Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With an openvpn tunnel that uses a tun device, what iptables rules allow the encapsulated traffic through and what rules control the packets after encapsulation? Basically, I am wondering how the order of operations works with iptables and openvpn as well as how this relates to the chains.

share|improve this question
up vote 7 down vote accepted

Plaintext traffic will go in and out of the tunX devices; you may find the -i tun+ and -o tun+ options to iptables, which match any tun interface, useful in handling that.

Encrypted traffic will be UDP/TCP on port 1194, or otherwise, as you have specified, on your ethernet interface. When filtering traffic into the server, don't forget to allow the OpenVPN encrypted packets.

And as for chains, encrypted traffic coming in is considered to terminate on the openvpn server, so that's the INPUT chain; encrypted traffic leaving is considered to have originated on the server, so that's the OUTPUT chain. Traffic passing between your internal network and the tunX interfaces is the responsibility of the FORWARD chain.

share|improve this answer

For traffic coming through the tunnel, you just need to set up FORWARD rules to allow the traffic from the tun interface to the eth interface. Such as the following rule allows access from tun0 to RDP for the specific range.

-A FORWARD -i tun0 -p tcp --dport 3389 -d -j ACCEPT

After the forward rules, if you have an established/related rule on the eth interface, it will allow the traffic back through.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.