iptables openvpn forward selectively from eth to tun

Posted by Bryan Hunt on Super User See other posts from Super User or by Bryan Hunt
Published on 2011-06-15T13:22:15Z Indexed on 2012/06/12 4:42 UTC
Read the original article Hit count: 544

Filed under:

tunnel

|

iptables

|

openvpn

Simple for those who know, indecipherable for those who don't...

I'm running openVPN on (hypothetical) 66.66.66.66, I want to FORWARD incoming traffic, arriving on interface eth0 to interface tun0.

It would also be nice to filter - based on destination IP address. I'm doing the NAT later on, but like to lock down early wherever possible.

So onto the main course...

This works:

  #Enable forwarding from eth0 to tun0
  iptables -A FORWARD -i eth0 -o tun+ -j ACCEPT

But this doesn't pass any packets whatsoever:

 #Stricter version
 iptables -A FORWARD -i eth0 -o tun+ --dst 66.66.66.66  -j ACCEPT

Am I being unacceptably foolish?

© Super User or respective owner

Related posts about tunnel

Split Tunnel VPN using incorrect Tunnel

as seen on Server Fault - Search for 'Server Fault'
Our company has a handful of field offices that have recently been setup with a regular internet connection after we removed the T1 and router that connected them directly to our network. Now, when the users are in the office, they log in to the VPN to be able to connect to the network. For the… >>> More
ASA hairpining: I basicaly want to allow 2 spokes to be able to communicate with each other.

as seen on Server Fault - Search for 'Server Fault'
ASA Spoke to Spoke Communication I have been looking at spke to spoke comms or "hairpining" for months and have posted on numerouse forums but to no avail. I have a Hub and spoke network where the HUB is an ASA Firewall version 8.2 * I basicaly want to allow 2 spokes to be able to communicate with… >>> More
Script to establish SSH tunnel and then run another program that uses the tunnel

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I am running a GUI app (Gnucash) that connects to a remote Postgres database via a secure shell session. I can use the SSH -L command to tunnel a local port and then separately run Gnucash and this works fine. What I'd like to do is use a single shell script that sets up the tunnel and then calls… >>> More
Split Tunnel VPN using incorrect Tunnel

as seen on Server Fault - Search for 'Server Fault'
Our company has a handful of field offices that have recently been setup with a regular internet connection after we removed the T1 and router that connected them directly to our network. Now, when the users are in the office, they log in to the VPN to be able to connect to the network. For the… >>> More
Routing all Traffic through OpenVPN Tunnel

as seen on Super User - Search for 'Super User'
I have installed OpenVPN server on Archlinux and am now using OpenVPN GUI on Windows 7, I can talk to other computers connected through the VPN but I have not yet figured out how to route all traffic through the tunnel. How do I do this? I figured I need to do it with route ( cmd command ) but I… >>> More

Related posts about iptables

Sometimes this script fails to update the iptables

as seen on Server Fault - Search for 'Server Fault'
It does not happen often, but sometimes after running the below script, checking the iptables with service iptables status shows that they weren't updated and the script doesn't output any error. The iptables is structured as look-up tree (long repeated sections snipped): #!/bin/sh iptables -t… >>> More
My current iptable configuration doesn't work [on hold]

as seen on Server Fault - Search for 'Server Fault'
sudo chkconfig iptables off /etc/init.d/iptables on ### Clear/flush iptables sudo iptables -F sudo iptables -P INPUT ACCEPT sudo iptables -P OUTPUT ACCEPT sudo iptables -P FORWARD ACCEPT ### Allow SSH iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT iptables… >>> More
L2TP iptables port forward

as seen on Server Fault - Search for 'Server Fault'
Hi all, I'm setting up port forwarding for an L2TP VPN connection to the local Windows 2003 VPN server. The router is a simpel Debian machine with iptables. The VPN server works perfect. But I cannot log in from the WAN. I'm missing something. The VPN server is using a pre-shared key (L2TP) and… >>> More
iptables -P FORWARD DROP makes port forwarding slow

as seen on Server Fault - Search for 'Server Fault'
I have three computers, linked like this: box1 (ubuntu) box2 router & gateway (debian) box3 (opensuse) [10.0.1.1] ---- [10.0.1.18,10.0.2.18,10.0.3.18] ---- [10.0.3.15] | box4, www [10.0.2.1] Among other… >>> More
IPtables AWS EC2 NAT/Reverse NAT - For Reverse Proxy style setup but with IPtables

as seen on Server Fault - Search for 'Server Fault'
I was thinking initially needing to do a reverse proxy or something so I could get some SSL/TLS traffic look like it is being terminated at a server and IP address in the AWS cloud, and then that traffic is forwarded onto our actual web servers that aren't in the cloud... I've not done much iptables… >>> More