I recently enabled IP Forwarding on a production web server that also acts as a VPN server. What, if any, security issues did I just set myself up for? And are there any iptables rules I should set up to limit forwarding to my VPN tunnel?
You will only have security issues if your server gets compromised. Anyone/thing that gets into your server will have access to machines on your network, as if it was the server (your machines probably trust your server). You should definitely have some iptables rules! Basically you want iptables to block everything from the outside world to your firewall, except your webserver port(s) and VPN server port(s).
I would recommend something like shorewall http://www.shorewall.net/ to set this up for you, but some people think coming up with the iptables rules yourself if better since you'll understand more about what's going on.
You should definitely minimize any routing-capability of that server by using iptables (FORWARD).
Which VPN-server do you run? Do you have fixed addresses for your VPN-accounts? I suppose you have basic knowledge how iptables should be called (what option/argument does what)?
Some example-rules might look like that, you have to replace XXXX and variables with sensible values fitting your setup:
IPT=/usr/sbin/iptables # deactivate FORWARD by default as you only want to grant access with a whitelist. $IPT -P FORWARD DROP # allow established connections $IPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT # allow access to your VPN-server from the outside $IPT -A INPUT -i $OUTER_INTERFACE -p XXXX --dport XXXX -j ACCEPT # allow access to some host (-d)/protocol (-p)/destination port (--dport) from one VPN-account $IPT -A FORWARD -i $VPN_INTERFACE -o $LAN_OR_OUTER_INTERFACE -s $IP_FROM_VPN -d $SOME_HOST -p XXXX --dport XXXX # allow access from your LAN-network/-host to the VPN-clients $IPT -A FORWARD -i $LAN_INTERFACE -o $VPN_INTERFACE -s $LAN_NET_OR_HOST -j ACCEPT # allow access from the VPN to the WAN $IPT -A FORWARD -i $VPN_INTERFACE -o $OUTER_INTERFACE -s $VPN_NET_OR_HOST -j ACCEPT