title: Tunnel dynamic UDP port range
body: <p>Usually I prefer finding a solution on my own, but unfortunately that didn't work out too well this time so I'm asking here.</p>
  
  <p>I'm trying to deal with a server (rather a computer with no screen and debian minimal on it) which is on the usual home network. Problem is the ISP is running out of ipv4 addresses and therefore
  decided to use ipv6 instead and dual-stack lite to access the ipv4 side of the internet. This means the computer is not accessible over the ipv4 address from the outside
  but is able to connect to a ipv4 computer.</p>
  
  <p>I do have a vserver (debian as well) which still uses only ipv4, so my plan was to use it as some kind of relay or porxy. Problem there is, I am not able to use iptables to configure NAT
  since the server provider has removed that module from the kernel.</p>
  
  <p>My first attempt was to use an SSH tunnel like this:</p>
  
  <pre><code>ssh -f user@vserver -R 2222:localhost:22 -N
  </code></pre>
  
  <p>This allows me to access the CLI over SSH which now listens on port 2222.</p>
  
  <p>Next step was to open a second SSH tunnel and tunnel UDP traffic through that using socat:</p>
  
  <pre><code>homeserver:~# socat tcp4-listen:${tcpport of second tunnel},reuseaddr,fork udp:localhost:${udpport to forward traffic from}
  
  vserver:~# socat -T15 udp4-recvfrom:${udpport to forward traffic to},reuseaddr,fork tcp:localhost:${tcpport of second tunnel}
  </code></pre>
  
  <p>This does work, however once the client application is trying to connect to the UDP port, the server application is trying to continue the communication on a different new port from the dynamic
  port range (Ephemeral Port Range I think). That one random port of course is not being forwarded since socat is not listening to.</p>
  
  <p>The second attempt also involved an SSH tunnel, only a dynamic one this time (basically a socks proxy).
  I was trying to setup a virtual network device to route all the traffic through the socks proxy:</p>
  
  <p>(As described in man pages from badvpn-tun2socks)</p>
  
  <pre><code>homeserver:~# openvpn --mktun --dev tun0 --user &lt;someuser&gt; #create tun0 device
  homeserver:~# ifconfig tun0 10.0.0.1 netmask 255.255.255.0 #configure it
  homeserver:~# route add &lt;IP_vserver&gt; gw &lt;IP_of_original_gateway&gt; metric  #Route all traffic through tun0
  homeserver:~# route add default gw 10.0.0.2 metric 6             #exept the ones to the vserver
  homeserver:~# badvpn-tun2socks --tundev tun0 --netif-ipaddr 10.0.0.2 --netif-netmask 255.255.255.0 --socks-server-addr 127.0.0.1:1080 \ 
            --udpgw-remote-server-addr 127.0.0.1:7300
  </code></pre>
  
  <p>This needs to SSH socks-proxies since upd needs to be handled seperately.</p>
  
  <p>On the vserver side of things these need to be handled as well:</p>
  
  <pre><code>vserver:~# badvpn-udpgw --listen-addr 127.0.0.1:7300
  </code></pre>
  
  <p>The connection between both is successful but this time the homeserver is not accessible at all. (seems to me like the vserver has no clue what to do with the packets)</p>
  
  <p>I hope there is a simple fix to either of my attempts. But as it stands now,
  I think my whole approach is fundamentally flawed and I'm starting to run out of ideas.</p>
  
  <p>Any help would be appreciated, Thanks in advance!</p>