Redirect traffic from VPS to internal server

c2ho · December 22, 2024, 1:15am

I self-host some stuff at home for friends as some sort of all-in-one solution regarding gaming, so game servers and TS3 for voice communications.
As all services are served from my residential connection I now tried to add a VPS in the connection chain to obfuscate services — and primarily protect myself from potential DDoS’ing.
The VPS is connected via WireGuard to my Router/Firewall/Security Appliance or whatever you want to call it. If you need a sketch please tell me.

So I tried to redirect traffic that is coming into my VPS to go to my local router using iptables rules but whenever one tries to connect (via FQDN) there is just an error. Checking the server logs shows that the traffic isn’t redirected so the TS3 client tries to connect to an instance on the VPS - which obviously does not exists as it should be a forwarding proxy to my internal servers.

I’ve created the following iptables rules setup on the VPS:

iptables -t nat -A PREROUTING -p udp --dport 9987 -j DNAT --to-destination 10.21.251.1:9987
iptables -t nat -A PREROUTING -p tcp --dport 10011 -j DNAT --to-destination 10.21.251.1:10011
iptables -t nat -A PREROUTING -p tcp --dport 30033 -j DNAT --to-destination 10.21.251.1:30033
iptables -A FORWARD -p udp --dport 9987 -d 10.20.30.1 -j ACCEPT
iptables -A FORWARD -p udp --dport 10011 -d 10.20.30.1 -j ACCEPT
iptables -A FORWARD -p udp --dport 30033 -d 10.20.30.1 -j ACCEPT

In the forwarding chain i also see that 12 packets and 1496 bytes were sent.
However the client logs only show the internet-facing IP from my VPS nothing about my internal network

|INFO    |ClientUI      |1  |Connect status: Connecting
|INFO    |PktHandler    |1  |server sent ciphers:1
|INFO    |PktHandler    |1  |Selected cipher:0
|DEVELOP |PktHandler    |1  |Puzzle solve time: 6
|INFO    |ClientUI      |1  |Connect status: Connected
|INFO    |ClientUI      |1  |Connect status: Establishing connection
|INFO    |ClientUI      |1  |Connect status: Connection established
|INFO    |              |   |requested new mytsid data
|INFO    |ClientUI      |1  |Connect status: Disconnected
|INFO    |ClientUI      |1  |Disconnected or forced to leave, want autoreconnect = 0
|INFO    |ClientUI      |1  |Connect to server: sub.domain.fqdn
|INFO    |ClientUI      |1  |Trying to resolve sub.domain.fqdn
|INFO    |TSDNS         |   |A/AAAA DNS resolve for possible TSDNS successful, "domain.fqdn" =(h: 203.0.113.5 p:0)
|INFO    |TSDNS         |   |A/AAAA DNS resolve for possible TSDNS successful, "sub.domain.fqdn" =(h: 203.0.113.70 p:0)
|INFO    |TSDNS         |   |A/AAAA DNS resolve successful, "sub.domain.fqdn" =(h: 203.0.113.70 p:0)
|INFO    |TSDNS         |   |SRV DNS resolve unsuccessful, "_ts3._udp.sub.domain.fqdn" Domain name not found
|INFO    |TSDNS         |   |SRV DNS resolve unsuccessful, "_tsdns._tcp.domain.fqdn" Domain name not found
|INFO    |TSDNS         |   |TSDNS queried unsuccessfully 203.0.113.5:41144
|INFO    |TSDNS         |   |No TSDNS found
|INFO    |TSDNS         |   |TSDNS queried unsuccessfully 203.0.113.70:41144
|INFO    |TSDNS         |   |No TSDNS found
|INFO    |ClientUI      |1  |Lookup finished: ip=203.0.113.70 port=9987 query=sub.domain.fqdn error=0
|INFO    |ClientUI      |1  |Resolve successful: 203.0.113.70:9987
|INFO    |ClientUI      |1  |Initiating connection: 203.0.113.70:9987
|INFO    |ClientUI      |1  |Connect status: Connecting
|INFO    |ClientUI      |1  |Connect status: Disconnected
|INFO    |ClientUI      |1  |Failed to connect to server, want autoreconnect = 0

I changed the log entries a little bit; removed the timestamps and anonymised domain and IPs.
domain.fqdn is my domain
sub.domain.fqdn is the subdomain I am using for the VPS
203.0.133.5 is the IP of my domain
203.0.133.70 is the IP of my VPS
10.20.30.1 is the IP of my local WireGuard peer

At my domain’s registrar I just added a single CNAME entry, no SRV or TSDNS stuff, just to clarify.

Any ideas why the traffic does not get redirected to my local stuff or what I should change to achieve my goal?

Gamer92000 · December 22, 2024, 10:43am

Without looking to closely at this, aren’t you missing the corresponding SNAT rules?

c2ho · December 22, 2024, 1:16pm

Why would I use SNAT? I want to alter the destination, not the source, so I use DNAT.
Or do you mean there is no route back from the local server to my router back to the VPS and then out the internet? IMO this should work without it because it depends on the initiation so there’s already a communication channel open.
Need more explanation on that, please.

Gamer92000 · December 22, 2024, 1:38pm

Yeah exactly, I am talking about the route back through the vps. I am running the exact same thing with those rules (for 9987):

iptables -t nat -A PREROUTING -i ens6 -p udp -m multiport --dport 9987 -j DNAT --to-destination 10.0.0.2
iptables -t nat -A POSTROUTING -o wg0 -p udp -m multiport --dport 9987 -d 10.0.0.2 -j SNAT --to-source 10.0.0.1
iptables -A FORWARD -i ens6 -o wg0 -p udp -m multiport --dport 9987 -j ACCEPT

c2ho · December 22, 2024, 1:52pm

Those rules are also applied on the VPS side?

fastboot · December 25, 2024, 8:24pm

При использование ВПН нужно прописывать таблицу маршрутизации - иначе пакеты будут уходить на сторону провайдера.

И есть такая ошикба, когда ты опдключаешся по SSH к серверу через ВПН и у тебя прописана маршрутизация ты подключишся к серверу и попробуешь сделать трассировку или пинг локальный устройств через ВПН - пакеты будут идти. Но, но если физически подойти к серверу и от туда сделать трассировку и пинг - ты увидешь что трафик будет игнорироваться и все запросы будут идти мимо ВПН к провайдеру… Вот такой у меня был опыт работы с ВПН…

Теперь ты знаешь что делать

fastboot · December 25, 2024, 8:26pm

другими словами сделай трассировку пакетов!

Windows: PC > Server

tracert server

Linux: Server > PC

traceroute pc

c2ho · December 28, 2024, 12:58am

@Gamer92000 Was that your whole set of rules?
Which of the IP’s is you VPS and which one’s the router on your home network?
I get the idea but can’t wrap my head around what I actually need to change here

Like I already said I can reach my home router and my local TS3 server from the VPS so that cyrillic stuff doesn’t even contribute to finding a solution.

Also, when connecting through the TS3 client the traffic is recognized on the VPS side but there’s no traversind/redirection/whateveryouwannacallit to my home router/fw

Edit: Love you @Gamer92000!!
Instead of waiting for another reply (I know, its the christmas holidays but I’m impatient ) I firstly deleted all existing rules and then added your ruleset but with my IP addresses - and it worked! You are such a saint!
Although I need to figure out which entry does what, but that’s obviously on me now.

Edit2: I am stupid, I connected to the local hostname instead of the remote one because I was using the bookmarks. So this isn’t resolved unfortunately.

Gamer92000 · December 28, 2024, 3:18pm

Hey, sorry for letting you hanging like that :P

                  -------------------------------
                  | NAT Network                 |
                  |                             |
VPS               |   Local Server              |
WG IP: 10.0.0.1 <---> WG IP: 10.0.0.2           |
                  |   TS listen: 0.0.0.0:9987   |
                  |                             |
                  -------------------------------

VPS wg0.conf:

[Interface]
PrivateKey = <vps priv key>
ListenPort = 995
Address = 10.0.0.1/24
Table = off

[Peer]
PublicKey = <server pub key>
AllowedIPs = 0.0.0.0/0

Local Server wg0.conf:

[Interface]
PrivateKey = <server priv key>
Address = 10.0.0.2/24
Table = off

[Peer]
PublicKey = <vps pub key>
AllowedIPs = 0.0.0.0/0
Endpoint = <vps ip>:995
PersistentKeepalive = 25

(I am running wireguard over port 995 to prevent port blocking on known vpn ports. Any port should work though.)

This should allow you to ping the servers over the wg network.

Then on the VPS I got the following bash script to setup the iptables rules:

#!/bin/bash

echo "###################"
echo "Clear IPTables"
echo "###################"
iptables -t nat -F
iptables -F

echo "###################"
echo "Create IPTables INPUT rules"
echo "###################"
iptables -A INPUT -i ens6 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i ens6 -p udp --dport 995 -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -P INPUT DROP

echo "###################"
echo "Create IPTables NAT rules"
echo "###################"
iptables -t nat -A PREROUTING -i ens6 -p udp -m multiport --dport 9987 -j DNAT --to-destination 10.0.0.2
iptables -t nat -A POSTROUTING -o wg0 -p udp -m multiport --dport 9987 -d 10.0.0.2 -j SNAT --to-source 10.0.0.1

echo "###################"
echo "Create IPTables FORWARD rules"
echo "###################"
iptables -P FORWARD DROP
iptables -A FORWARD -i ens6 -o wg0 -p udp -m multiport --dport 9987 -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

fastboot · December 28, 2024, 4:26pm

потому-что я говорил про таблицу маршрутизацию про которую вы забыли и забили на это!

ещё раз покажите нам трассировку вашей сети!

c2ho · December 29, 2024, 7:28pm

Dude, you are such a savior!
As I am managing some firewall related stuff through my VPS provider I actually just need three rules and don’t need the extra stuff you are doing as they’re already firewalling basic stuff.

iptables -A FORWARD -p udp -d 10.20.30.1 --dport 9987 -j ACCEPT
iptables -t nat -A PREROUTING -p udp --dport 9987 -j DNAT --to-destination 10.20.30.1:9987
iptables -t nat -A POSTROUTING -o wg0 -p udp --dport 9987 -d 10.20.30.2 -j SNAT --to-source 10.21.251.1

But your last message made me think and test some more. The above iptables rules are enough like I said and I was able to connect to the server with correct routing!
What I haven’t thought of was that WireGuard automatically drops the connection if no data is being send for a while - in your last reply I noticed the PersistentKeepalive which I never needed until now
I am usually fine with VPN connections dropping when they aren’t needed but in this case I actually need it to not drop.

So after your previous reply I had all the correct stuff in place but since the WireGuard connection dropped when I was trying to figure stuff out the other night I just didn’t notice it

Thank you so much for also providing your wg.conf so I could figure out why I’m such a dumbass