Remote router management. How to forward a port from the outside to a host behind a tunnel?

Question

linux

Given:

• HV1 debian hypervisor with white IP
  
• VM1 inside hypervisor with OpenVPN server installed
  
• Router R1 with tun0 tunnel up to VM1
  
• До VM1 нормально пробрасывается снаружи порт, т.к. работают SSH и OpenVPN
  
• C VM1 работает telnet до R1
  
• @VM1 cat /etc/sysctl.conf net.ipv4.ip_forward=1
  

Конфигурация OpenVPN сервера:

port 9094
proto tcp
dev tun

ca .keys/ca.crt
cert .keys/server.crt
key .keys/server.key  # This file should be kept secret
dh .keys/dh2048.pem

server 10.0.141.0 255.255.255.0
client-config-dir /etc/openvpn/ccd

keepalive 10 120
tun-mtu 1500
mssfix 1450
cipher AES-256-CBC
auth sha1
user nobody
group nogroup
persist-key
persist-tun

@VM1 cat /etc/openvpn/ccd/cli1:

iroute 192.168.141.0 255.255.255.0 10.0.141.2
ifconfig-push 10.0.141.2 10.0.141.1

@VM1 tcpdump:

10:32:52.881288 IP ip1-2-3-4.58268 > 10.0.141.2.http: Flags [S], seq 2942271875, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
10:32:58.638323 IP ip1-2-3-4.58266 > 10.0.141.2.http: Flags [S], seq 2324022312, win 8192, options [mss 1460,nop,nop,sackOK], length 0

Задача:
Как сделать, чтобы при обращении на порт HV1 клиент попадал на порт R1?
Грубо говоря, хочу удалённо управлять роутером, который использует 4G подключение

Answer 1

If I understood the scheme correctly, then you need to forward the port to VM1 on HV1, and forward the same port to R1 on VM1

Answer 2

Don't forward another port - use a VPN to access the network behind the VPN server.
You don't have a configuration line that specifies a client-side route to the network behind the VPN server. The cli1 file should contain something like:
push "route 192.168.142.0 255.255.255.0"
(substitute your own addresses)
The iroute instruction adds a route on the VPN server to the network behind the client.