Forward Port from OpenWrt IP (LAN) to internal IP Adress

[mat1]

Hello,

I've this setup:

• OpenWRT Firewall
  • IP Adress: 192.168.50.70 / Gateway 192.168.50.1 / Subnet 255.255.255.0
  • WAN Interface not used & not configured
  • Installed behind a Third-Party-Firewall what resides behind Internet (192.168.1.0/24)
  • The OpenWRT is used mainly as a VPN-Server within an existing network
  • A wireguard VPN-Server/ Client configuration makes the network 192.168.178.0/24 accessible trough the VPN Tunnel
  • From the OpenWRT I can ping 192.168.178.2 and curl http://192.168.178.2

Because of some firewall limitations of the external network, I want to add a port forwarding rule that when I access my Firewall-IP on Port 192.168.50.70:88 I get forwarded to the 192.168.178.2:80 TCP port.

I already tried this with a firewall-rule:

config redirect
	option target 'DNAT'
	option name 'test'
	option src 'lan'
	option dest 'lan'
	option proto 'tcp'
	option src_dip '192.168.50.70'
	option src_dport '88'
	option dest_ip '192.168.178.2'
	option dest_port '80'
	option enabled '1'

Is this possible? Did I miss something?

The Wireguard-Tunnel is maybe something complex, but I also did not managed it with a internal forwarding rule to my own LAN.

From 192.168.50.70:88 to 192.168.50.100:80

config redirect
	option target 'DNAT'
	option name 'test'
	option src 'lan'
	option dest 'lan'
	option proto 'tcp'
	option src_dip '192.168.50.70'
	option src_dport '88'
	option dest_ip '192.168.50.100'
	option dest_port '80'
	option enabled '1'

What did I wrong?

[psherman]

This is not possible it do because the traffic on the same LAN is switched, not routed. As a result, it never hits the firewall on the router.

[mat1]

That's correct - but what I'd like to do is to access the IP from the Firewall (OPENWRT Interface) - so a port-forwarding must be possible?

192.168.50.70 is the IP of the OpenWRT Firewall and I would access to the forwarding rule by opening this url:

-> http://192.168.50.70:88

[eduperez]

I just do not get how many devices / networks / interfaces you have, and how do they relate.

You seem to have a firewall with just one interface?
You want to redirect to an IP address not connected directly to the device?

[mk24]

You don't have a firewall you have a VPN server (or client, Wireguard is symmetric). In other words it is a gateway to the VPN network.

If someone on the .50 network wants to access the .178 network there are two ways it can happen. If their OS has an entry for 192.168.178.0/24 via 192.168.50.70 in its routing table, the packet will go directly to your VPN server and down the VPN. This entry can be made manually or with a DHCP option.

The other way is to leave the PCs alone and install a route to .178 on the .50.1 main router. A PC user going to 192.168.178.2 will, like everything else outside .50, use the default route of 192.168.50.1. This will then be re-forwarded by that router to your VPN server.

Either way it is all conventional routing, not NAT.

[psherman]

What does the overall physical topology look like for your network and what are you access goals over the VPN?

[mat1]

I know that this can be done with traditional routing, this is already working.
But the question is if I am able to set - up a port-forwarding what is doing this with DNAT

The problem is related to a firewall-rule (and probably also a company policy from the other Organization managing the another Firewall) for devices what only can access the 192.168.50.0/24 - net.

I know the simple solution would be the static route, but the question is if we can set up a port-forwarding with DNAT on the lan side -> http://192.168.50.70:88

[psherman]

@mat1 - I asked a question about your goals -- if we better understand what you are trying to do (in a broader sense), we can likely help you with a working solution.

FWIW, I have an OpenWrt router running WG behind my main router. I have access to my entire LAN including the both routers.

[mat1]

I think I was on the wrong way, I found the thing I want:

iptables -t nat -A PREROUTING -p tcp -i br0 --dport 201 -j DNAT --to-destination 192.168.1.101:22
iptables -A FORWARD -p tcp -d 192.168.1.101 --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -d 192.168.1.101 -p tcp --dport 22 -j SNAT --to-source 178.126.193.153

But routing the Subnet's and also routing them correctly from the main Firewall is the most cleanest solution.

Thank you for your help!

[mat1]

I've still one issue:

This are the correct rules:

iptables -t nat -A PREROUTING -p udp --dport 1628 -j DNAT --to-destination 172.31.1.10:1628
iptables -t nat -A POSTROUTING -j MASQUERADE

enabling them via SSH works without problems, but when Adding them in Luci under Custom Rules they're not applying.

Why?

[vgaetera]

Create a DNAT + SNAT rule, or enable zone masquerading:
https://openwrt.org/docs/guide-user/firewall/firewall_configuration#redirects

Custom rules are tricky, so it's best to avoid when possible.

[mat1]

When I've the Firewall at 192.168.50.70 and want to forward TCP 192.168.50.70:8888 to 192.168.50.71:80 how does the rules should look like?

I tried:

config redirect
	option name 'DNAT'
	option src 'lan'
	option src_dport '8888'
	option dest 'lan'
	option dest_ip '192.168.50.71'
	option dest_port '80'
	option proto 'tcp'
	option target 'DNAT'

config redirect
	option enabled '1'
	option target 'SNAT'
	option src_dip '192.168.50.70'
	option src_dport '8888'
	option name 'SNAT'
	option proto 'tcp'
	option dest_ip '192.168.50.71'
	option dest_port '80'

[vgaetera]

Remove the SNAT rule options:

@mat1

	option src_dport '8888'
	option dest_ip '192.168.50.71'
	option dest_port '80'

Instead specify the proper src and dest zones.

Then perform testing and collect the output:

iptables-save -c -t nat | grep -e [DS]NAT

[mat1]

root@VPNGW:/etc/config# iptables-save -c -t nat | grep -e DNAT
[0:0] -A zone_lan_prerouting -p tcp -m tcp --dport 8888 -m comment --comment "!fw3: DNAT" -j DNAT --to-destination 192.168.50.71:80

This is not working, I'm unable to access the port :8888.

If i manually change the rule via SSH it works:

-A PREROUTING -p tcp -m tcp --dport 8888 -m comment --comment "!fw3: DNAT" -j DNAT --to-destination 192.168.50.71:80

[vgaetera]

Post the output:

iptables-save -c -t nat

[mat1]

root@FW-VPNGW:~# iptables-save -c -t nat
# Generated by iptables-save v1.8.3 on Sat Jan 16 11:17:26 2021
*nat
:PREROUTING ACCEPT [7:975]
:INPUT ACCEPT [2:106]
:OUTPUT ACCEPT [2:752]
:POSTROUTING ACCEPT [4:892]
:GL_S2S_POSTROUTING - [0:0]
:GL_SPEC_DMZ - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:postrouting_wireguard_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:prerouting_wireguard_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
:zone_wireguard_postrouting - [0:0]
:zone_wireguard_prerouting - [0:0]
[7:975] -A PREROUTING -j GL_SPEC_DMZ
[7:975] -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
[3:729] -A PREROUTING -i wg0 -m comment --comment "!fw3" -j zone_wireguard_prerouting
[7:1621] -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
[0:0] -A POSTROUTING -o wg0 -m comment --comment "!fw3" -j zone_wireguard_postrouting
[3:729] -A POSTROUTING -o wg1 -j GL_S2S_POSTROUTING
[3:729] -A GL_S2S_POSTROUTING -j MASQUERADE
[0:0] -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
[0:0] -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
[0:0] -A zone_lan_prerouting -p tcp -m tcp --dport 8888 -m comment --comment "!fw3: DNAT" -j DNAT --to-destination 192.168.50.71:80
[0:0] -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
[0:0] -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
[0:0] -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
[0:0] -A zone_wireguard_postrouting -m comment --comment "!fw3: Custom wireguard postrouting rule chain" -j postrouting_wireguard_rule
[3:729] -A zone_wireguard_prerouting -m comment --comment "!fw3: Custom wireguard prerouting rule chain" -j prerouting_wireguard_rule
COMMIT
# Completed on Sat Jan 16 11:17:26 2021
root@FW-VPNGW:~# 

[vgaetera]

Assign LAN and VPN interfaces to the appropriate firewall zone.

[mat1]

When reviewing Firewall Zones I think I've some misconfiguration within the firewall zones....

Does any zone needs do have an interface? If yes, then this zone is useless - correct?

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option network ' '
	option forward 'REJECT'

I also see one zone what has a device assigned to - but the device is not shown within Luci.

config zone 'wireguard'
	option name 'wireguard'
	option output 'ACCEPT'
	option device 'wg0'
	option masq6 '1'
	option input 'ACCEPT'
	option network 'wireguard'
	option forward 'REJECT'

Would it be better to create a interface with the name "wireguard" and assign the wg0-device to that interface and then assign the interface to the zone?

Are interfaces just virtual interfaces (like firewall zones) to better manage interface in groups or are these interfaces created also on the device?

Example

• If I create a wireguard vpn, the physical interface wg0 is created
• The Interface wg0 is missing in the LUCI Gui under interfaces
• In this case I can easily create a Interface within luci, assign the wg0 and Select Wireguard VPN as protocol type or do I break something if I do this?

Sorry for the "noob" questions - but my experience with OpenWrt is not so much (until now).

Thank you