Firewall (FW), three leg:

  • eth0:
  • eth1: (LAN)
  • eth2: (DMZ)

I installed openvpn in FW by tunnel mode, already ok:

  • tun0:

If I use shorewall and squid proxy FW is ok. At beside can connect to FW, LAN, DMZ using my company services.

Now, I want to use iptables rules + squid proxy.

What do I set rules for openvpn?

And I have set rules below but not connect to server firewall installed openvpn:

  • Packet forwarding

    net.ipv4.ip_forward = 1

  • OpenVPN

    iptables -A INPUT -i eth0 -m state --state NEW -p udp --dport 1194 -j ACCEPT

  • Allow TUN interface connections to OpenVPN server

    iptables -A INPUT -i tun+ -j ACCEPT

  • Allow TUN interface connections to be forwarded through other interfaces

    iptables -A FORWARD -i tun+ -j ACCEPT
    iptables -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
    iptables -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
  • NAT the VPN client traffic to the internet

    iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

  • If your default iptables OUTPUT value is not ACCEPT, you will also need a line like:

    iptables -A OUTPUT -o tun+ -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.