Port forwarding when VPN port is not static

[Androkiller]

I am wondering how people are implementing Port forwards which are not static from the VPN provider to their clients that need them. I understand the use that you can do a query to the HTTP control server to find out the port which is in use (but very lost how i am going to get a client to update its port)
However would it not be easier to have the possibility for a NAT rule built in to translate the port provided by the VPN provider to a predefined port in use by the client.
ex. VPN WAN IP:Port that VPN provider gives out -> SomeLAN IP:6881 (Should be defined by a env i.e FIREWALL_VPN_INPUT_PORT_NAT)

[qdm12]

That's a good idea. If I recall correctly, I quickly tried but it didn't work out for some reason. Although please have a try at it, it might had been me being lazy (aka 'not a priority') as well.

If you find an iptables rule (or ip route / ip rule) that works to redirect a port, I can definitely implement it to be automated in Gluetun! 👍

EDIT: you can docker exec -it gluetun /bin/sh and play around with commands on a running instance (exit it by typing exit + enter).

[Androkiller]

looking at the iptables rules running currently i see no NAT rules, as i recall iptables needs net.ipv4.ip_forward enabled from kernel via sysctl.conf or in sysctl.d but see nothing. With docker i not sure if a each container shares the kernel from the host but atm i haven't been able to get any NAT rules working with it enabled on the host.

[qdm12]

all containers share the same kernel. But they don't share the same iptables rules, so you need to exec in gluetun and set iptables rules inside the container, not on the host.

[andry81]

but very lost how i am going to get a client to update its port

Port Forwarding does not mean a client must setup the same port. It only means that all packets through the port would be forwarded to an IP with might be a different port or might be the same. It depends on the Port Forwarding software.

[Androkiller]

kinda curious how it works atm, i assumed traffic to the WAN port is just getting translated to the LAN broadcast address so any interface listening on the port gets the traffic.

iptables -t nat -A PREROUTING -p tcp --dport $FIREWALL_VPN_INPUT_PORT -j DNAT --to-destination someip:$FIREWALL_VPN_INPUT_PORT_NAT

I am going to play around this above rule too see if it will work whilst using not the variables but explicit ports

[qdm12]

Note if this works out, the vpnip:forwardedport will still change (i. e. for broadcasting a port for p2p applications) so external users will have to update the port anyway. But I get your point, you can iptables this to redirect the traffic from port XYZ to a fixed port. Let me know when you figure out (sorry I have zero time atm)

[Androkiller]

wasn't able to get the rules working as intended within the container however was able to get them working for a similar use case on the host, therefore i suspect net.ipv4.ip_forward is not enabled in the container. so i stuck with mullvad vpn in the end as they offer static ports.