Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to get a basic IPTables setup on my server which will allow HTTP/SSH access, as well as enable the use of the server as an OpenVPN tunnel. The following is my current rule setup - the problem is OpenVPN queries (port 1194) seemed to be getting dropped as a result of this ruleset.

Pinging a website while logged into the VPN results in teh response:

Request timeout for icmp_seq 1 92 bytes from Destination Port Unreachable

When I clear the IPTable rules pinging from the VPN works fine. Any ideas?

iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE
iptables -A INPUT -p tcp --dport 1194 -j ACCEPT
iptables -A FORWARD -p tcp --dport 1194 -j ACCEPT

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i ! lo -d -j REJECT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
iptables -A INPUT -j REJECT
iptables -A FORWARD -j REJECT
share|improve this question

Your VPN server(and client) is configured on TCP or on UDP ? You open just TCP. Put a log before the reject rules to see what is refused by your firewall : you can then change your rules accordingly.

share|improve this answer
both are configured for TCP. How do I put a log before the reject rules? – Afronautica May 27 '10 at 21:56
just before the REJECT lines put : iptables -A INPUT -j LOG iptables -A OUTPUT -j LOG iptables -A FORWARD -j LOG I think something else : you VPN works, right ? You are connected ? The problem, then, is when a packet come from tun0 (VPN interface) to eth0, it is the FORWARD rule which is used. And on your FORWARD rule, you have only REJECT. So define what you authorize in your VPN – Dom May 28 '10 at 7:20
Hi - yes the VPN does work with IPTables disabled. I would like to authorize all activity from my VPN - basically I want to use my VPN to encrypt all traffic from my laptop when I'm at an Internet Cafe, library, etc... as well as restrict access to my home network to my VPNs IP. – Afronautica May 28 '10 at 13:13
Then open the trafic in FORWARD to allow the VPN to communicate with outside. Think to add the interfaces to define if the connection come from outside or from inside – Dom May 31 '10 at 7:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.