openvpn configure iptables to allow only port 80/443 and throttle all other

Question

I'm using Openvpn to let people go on the internet. All is working fine but i want to restrict the use torrent/P2p traffic. Instead of trying to block that by trying to identify them all separately i want to allow only http and https and throttle the rest or deny them. The iptables configuration that i have now is:

    # Generated by iptables-save v1.4.21 on Mon Dec 26 16:45:34 2016
*mangle
:PREROUTING ACCEPT [1412:290307]
:INPUT ACCEPT [668:148793]
:FORWARD ACCEPT [744:141514]
:OUTPUT ACCEPT [528:166065]
:POSTROUTING ACCEPT [1182:293750]
COMMIT
# Completed on Mon Dec 26 16:45:34 2016
# Generated by iptables-save v1.4.21 on Mon Dec 26 16:45:34 2016
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [343:139236]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p icmp -m state --state NEW -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1195 -j ACCEPT
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
-A INPUT -j DROP
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
COMMIT
# Completed on Mon Dec 26 16:45:34 2016
# Generated by iptables-save v1.4.21 on Mon Dec 26 16:45:34 2016
*nat
:PREROUTING ACCEPT [55:4133]
:INPUT ACCEPT [12:1368]
:OUTPUT ACCEPT [1:76]
:POSTROUTING ACCEPT [1:76]
-A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 145.131.3.243
-A POSTROUTING -s 10.8.1.0/24 -j SNAT --to-source 145.131.17.88
COMMIT
# Completed on Mon Dec 26 16:45:34 2016

I've only read about the possibility of allowing only http and https but couldn't find a way to actually implement it that way. My guess would be that i have to add rules to the FORWARD chain which now says that you can do what you want over the tun interface. Since the default Policy of the FORWARD chain is set to DROP everything except the traffic which has rules allowing it explicitly. Am i right about the chain where i should place the rules?

Answer 1

Tested it and it works when you put them in the forward chain. Tested it over the openvpn and putting (for testing!) this rule at the top of the chain. All other networks can pass and only traffic coming from the 10.8.1.0/24 network is not getting any over 443 :

-A FORWARD -s 10.8.1.0/24 -p tcp --dport 443 -j DROP
-A FORWARD -i tun+ -j ACCEPT

So i was right and can work this out further now.

Thanks for thinking with me. ;)