Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Simple for those who know, indecipherable for those who don't...

I'm running openVPN on (hypothetical) 66.66.66.66, I want to FORWARD incoming traffic, arriving on interface eth0 to interface tun0.

It would also be nice to filter - based on destination IP address. I'm doing the NAT later on, but like to lock down early wherever possible.

So onto the main course...

This works:

  #Enable forwarding from eth0 to tun0
  iptables -A FORWARD -i eth0 -o tun+ -j ACCEPT

But this doesn't pass any packets whatsoever:

 #Stricter version
 iptables -A FORWARD -i eth0 -o tun+ --dst 66.66.66.66  -j ACCEPT

Am I being unacceptably foolish?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

The following works quite well for me, I'm not sure if it's perfect but seems sane enough.

iptables -A FORWARD -i eth0 -o tun+ -j ACCEPT
iptables -A FORWARD -i eth0 -o tun+ \! -d 178.79.178.75 -j DROP
share|improve this answer
    
Oh yeah, you must also enable martians in sysctl on the remote box –  Bryan Hunt Jan 17 '12 at 12:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.