Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In this OpenVPN howto have they this iptables rule

iptables -A INPUT -i eth1 -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -i eth0 -o tun+ -j ACCEPT
iptables -A FORWARD -i eth1 -o tun+ -m state --state ESTABLISHED,RELATED -j ACCEPT
service iptables save

which is made for a server with 2 NIC's.

I only have one NIC.

How would this iptables look like for a server with only 1 NIC?

share|improve this question
up vote 3 down vote accepted

The above iptables rules use for this diagram:

client ----- (eth1) OpenVPN server (eth0) ----- LAN
  |                        |

so if you have only one NIC, something like this:

client ----- (eth0) OpenVPN server
   |                        |

you can write iptables rules like belows:

iptables -A INPUT -i eth0 -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT

Remove the 3 last FORWARD chain rules.

share|improve this answer

In the example you linked, eth1 is the external interface, while eth0 is the LAN interface. Those iptables rules make possible for VPN connections from the outside to access the local LAN.

You don't need them if using a single eth0, a part, maybe, the lines:

iptables -A INPUT -i eth1 -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT

in case you have a default DROP policy in iptables (or if you use a software firewall inteface, you need to allow connections to port 1194).

That said, what's the need for a VPN with just one ethernet interface? Or do you have a WAN and a LAN IP on the same interface?

share|improve this answer
I would have liked to have two NICs, but all IPs on the LAN are public, but in a DMZ. So I guess even if I had two NICs I would still to have inbound and outbound on the same NIC... So all LAN IPs are also WAN IPs, which makes testing a VPN hard =) – Sandra Sep 2 '11 at 7:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.