I use openvpn and I'm interested in rejecting traffic on a specific port unless its using tun0. For instance if openvpn disconnects all my traffic defaults back to eth0. I would like traffic on a certain port to never use eth0 no matter what. Is this even possible?


Is this even possible?


Take a look at the iptables man page, and you'll see that rules can match against input or output interface names as well as addresses and ports. E.g., to only allow incoming traffic on port 22 coming in on the tun0 interface:

iptables -A INPUT -i tun0 -p tcp --dport 22 -j ACCEPT

Note that you may not be able to just copy-and-paste the above rule because order is significant and I have no idea what your current ruleset looks like.

  • +1 for mentioning that the order of rules is significant - first matching rule wins. – cas Aug 5 '17 at 2:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.