Docker-openvpn: Port forwarding through VPN to a Client

[Pixxelfragger]

I have the following scenarios:

• a Dedicated Server with Static IP (Docker host) with running openVPN Docker. The Dockers eth0 IP is 172.24.0.2

• a client A which establishes an openVPN connection to the docker and gets assigned a static IP (192.168.254.1). This client has various services available under different ports.

• a Client B which should be able to access the services on client A

So far everything works as expected. Client B can use services running on client A without problems as long as the vpn tunnel is up and running on both clients. For now both clients will use the VPN as Default Gateway and all traffic will be routed through the VPN.

The Problem:

But now it gets a little trickier. I want to use the services of client A even without an active VPN running on client B. I know that you would normally use a port release on the main router as well as a DynDNS service. But this is unfortunately not possible in my case…

Possible Solution:

The Idea was to use the VPN with port forwarding on the Dedicated Server as an alternative way.
But my Problem is that I’m not sure what exact I must configure for this within the docker…

I’ve started with adding the port (as first example the port 5001/tcp) to my docker compose file.
After that, I’ve added this rules to the iptables:

iptables -t nat -A PREROUTING -d 172.24.0.2 -p tcp --dport 5001 -j DNAT --to-dest 192.168.254.1:5001
iptables -t nat -A POSTROUTING -d 192.168.254.1 -p tcp --dport 5001 -j SNAT --to-source 192.168.254.2

iptables -t nat -L now shows:

bash-4.4# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       tcp  --  anywhere             a883b93cbe0a         tcp dpt:5001 to:192.168.254.1:5001

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
DOCKER_OUTPUT  all  --  anywhere             127.0.0.11

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
DOCKER_POSTROUTING  all  --  anywhere             127.0.0.11
MASQUERADE  all  --  192.168.255.0/24     anywhere
MASQUERADE  all  --  192.168.254.0/24     anywhere
SNAT       tcp  --  anywhere             192.168.254.1        tcp dpt:5001 to:192.168.254.2

Chain DOCKER_OUTPUT (1 references)
target     prot opt source               destination
DNAT       tcp  --  anywhere             127.0.0.11           tcp dpt:domain to:127.0.0.11:35413
DNAT       udp  --  anywhere             127.0.0.11           udp dpt:domain to:127.0.0.11:33452

Chain DOCKER_POSTROUTING (1 references)
target     prot opt source               destination
SNAT       tcp  --  127.0.0.11           anywhere             tcp spt:35413 to::53
SNAT       udp  --  127.0.0.11           anywhere             udp spt:33452 to::53

Where a883b93cbe0a is the Docker Container ID. And 192.168.255.1 is the IP Address of the Dockers “tun0”

So far, this setting only leads to timeouts when calling the subdomain URL "vpn.domain.com:5001".
Is there a bug in the snat rule for the client's answers or do i miss something else here?

[LukasWerfel]

@Pixxelfragger did you find a way how to do it yet? I am wondering to.

Maybe you just have to set the iptables within docker and bind the ports to the host?

EDIT: In the end I switched to WireGuard, which makes these things very easy.

[timvan]

@Pixxelfragger - I am also interested in a solution to this. I want to forward a WebServer that is running locally on a Pi, that is the VPN Client, to a Cloud IP that is a VPN host.

Any luck on finding a solution?

[webian]

@Pixxelfragger, I'm interested to. I need to make my dev machine webserver reachable but my provider only gives me a non reachable private ip. I set up a vps with docker-openvpn and my dev machine can connect to it but I don't know how to forward ports 80/443. Any idea please?

[jerometerrier]

@Pixxelfragger, I'm interested to. I need to make my dev machine webserver reachable but my provider only gives me a non reachable private ip. I set up a vps with docker-openvpn and my dev machine can connect to it but I don't know how to forward ports 80/443. Any idea please?

Same needs, same problem :)

[Derkades]

I got it working, just in case it might help someone I've written a wiki page with the steps I took: https://github.com/kylemanna/docker-openvpn/wiki/Port-forwarding . It's not well written, but hopefully clear enough.

[NanoCode012]

Hi @Derkades , may I ask a question? What would I do if the webserver is not working inside the container?

In my case, I have an apache server on my local machine. It is connected to the VPS via this repo OpenVPN. I followed your step in setting the static client ip, but could not wget successfully.

# apache is on localhost:81
wget -O - 192.168.254.1:81

I'm just using apache server to test port forwarding on VPN first. Do you have any ideas on where I made a mistake?

[Derkades]

Make sure the webserver is listening on the correct interface (the VPN). How do you connect to the VPN on the client? I am using this: https://hub.docker.com/r/derkades/ovpn-client

[NanoCode012]

Hi @Derkades . Thank you for your reply. I finally got it working. I'm using Windows openvpn client on local.

Your guide was great! The issue lied within the static client ip. When I checked it out, even after following the other guide you mentioned, my client machine still has another ip 192.168.255.X. I already tried reconnecting the openvpn, but nothing changed. I will see if it changes later, but in the meantime, I'm using the ip above and the port forwarding works great!