Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I mean real newbie - linux here.. Please help me configuring my openvpn through iptables.

My main goal here is to open port for regular browsing (80, 443), email (110, 25), etc just like isp does but i want to block p2p traffic. So I will need to open only few port.

Here are my iptables config

    # Flush all current rules from iptables
    iptables -F
    iptables -t nat -F
    iptables -t mangle -F

    # Allow SSH connections on tcp port 22 (or whatever port you want to use)
    iptables -A INPUT -p tcp --dport 22 -j ACCEPT

    # Set default policies for INPUT, FORWARD and OUTPUT chains
    iptables -P INPUT DROP                #using DROP for INPUT is not always recommended. Change to ACCEPT if you prefer.
    iptables -P FORWARD ACCEPT
    iptables -P OUTPUT ACCEPT

    # Set access for localhost
    iptables -A INPUT -i lo -j ACCEPT

    # Accept packets belonging to established and related connections
    iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

    #Accept connections on 1194 for vpn access from clients
    #Take note that the rule says "UDP", and ensure that your OpenVPN server.conf says UDP too
    iptables -A INPUT -p udp --dport 1194 -j ACCEPT

    #Apply forwarding for OpenVPN Tunneling
    iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    iptables -A FORWARD -s -j ACCEPT     # ? Check your OpenVPN server.conf to be sure
    iptables -A FORWARD -j REJECT
    iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to-source   #Use your OpenVPN server's real external IP here

    #Enable forwarding
    echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 26 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 110 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
    iptables -L -v

But when I connect to my vpn, i can't browsing and also got RTO on pinging yahoo, etc

share|improve this question
Since the default FORWARD behavior is ACCEPT, is there a reason you have a REJECT in there after your OpenVPN subnet? – Magellan Mar 20 '12 at 14:18

It looks like your using the defaults from someone's tutorial for your NAT settings.

The 'to-source' is clearly invalid since you cannot have an IPv4 quarter with a value > 255. The value should be the IP of the external interface of your server.

share|improve this answer
no.. it's just example.. on the original i use my own server ip – Mook Mar 20 '12 at 6:07
OK. You did say 'real newbie'. =) – Magellan Mar 20 '12 at 14:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.