iptables openvpn forward selectively from eth to tun

Question

Simple for those who know, indecipherable for those who don't...

I'm running openVPN on (hypothetical) 66.66.66.66, I want to FORWARD incoming traffic, arriving on interface eth0 to interface tun0.

It would also be nice to filter - based on destination IP address. I'm doing the NAT later on, but like to lock down early wherever possible.

So onto the main course...

This works:

  #Enable forwarding from eth0 to tun0
  iptables -A FORWARD -i eth0 -o tun+ -j ACCEPT

But this doesn't pass any packets whatsoever:

 #Stricter version
 iptables -A FORWARD -i eth0 -o tun+ --dst 66.66.66.66  -j ACCEPT

Am I being unacceptably foolish?

Answer 1

The following works quite well for me, I'm not sure if it's perfect but seems sane enough.

iptables -A FORWARD -i eth0 -o tun+ -j ACCEPT
iptables -A FORWARD -i eth0 -o tun+ \! -d 178.79.178.75 -j DROP