly to the machine behind ClearOS.
If you are using ClearOS as the VPN gateway/server, so connecting to ClearOS, you should open ports and not port forward for both OpenVPN and PPTP VPN. For OpenVPN you can just open the incoming Standard Service OpenVPN. For PPTP VPN also use the Standard Service PPTP as this will open the port and protocol. In both cases you should not need to do anything more to allow traffic to go to your machine behind ClearOS. For the machine behind ClearOS you need to check that its firewall will allow incoming traffic from the OpenVPN or PPTP VPN subnet. -
Accepted Answer
-
Accepted Answer
Don't mix port opening and port forwarding. Port opening is for traffic destined for ClearOS. Port forwarding is for traffic from the WAN to somewhere behind ClearOS. Close your open port and try again. The open port is interfering with your testing. Also I believe PPTP needs GRE (protocol 47) but I can't remember how to handle this in the firewall. Note it is a protocol ond not a port.
Also note that PPTP is not a secure VPN these days and can be cracked relatively easily.
Please login to post a reply
You will need to be logged in to be able to post a reply. Login using the form on the right or register an account if you are new here.
Register Here »