Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Simple for those who know, indecipherable for those who don't...

I'm running openVPN on (hypothetical), I want to FORWARD incoming traffic, arriving on interface eth0 to interface tun0.

It would also be nice to filter - based on destination IP address. I'm doing the NAT later on, but like to lock down early wherever possible.

So onto the main course...

This works:

  #Enable forwarding from eth0 to tun0
  iptables -A FORWARD -i eth0 -o tun+ -j ACCEPT

But this doesn't pass any packets whatsoever:

 #Stricter version
 iptables -A FORWARD -i eth0 -o tun+ --dst  -j ACCEPT

Am I being unacceptably foolish?

share|improve this question
up vote 0 down vote accepted

The following works quite well for me, I'm not sure if it's perfect but seems sane enough.

iptables -A FORWARD -i eth0 -o tun+ -j ACCEPT
iptables -A FORWARD -i eth0 -o tun+ \! -d -j DROP
share|improve this answer
Oh yeah, you must also enable martians in sysctl on the remote box – Bryan Hunt Jan 17 '12 at 12:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .