How to forward traffic 80/443 from interface eth0 to ip address of openvpn client?

Question

openvpn

Hello everyone!
I'm trying to set up access to the home server from the outside, taking into account the gray static from the Internet provider.
Initial data (see the attached diagram under the spoiler):

spoiler

• amazon aws instance with configured openvpn server on ubuntu 16.04 OS
  
• home router with openvpn client and configured port forwarding to the desired server
  
• the server itself is connected to the home network
  

How did you solve the problem:

• opened access to the necessary ports in the aws firewall from trusted Internet subnets
  
• opened ports in ufw on amazon aws
  
• set up forwarding on the home router to the desired local server
  
• according to the guides from open sources, I made settings on the amazon aws server in terms of redirecting traffic from eth0 to the ip openvpn of the router client:
  

etc/ufw/before.rules

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0] 
-A PREROUTING -i eth0 -d 18.146.x.x -p tcp --dport 80 -j DNAT --to-destination 10.8.0.4:80
-A PREROUTING -i eth0 -d 18.146.x.x -p tcp --dport 443 -j DNAT --to-destination 10.8.0.4:443
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
COMMIT

/etc/sysctl.conf

net.ipv4.ip_forward= 1
As a result, the scheme still does not work. Question to experts, what did I miss and how to solve the question in the end?

Answer 1

And on the home router, in addition to redirecting FROM the tunnel, is the same NAT made INSIDE the tunnel?
And what's the point of doing two redirects (forwarding) when you can immediately register a direct route to the server behind the tunnel on AWS and not do any forwarding on your home router?