Perhaps someone with a sharper brain than I can solve this little mystery.
I've Googled until I'm blue in the face, read all TFM's I can find, and
tried several iptables rule combinations but just can't get the following to
work. Here's my challenge:
I have a CentOS-5.3 "main" server with a static public IP address
running Apache, OpenVPN, and a bunch of other services.
The primary IP address for the only NIC in this box is used by
Apache on standard ports 80 and 443. I have a secondary
static public IP address assigned to this same NIC as eth0:1
I have a working OpenVPN tunnel going to another CentOS-5.3 server
which has Apache listening on its eth0 NIC for requests on non-standard
ports 29080 and 29443(don't ask!). This server is accessible on its
static public IP address and thru OpenVPN tunnel from the main server.
The main server is the OpenVPN server as well, with private IP address
172.16.xxx.1/32 auto-assigned to it. The second server is a VPN client
with IP address 172.16.xxx.yyy/32 assigned. The narrow netmasks are the
OpenVPN default, presumably used for isolation among multiple clients.
OpenVPN is configured to run over the main server's NIC via its eth0:1
secondary IP address 64.aaa.bbb.ccc The main server has a static
route set up between its eth0:1 IP and the remote server's public
IP address (not the tunnel IP). This route is only there so that during
initial VPN negotiations the data will move via eth0:1's IP address.
Things like ping, SSH, scp and HTTP/HTTPS all work correctly thru the
VPN in both directions, so the VPN itself is solid.
Ok, so now I want external HTTP/HTTPS requests made to the main
server's eth0:1 public IP address to be forwarded thru the VPN to the
second remote server, with port translation along the way.
Here is what I want to happen:
Outside world HTTP/HTTPS requests to eth0:1 ports 80/443
|
V
CentOS eth0:1 (64.aaa.bbb.ccc)
|
V
Translate to ports 29080/29443
|
V
Forward requests thru the tunnel to 172.16.xxx.yyy
|
V
Remote Apache responds, packets return thru VPN to "main"
|
V
Response goes back to the outside world via 64.aaa.bbb.ccc
HTTP/HTTPS requests to the 64.aaa.bbb.ccc public IP just hang and time out.
Direct requests to the remote server on the non-standard ports work fine.
I've tried lots of iptables example entries found on several forums but so
far none of them seem to work.
Does anyone have a cookbook-like complete set of iptables rules that will
accomplish what I need? Is it possible I need to set up strong-end routing
on the remote server to send the response packets back thru the VPN? (such a
pain to configure) Any assistance will be most gratefully received!
Best Regards, and my sincere kudos to the CentOS team and helpful list
members over the past few years.
Chuck