I've followed a guide to set up a raspberry pi to connect to a VPN, then NAT the traffic from my LAN to the VPN in order to protect it.

I'm also using it for DNS filtering (adblocking).

Domain filtering doesn't filter out the IPs I don't like, so I'm trying to learn about ipsets to prohibit communication with vast areas of the Internet.

Currently, my script to do all this looks as such:

iptables -F

ipset restore < /etc/ipset-blacklist/ip-blacklist.restore

iptables -I INPUT 1 -m set --match-set blacklist src -j DROP
iptables -I FORWARD -m set --match-set blacklist src -j DROP
iptables -I OUTPUT -m set --match-set blacklist src -j DROP

iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -A FORWARD -i tun0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT
iptables -L

This works!

But I don't understand why, and I don't think I need all three blacklist rules for INPUT, FORWARD & OUTPUT - I feel like I've achieved a working result the wrong way - and without understanding it.

Can anyone wiser than I see what I'm trying to do, what I've achieved and where I've got wrong please?

Also, what is the "1" for in this line:

iptables -I INPUT 1 -m set --match-set blacklist src -j DROP

This is the goal, which is already somewhat achieved: LAN Goal


Edit:: The "1" is for the order of the rule.

The FORWARD chain is the only necessary chain, not all three.

I assume this is because all the traffic is being forwarded.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.