Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Firewall (FW), three leg:

  • eth0: 172.16.1.101
  • eth1: 192.168.99.99 (LAN)
  • eth2: 10.0.0.1 (DMZ)

I installed openvpn in FW by tunnel mode, already ok:

  • tun0: 192.168.10.0/24.

If I use shorewall and squid proxy FW is ok. At beside can connect to FW, LAN, DMZ using my company services.

Now, I want to use iptables rules + squid proxy.

What do I set rules for openvpn?

And I have set rules below but not connect to server firewall installed openvpn:

  • Packet forwarding

    net.ipv4.ip_forward = 1

  • OpenVPN

    iptables -A INPUT -i eth0 -m state --state NEW -p udp --dport 1194 -j ACCEPT

  • Allow TUN interface connections to OpenVPN server

    iptables -A INPUT -i tun+ -j ACCEPT

  • Allow TUN interface connections to be forwarded through other interfaces

    iptables -A FORWARD -i tun+ -j ACCEPT
    iptables -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
    iptables -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
    
  • NAT the VPN client traffic to the internet

    iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o eth0 -j MASQUERADE

  • If your default iptables OUTPUT value is not ACCEPT, you will also need a line like:

    iptables -A OUTPUT -o tun+ -j ACCEPT
    
share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.