Use public vps IP on internal firewall about openmptcprouter

[Ysurac]

I'm not sure I really understand what you want.
For incoming packets there is no real problem, you can disable masquerade on VPN zone.
For outgoing packets I don't really understand what you want but you need to know that, by default, TCP is using a proxy, it's a big difference with a VPN.

[Funstar81]

Thank you for your very fast response. Basically I want omr to be fully transparent to my local firewall. I want to configure the public IP of the vps to my firewalls WAN interface, so it does the source NAT. And then, all packets should be handled by omr in a way that outgoing packets from my firewall keep their (public) source IP all the way out to the internet and that incoming packets reach my firewall in a way that they are addressed to the public IP, so the firewall doesn't know about the omr-construct on its WAN side.

[Ysurac]

So you want something like a bridge mode, for me it's not possible.
But you can still try and if you success I can add needed settings for that.

[Funstar81]

I would like to try it, if you could give me some hints for that:

1. How to disable SNAT for omr => tun0
2. How to enable DNAT for omr => lan

[Funstar81]

After setting "option masq" to '0' in /etc/config/firewall on my local omr instance, I can see the packets with the unchanged sender ip 5.75.172.183 when I monitor the traffic with tcpdump -i tun0 -n outbound. However, on the vps side of the tunnel, I cannot see those packets with tcptump -i tun0 -n inbound. They get lost somewhere on their way.