How to Forward Public IP Traffic to a WireGuard Client Behind NAT While Preserving Client IPs

When exposing a local server located behind a residential CGNAT (Carrier-Grade NAT) to the public internet using a cloud VPS as a front-end gateway, standard DNAT/MASQUERADE setups rewrite incoming packets with the WireGuard gateway's internal IP. This destroys client IP visibility, making rate-limiting, geo-blocking, and security auditing impossible. Here is how to configure policy-based routing and iptables PREROUTING to preserve the original client IP all the way to your backend application.

Architecture: Public Client (IP: X) → Cloud VPS (Public IP: Y) → WireGuard Tunnel → Home Server Behind NAT (Sees Real Client IP: X)

1. Cloud VPS Gateway Configuration

On the cloud VPS, forward external ports directly through the WireGuard interface (wg0) without applying SNAT/MASQUERADE to the incoming packets:

# Enable IP forwarding
sysctl -w net.ipv4.ip_forward=1

# Forward HTTP port 80 to WireGuard client (10.200.200.2)
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.200.200.2:80
iptables -A FORWARD -p tcp -d 10.200.200.2 --dport 80 -j ACCEPT

2. Home Server Policy Routing (The Secret to Preserving IPs)

Because the incoming packet preserves the public client IP, the home server's reply would normally route through its default residential gateway rather than returning via the WireGuard tunnel (causing asymmetric routing drop). Resolve this using Linux policy routing:

# 1. Create a custom routing table
echo "200 custom_vpn" >> /etc/iproute2/rt_tables

# 2. Route responses to traffic arriving on wg0 back through wg0
ip rule add from 10.200.200.2 table custom_vpn
ip route add default via 10.200.200.1 dev wg0 table custom_vpn

Now your backend web application logs the true public client IP address for every visitor!

How to Access Native SIP / VoIP Account Settings Across Different Android Versions

Many Android releases include a built-in native SIP client directly integrated into the system Dialer application, allowing users to make and receive VoIP calls over Wi-Fi and mobile data without installing third-party battery-draining apps. However, OEM custom skins (Samsung, Huawei, Asus, Xiaomi) frequently relocate the configuration menu.

Native SIP Client Path Reference by Android OS Version

• Android 4.2.2 (Jelly Bean):
  Dialer App → Menu → Settings → Internet Call → Accounts
• Android 5.0 / 5.1 (Lollipop):
  Phone App → Settings → Call Settings → Phone Account Settings → SIP Accounts
• Android 6.0 (Marshmallow) & 7.0 (Nougat):
  Phone App → Three Dots Menu → Settings → Calling Accounts → SIP Accounts
• Android 8.0 (Oreo) through Android 11:
  Phone App → Settings → Calls → Calling Accounts → SIP Accounts → Add (+)

Note: In Android 12 and newer, Google deprecated the legacy built-in SIP stack. For modern Android releases, standard standalone clients like Linphone, Grandstream Wave, or MizuDroid are recommended.

How to Configure VoIP SIP Settings on GreenPacket DT-350 4G Routers

The GreenPacket DT-350 TD-LTE indoor router includes an integrated hardware VoIP FXS port (RJ-11) for connecting analog telephone handsets directly to SIP servers (such as Asterisk, FreePBX, or telecom IMS gateways). However, on many telecom-branded firmwares (such as Irancell), the VoIP menu is hidden from standard administrative accounts.

Hardware: GreenPacket DT-350 TD-LTE Router • RJ-11 POTS Handset • SIP Protocol

1. Accessing Hidden VoIP Menus

Log in with the root/operator credentials (or inspect the web GUI source to reveal hidden navigation items under /voip_settings.html or /sip.html).

2. SIP Account Configuration

SIP Proxy / Registrar: YOUR.PBX.SERVER.IP
Port: 5060
SIP Transport: UDP
Outbound Proxy: (Optional, set if behind telecom NAT)
Account / Display Name: 101
Authentication Username: 101
Secret / Password: YOUR_SIP_SECRET
Codec Priority: G.711u (PCMU), G.711a (PCMA), G.729

Save and apply settings. Once registered, the Phone LED on the router faceplate illuminates solid green, and connected analog handsets will receive dial tone.

Fixing Lantronix Spider KVM Java Security Errors: Using the Native Standalone Client

When accessing remote datacenter servers via Lantronix Spider KVM-over-IP devices, modern Java Runtime Environments (Java 7, 8, and newer) block the JNLP applet with strict security exceptions like "unsigned application requesting unrestricted access to system". Adjusting Java deployment security rules and exception lists frequently fails.

Solution: Replace browser-based Java Web Start with Lantronix's official SpiderControl native standalone client.

Direct Native Client Download

Lantronix provides native standalone binaries that connect directly to the Spider KVM without requiring Java or browser plugins:

• Download the official SpiderControl standalone application for Windows, Linux, or macOS from Lantronix support.
• Launch the client, enter the Spider's IP address, username, and password.
• The native client supports virtual media mounting (ISO redirection), low-latency mouse synchronization, and native resolution scaling without certificate validation errors.

How to Install XFCE Desktop and RealVNC Server on CentOS 7

XFCE is a lightweight, responsive desktop environment ideal for remote graphical management on headless CentOS 7 servers without consuming excessive RAM. However, launching an XFCE session inside RealVNC Server (vncserver-virtual) on CentOS 7 often fails or displays a blank screen because default Xsession startup scripts target GNOME.

Environment: CentOS 7 • XFCE Desktop • RealVNC Server

1. Installing XFCE and RealVNC

yum groupinstall "Xfce" -y
yum install tigervnc-server -y # Or install RealVNC Server RPM

2. Configuring the VNC Virtual Session (/etc/vnc/xstartup.custom)

To ensure RealVNC launches the XFCE desktop environment properly, create or edit /etc/vnc/xstartup.custom:

#!/bin/sh
[ -x /etc/vnc/xstartup ] && exec /etc/vnc/xstartup
[ -r $HOME/.Xresources ] && xrdb $HOME/.Xresources
startxfce4 &

Make the script executable and launch the VNC virtual display:

chmod +x /etc/vnc/xstartup.custom
vncserver-virtual :1

How to Load Balance SSL IMAP, POP3, and SMTP with HAProxy and Dovecot / Postfix

Load balancing encrypted email traffic (IMAPS on port 993, POP3S on port 995, and SMTPS on port 465) using HAProxy requires two critical mechanisms: SSL offloading at the load balancer and the PROXY protocol to preserve the client's real public IP address in Dovecot and Postfix logs.

Architecture: Encrypted Client → HAProxy (SSL Termination & send-proxy) → Dovecot / Postfix (Real IP Preserved)

1. HAProxy Configuration (haproxy.cfg)

frontend imaps_in
    bind *:993 ssl crt /etc/ssl/certs/mail.pem
    mode tcp
    default_backend dovecot_imaps

backend dovecot_imaps
    mode tcp
    server mail1 10.0.0.1:10143 send-proxy check

2. Dovecot PROXY Protocol Support (/etc/dovecot/dovecot.conf)

Configure Dovecot to accept the PROXY protocol header to log the real client IP:

service imap-login {
    inet_listener imap_haproxy {
        port = 10143
        haproxy = yes
    }
}
haproxy_trusted_networks = 10.0.0.0/24

High-Availability Outbound Email: Postfix smtp_fallback_relay with HAProxy SMTP Balancing

For organizations operating mail infrastructure in restrictive networks or corporate subnets with unreliable direct port 25 connectivity, combining HAProxy as an SMTP proxy relay with Postfix's smtp_fallback_relay directive guarantees reliable email delivery without dropped messages.

Flow: Primary MTA → Direct MX Delivery Failure → smtp_fallback_relay → HAProxy Relay VPS → Destination MX

1. HAProxy TCP Relay Configuration (haproxy.cfg)

listen smtp-relay
    bind *:2525
    mode tcp
    option tcplog
    timeout connect 5s
    timeout client 1m
    timeout server 1m
    server mta-out 10.0.0.1:25 check

2. Postfix Fallback Configuration (/etc/postfix/main.cf)

Instruct Postfix to attempt direct MX delivery first, but automatically route through the HAProxy relay if destination mail servers are unreachable:

# Automatic fallback routing to HAProxy relay on port 2525
smtp_fallback_relay = [relay.example.com]:2525