I am familiar with Iptables, and recently I wanted to build a statefull firewall which is connected to a openvpn server.

If someone is willing to explain, how for example eth0 (WAN), eth1 (LAN) and tun0 (VPN) pass the packets between each other?

I am talking about FORWARD chain. I have no troubles for setting a firewall with two NIC's, but I am getting confused if I try to set it up with OpenVPN.



There are two independent packet flows – one for the original packets from LAN, and another for encapsulated packets towards WAN.

For example, a LAN client tries to reach a remote host via the VPN:

  1. The original packet goes through FORWARD and is forwarded from eth1 to tun0, where it's consumed by OpenVPN.
  2. OpenVPN sends a new "VPN" packet, which goes through OUTPUT and is sent from the firewall to eth0.

Same for replies from VPN to LAN:

  1. The VPN packets are received on eth0, go through INPUT, and are received by OpenVPN on the firewall.
  2. The decapsulated "original" packets appear as if they were received through tun0, and go through FORWARD to eth1 again.

So as far as iptables is concerned, tun0 is just a regular network interface that's connected to yet another network – it is no different from e.g. having an eth2 physically connected with a very long cable.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.