There are two independent packet flows – one for the original packets from LAN, and another for encapsulated packets towards WAN.
For example, a LAN client tries to reach a remote host via the VPN:
- The original packet goes through FORWARD and is forwarded from
tun0, where it's consumed by OpenVPN.
- OpenVPN sends a new "VPN" packet, which goes through OUTPUT and is sent from the firewall to
Same for replies from VPN to LAN:
- The VPN packets are received on
eth0, go through INPUT, and are received by OpenVPN on the firewall.
- The decapsulated "original" packets appear as if they were received through
tun0, and go through FORWARD to
So as far as iptables is concerned,
tun0 is just a regular network interface that's connected to yet another network – it is no different from e.g. having an eth2 physically connected with a very long cable.