Help on configuring iptables for openvpn

Question

I am trying to setup a openvpn server for group of people but I have problem with configuring iptables rules.

the box have 5 Dedicated IP address and I want to use one of ips that is not the default outgoing ip address also I want to limit open ports on vpn to ( 80 443 53 ... ) and block the rest.

openvpn client ip range is : 10.1.8.2 - 10.1.8.255
openvpn server ip : 10.1.8.1
outgoing ip address : a.b.c.d ( real ip )
allowed ports : 80 443 53 21

after a lot of researching i found following command that could work for me ?:

iptables -t nat -A PREROUTING -p TCP -m multiport --dports 21,53,80,443 -m iprange --src-range 10.1.8.2-10.1.8.255 -j DNAT --to-destination A.B.C.D

The main problem is iptables is forwarding all traffic from all ips / ports but I want to define iprange and ports manually and block the reset traffic request from openvpn clients ...

Answer 1

This sounds all a little confused to me. The OpenVPN server will take care of routing and NATting for the VPN clients, so you don't need to do this with iptables. In general, OpenVPN also only needs one port, and many people choose to do this on port 443, since in many hotels around the world this port is allowed (whereas others such as port 500, are often not).

You will need an INPUT rule to open the relevant port in the firewall. Depending on your policy settings, you may also need OUTPUT rules for both the internet interface and the tunnel interface. And, again depending on your policy settings, you may need FORWARD rules to allow flow of traffic between relevant interfaces (e.g. the tunnel and your internal network interface). All of these rules can be modified to limit IP address ranges and/or port ranges.

If your machine is forwarding traffic from all IP addresses and all ports, then most likely your default policy for INPUT, OUTPUT and FORWARD is ACCEPT, and you need to change this to DROP. Read the man page for iptables for exact details.