I've followed two separate guides(1, 2) to setup my Raspberry Pi up as a VPN router. To clarify, the RPi isn't acting as a VPN server but rather acting as a router to forward traffic from some, but not all, LAN clients to a third party VPN provider.

The network topology is as follows. There are a number of clients that connect to a home router either by wireless or Ethernet. The Pi hosting the VPN is connected to the router by Ethernet and is assigned a static IP.

Some of the clients use the router as their default gateway. Their traffic is passed on without entering the VPN tunnel. Other clients use the Pi's IP address as their default gateway. The Pi receives their traffic and then forwards it on through the VPN tunnel.

Rather than just mindlessly copy and paste commands I wanted to know what I was doing. When I encountered iptables I went over a few basic tutorials to try understand them.

I ended up with the following set of iptables (a mix of both guides):

-A INPUT -i lo -p tcp -m tcp --dport 4711:4720 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i lo -m comment --comment Loopback -j ACCEPT
-A INPUT -i eth0 -p icmp -m comment --comment IMCP -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -m comment --comment SSH -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 5900 -m comment --comment "VNC 5900" -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 5901 -m comment --comment "VNC 5901" -j ACCEPT
-A FORWARD -i eth0 -o tun0 -m comment --comment "Enable LAN connection" -j ACCEPT
-A FORWARD -i tun0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o tun0 -m comment --comment vpn -j ACCEPT (rule 1)
-A OUTPUT -o eth0 -p icmp -m comment --comment icmp -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp --dport 1198 -m comment --comment openvpn -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --sport 22 -m comment --comment ssh -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp --dport 53 -m comment --comment dns -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 53 -m comment --comment dns -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp --dport 123 -m comment --comment "Network Time Protocol" -j ACCEPT
-A OUTPUT -d -o eth0 -m comment --comment lan -j ACCEPT (rule 8)
-A OUTPUT -o eth0 -j DROP   (rule 9)

The purpose of these rules is to accomplish three things:

  1. Route all traffic the Pi receives from within the LAN out through the VPN tunnel.
  2. Try provide some security from WAN to LAN.
  3. Restrict traffic so that the traffic from the LAN clients can only go out through the VPN.

With the above iptable none of the connected clients can access the internet. To troubleshoot I removed rule 9 from the output chain. This resolved my issue and as far as I can tell is working as I intend.

With rule 9 removed the clients connect through the VPN and when the VPN goes down they cannot access the internet.

Questions 1. Why does rule 9 currently block all my traffic? From my understanding rule 1 should allow all traffic going out onto the VPN (tun0 interface) and rule 8 should allow the traffic to return to a client on the LAN(for example the client at From my understanding either rule 1 or rule 8 appears to not be working as intended.

Question 2. I am correct in thinking that rule 9 is redundant? I think this because the default action of the forward chain is drop and unless traffic from eth0 is going to tun0 then it will be dropped anyway?

  • Please describe your network topology. For example, is this device between the LAN and WAN? Is it the main WAN router? How do you differentiate the "some" clients that can use it and those that can't. What should happen to traffic from this second group of clients? Which routes should be sent across the VPN and which should not? – roaima Mar 28 at 19:53
  • Please add all that to your question - ideally as if you'd provided it originally. Don't use "edit" or "update", but make the question flow. Comments don't always get read by people answering a question, and can be deleted. Make it easy for us to help you. – roaima Mar 29 at 7:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.