Troubleshooting:Port Forwarding Troubleshooting

Port Forwarding Troubleshooting Guide

Overview

This guide covers troubleshooting for SSH port forwarding from the VPS (port 22222) to the Synology NAS (10.8.0.2:22) via OpenVPN.

Port Forwarding Configuration:

• External Access: ssh -p 22222 user@87.106.61.62

• Internal Target: 10.8.0.2:22 (Synology NAS via VPN)

• Network Interface: ens6 (external interface)

• VPN Interface: tun0 (OpenVPN tunnel)

• Cloud Provider: IONOS

---

IONOS Cloud Provider Configuration

Important: This VPS is running on IONOS. The IONOS firewall must be configured to allow traffic on port 22222.

IONOS Firewall Configuration

IONOS uses a cloud firewall that must be configured through the IONOS Cloud Panel:

Log in to IONOS Cloud Panel:

  * Navigate to: https://dcd.ionos.com/

  * Select your Data Center → Server & Cloud → Servers

Configure Firewall Rules:

  * Select your VPS server

  * Go to Firewall section

  * Click Add Rule or edit existing rules

Add Firewall Rule for Port 22222:

  * Name: SSH Port Forward (or any descriptive name)

  * Protocol: TCP

  * Port: 22222

  * Source: 0.0.0.0/0 (or restrict to specific IPs for security)

  * Action: Allow

  * Priority: Set appropriate priority (lower numbers = higher priority)

Apply Changes:

  * Save the firewall rule

  * Changes are applied immediately (no server restart required)

Verify IONOS Firewall:

  * Ensure the firewall rule is active and enabled

  * Check that no higher-priority DROP rules are blocking the port

  * Verify the rule applies to the correct network interface

IONOS-Specific Notes

• Firewall Location: IONOS firewall is managed at the cloud infrastructure level, not on the VPS

• No Security Groups: IONOS uses a direct firewall per server, not security groups

• Rule Priority: Lower priority numbers are evaluated first

• Immediate Effect: Firewall changes take effect immediately without server restart

• Multiple Rules: You can have multiple rules; ensure no conflicting DROP rules have higher priority

Testing IONOS Firewall

If you suspect the IONOS firewall is blocking traffic:

Check IONOS Cloud Panel:

  * Verify the firewall rule exists and is enabled

  * Check rule priority (lower numbers = higher priority)

  * Ensure no DROP rules are blocking the port

Test from different locations:

   # Test from external IP (not from the VPS itself)
   ssh -v -p 22222 user@87.106.61.62

Check if packets reach the VPS:

   # On the VPS, check if packets are hitting iptables rules
   iptables -t nat -L PREROUTING -n -v | grep 22222
   # If packet count doesn't increase, packets are blocked before reaching VPS

---

Quick Verification Checklist

Run these commands to verify the setup is working:

= 1. Check if VPN is running =
systemctl status openvpn-server@server.service

= 2. Verify VPN tunnel is up =
ip addr show tun0

= 3. Check if Synology is connected to VPN =
ping -c 2 10.8.0.2
cat /etc/openvpn/server/ipp.txt | grep "10.8.0.2"

= 4. Verify iptables rules are active =
iptables -t nat -L PREROUTING -n -v | grep 22222
iptables -t filter -L FORWARD -n -v | grep "10.8.0.2"

= 5. Check IP forwarding is enabled =
cat /proc/sys/net/ipv4/ip_forward  # Should output: 1

= 6. Verify SSH is NOT listening on port 22222 (should only be on 22) =
ss -tlnp | grep 22222  # Should return nothing

---

Components Explained

1. iptables NAT Rules (Port Forwarding)

DNAT Rule (PREROUTING):

iptables -t nat -A PREROUTING -i ens6 -p tcp --dport 22222 -j DNAT --to-destination 10.8.0.2:22

• Purpose: Redirects incoming traffic on port 22222 to the Synology NAS

• Interface: ens6 (external/public interface)

• Direction: Incoming → Forwarded

MASQUERADE Rule (POSTROUTING):

iptables -t nat -A POSTROUTING -d 10.8.0.2/32 -o tun0 -p tcp --dport 22 -j MASQUERADE

• Purpose: Handles source NAT for forwarded traffic so return packets route correctly

• Interface: tun0 (VPN tunnel)

• Direction: Outgoing forwarded traffic

2. iptables Filter Rules (Firewall)

FORWARD Rule:

iptables -t filter -A FORWARD -d 10.8.0.2/32 -p tcp --dport 22 -j ACCEPT

• Purpose: Allows forwarding packets to the Synology SSH port

• Direction: Forwarded traffic

3. Persistence Configuration

Files:

• /etc/iptables/rules.v4 - Saved iptables rules

• /etc/openvpn/server/server.conf - OpenVPN configuration

• /etc/openvpn/iptables-restore.sh - Script that restores rules when VPN starts

• /etc/sysctl.conf - Contains net.ipv4.ip_forward=1

Services:

• netfilter-persistent - Loads iptables rules on boot

• openvpn-server@server.service - OpenVPN server service

---

Common Issues and Solutions

Issue 1: Connection Timeout from External

Symptoms:

• ssh -p 22222 user@87.106.61.62 times out

• No response from the server

Diagnostic Steps:

Check if packets are reaching the VPS:

   # Watch kernel logs for DNAT rule hits
   # Note: On systems using journald, kern.log may not exist. Use dmesg instead.
   tail -f /var/log/kern.log | grep "DNAT-22222" 2>/dev/null || \
   dmesg -w | grep "DNAT-22222"
   
   # Or check recent logs
   dmesg | tail -30 | grep "DNAT-22222"

Check IONOS cloud firewall:

  * IONOS Cloud Panel: Log in to https://dcd.ionos.com/

  * Navigate to: Server & Cloud → Servers → [Your VPS] → Firewall

  * Verify TCP port 22222 has an ALLOW rule configured

  * Check rule priority (lower numbers = higher priority)

  * Ensure no DROP rules with higher priority are blocking the port

  * This is the most common cause of timeouts on IONOS

  * See "IONOS Cloud Provider Configuration" section above for detailed steps

Verify VPN is running:

   systemctl status openvpn-server@server.service
   ip link show tun0

Check if Synology is connected:

   ping -c 2 10.8.0.2
   cat /etc/openvpn/server/ipp.txt

Solution:

• If no logs appear: Check IONOS firewall in Cloud Panel (most common issue)

 * Verify port 22222 is allowed in IONOS firewall rules

 * Check rule priority and ensure no blocking rules override it

• If logs appear but connection fails: Check Synology VPN connection

• If Synology is not in ipp.txt: Reconnect Synology to VPN

---

Issue 2: Port Forwarding Not Working After Reboot

Symptoms:

• Port forwarding works initially

• After reboot, connections time out

Diagnostic Steps:

Check if iptables rules are loaded:

   iptables -t nat -L PREROUTING -n -v | grep 22222

  * If rule is missing, rules weren't loaded

Verify persistence services are enabled:

   systemctl is-enabled netfilter-persistent
   systemctl is-enabled openvpn-server@server.service

Check OpenVPN configuration:

   grep "script-security\|up" /etc/openvpn/server/server.conf

  * Should show: script-security 2 and up /etc/openvpn/iptables-restore.sh

Verify iptables-restore script exists:

   ls -la /etc/openvpn/iptables-restore.sh
   cat /etc/openvpn/iptables-restore.sh

Solution:

= Manually restore rules =
iptables-restore < /etc/iptables/rules.v4

= Verify rules are saved correctly =
iptables-save > /etc/iptables/rules.v4

= Ensure services are enabled =
systemctl enable netfilter-persistent
systemctl enable openvpn-server@server.service

---

Issue 3: Wrong Network Interface

Symptoms:

• Rules exist but forwarding doesn't work

• Interface name mismatch

Diagnostic Steps:

Identify the correct external interface:

   ip route | grep default
   # Output: default via 87.106.61.1 dev ens6 ...

Check iptables rule interface:

   iptables -t nat -L PREROUTING -n -v | grep 22222
   # Should show: -i ens6 (or your actual interface)

Check saved rules file:

   grep "22222" /etc/iptables/rules.v4

Solution:

= Fix the interface in the rules file =
sed -i 's/-i eth0/-i ens6/g' /etc/iptables/rules.v4

= Or manually edit /etc/iptables/rules.v4 =
= Change: -A PREROUTING -i eth0 ... =
= To:     -A PREROUTING -i ens6 ... =

= Reload rules =
iptables-restore < /etc/iptables/rules.v4

---

Issue 4: SSH Conflicts with Port Forwarding

Symptoms:

• Port 22222 is being used by SSH

• Connection connects but to wrong server

Diagnostic Steps:

Check what's listening on port 22222:

   ss -tlnp | grep 22222

Check SSH configuration:

   grep "^Port" /etc/ssh/sshd_config

Solution:

= Remove port 22222 from SSH config =
sed -i '/^Port 22222$/d' /etc/ssh/sshd_config

= Restart SSH =
systemctl restart sshd

= Verify port 22222 is free =
ss -tlnp | grep 22222  # Should return nothing

---

Issue 5: VPN Not Starting

Symptoms:

• OpenVPN service fails to start

• Error messages about script-security

Diagnostic Steps:

Check OpenVPN status:

   systemctl status openvpn-server@server.service
   journalctl -u openvpn-server@server.service -n 50

Common error:

   WARNING: External program may not be called unless '--script-security 2' or higher is enabled

Solution:

= Add script-security to OpenVPN config =
echo "script-security 2" >> /etc/openvpn/server/server.conf

= Restart OpenVPN =
systemctl restart openvpn-server@server.service

---

Issue 6: IP Forwarding Disabled

Symptoms:

• Rules exist but forwarding doesn't work

• Can't reach Synology even though VPN is up

Diagnostic Steps:

Check if forwarding is enabled:

   cat /proc/sys/net/ipv4/ip_forward
   # Should output: 1

Check if it's in sysctl.conf:

   grep "ip_forward" /etc/sysctl.conf

Solution:

= Enable forwarding =
echo 1 > /proc/sys/net/ipv4/ip_forward

= Make it persistent =
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

---

Diagnostic Commands

Check Complete Forwarding Chain

echo "=== Port Forwarding Status ===" && \
echo "" && \
echo "1. DNAT Rule:" && \
iptables -t nat -L PREROUTING -n -v | grep 22222 && \
echo "" && \
echo "2. FORWARD Rules:" && \
iptables -t filter -L FORWARD -n -v | grep "10.8.0.2" && \
echo "" && \
echo "3. POSTROUTING (MASQUERADE):" && \
iptables -t nat -L POSTROUTING -n -v | grep "10.8.0.2\|MASQUERADE" && \
echo "" && \
echo "4. VPN Status:" && \
ip addr show tun0 2>/dev/null | grep "inet " && \
echo "" && \
echo "5. Synology Reachability:" && \
ping -c 1 -W 2 10.8.0.2 2>&1 | grep -E "bytes from|time=" || echo "Not reachable"

Monitor Connection Attempts

= Watch for incoming connections =
= Note: On systems using journald, kern.log may not exist. Use dmesg instead. =
tail -f /var/log/kern.log | grep -E "DNAT-22222|FWD-to-Synology" 2>/dev/null || \
dmesg -w | grep -E "DNAT-22222|FWD-to-Synology"

= Or use tcpdump =
tcpdump -i ens6 -n tcp port 22222

= Monitor iptables counters =
watch -n 1 'iptables -t nat -L PREROUTING -n -v | grep 22222'

Test Connection from VPS

= Test direct connection to Synology =
ssh -o ConnectTimeout=5 -p 22 user@10.8.0.2 "echo 'Direct connection works'"

= Test if port forwarding rule is active (from external IP) =
timeout 5 nc -zv 87.106.61.62 22222

---

Restore Configuration After Issues

If port forwarding stops working, restore the complete configuration:

= 1. Restore iptables rules =
iptables-restore < /etc/iptables/rules.v4

= 2. Verify rules are loaded =
iptables -t nat -L PREROUTING -n -v | grep 22222

= 3. Restart OpenVPN (will also restore rules via up script) =
systemctl restart openvpn-server@server.service

= 4. Verify VPN is up =
ip addr show tun0

= 5. Check Synology connection =
ping -c 2 10.8.0.2

---

Configuration Files Reference

/etc/iptables/rules.v4

Complete iptables rules including:

• DNAT rule for port 22222

• FORWARD rule for Synology

• MASQUERADE rule for return traffic

• Logging rules for debugging

/etc/openvpn/server/server.conf

OpenVPN server configuration with:

• script-security 2 - Allows up/down scripts

• up /etc/openvpn/iptables-restore.sh - Restores rules when VPN starts

/etc/openvpn/iptables-restore.sh

Script that restores iptables rules when OpenVPN tunnel comes up.

/etc/sysctl.conf

Contains net.ipv4.ip_forward=1 to enable IP forwarding.

---

Maintenance

Update Rules

After making changes to iptables rules:

= Save current rules =
iptables-save > /etc/iptables/rules.v4

= Verify they're correct =
cat /etc/iptables/rules.v4 | grep 22222

Add More Port Forwards

To forward additional ports:

= Add DNAT rule =
iptables -t nat -A PREROUTING -i ens6 -p tcp --dport <EXTERNAL_PORT> \
  -j DNAT --to-destination 10.8.0.2:<INTERNAL_PORT>

= Add FORWARD rule =
iptables -t filter -A FORWARD -d 10.8.0.2 -p tcp --dport <INTERNAL_PORT> -j ACCEPT

= Save rules =
iptables-save > /etc/iptables/rules.v4

---

Quick Reference

Component	Value
External Port	22222
Internal Target	10.8.0.2:22
External Interface	ens6
VPN Interface	tun0
VPN Subnet	10.8.0.0/24
VPS Public IP	87.106.61.62
Synology VPN IP	10.8.0.2
Cloud Provider	IONOS
IONOS Panel	https://dcd.ionos.com/

Contact & Support

If issues persist after following this guide:

Verify IONOS firewall settings (most common issue):

  * Log in to IONOS Cloud Panel: https://dcd.ionos.com/

  * Navigate to Server & Cloud → Servers → [Your VPS] → Firewall

  * Verify port 22222 is allowed with proper priority