DNAT with routing, setup possible?

Device1 LAN

OpenVPN Connection

Now I receive tcp packages over the VPN connection for destination which I have to rewrite into and route it over Device1

Is this possible and how?

Is this only possible with the custom rules (only single ip for testing)?
iptables -t nat -A PREROUTING -d -j DNAT --to-destination
and then a static route for to gateway


To better understand the requirements, please, attach a simple network topology with IP addresses marked and the desired packet flow.

Kind Regards,

Yes you are true, here is the network topology:

Notebook has a route for via and can ping and
But now I need to access a device in “LAN2” with address for example.

My idea was now to rewrite all traffic coming in of the tun (vpn) interface to address into (DNAT).

The other idea was to add a second route on the Notebook for example and rewrite it on the RUTX08 into

RUTX08 need a route for network with gateway of the second router

Routing Notebook:

Routing RUTX08:

I got it, can you confirm this setup is ok?

Network > Routing > Static routes

lan | | |

Network > Firewall > Custom Rules

iptables -t nat -A PREROUTING -i tun_c_VPN -d -j DNAT --to-destination

If I ping (LAN1) from the notebook device (LAN2) answer and the connection works.

I was not sure with -A PREROUTING or -I PREROUTING, but append sounds better to me than insert.


Since the routes can be configured on the laptop and you have a VPN, it should be possible to have routing between networks. However, since you already have a working setup, I guess you can leave it as it is. The forwarding itself looks fine.

When it comes to IPtable rules, insert simply ensures that the rule is at the top of the ruleset and is matched first. Keep in mind that rules are applied on the first match. When you append the rule, its added to the bottom of the ruleset and is basically the last rule against which the packet is checked.

Kind Regards.

1 Like

Yes that was my first idea, unfortunately there are more LAN2 networks with the same subnet behind different LAN1 networks…
The only way to handel this (in my eyes) is DNAT or I’m wrong?

Hello @itsam,

Indeed, if there are multiple different networks with same subnets, then DNAT will likely be more appropriate for this use case. This way, you will be able to have a logical distinction between identical networks.

The setup looks fine as long as it achieves your goals. If you will ever need to route between identical networks directly in other set-ups, I would suggest checking these forum posts here:

Kind Regards,

Routing in not an issue for me but in this case I must learn how to use DNAT at Teltonika the first time :wink:

Products and support of Teltonika is really excellent, thank you @AndzejJ !

This topic was automatically closed after 15 days. New replies are no longer allowed.