I've followed a guide to set up a raspberry pi to connect to a VPN, then NAT the traffic from my LAN to the VPN in order to protect it.
I'm also using it for DNS filtering (adblocking).
Domain filtering doesn't filter out the IPs I don't like, so I'm trying to learn about ipsets to prohibit communication with vast areas of the Internet.
Currently, my script to do all this looks as such:
iptables -F ipset restore < /etc/ipset-blacklist/ip-blacklist.restore iptables -I INPUT 1 -m set --match-set blacklist src -j DROP iptables -I FORWARD -m set --match-set blacklist src -j DROP iptables -I OUTPUT -m set --match-set blacklist src -j DROP iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE iptables -A FORWARD -i tun0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT iptables -L
But I don't understand why, and I don't think I need all three blacklist rules for INPUT, FORWARD & OUTPUT - I feel like I've achieved a working result the wrong way - and without understanding it.
Can anyone wiser than I see what I'm trying to do, what I've achieved and where I've got wrong please?
Also, what is the "1" for in this line:
iptables -I INPUT 1 -m set --match-set blacklist src -j DROP
This is the goal, which is already somewhat achieved: LAN Goal