I was recently setting up an OpenVPN server on Linux in ethernet bridging mode.
The Linux server had iptables rules enabled, so I had to specify inbound access via UDP on port 1194:
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
However, the OpenVPN server wasn't working properly until I also specified these rules:
iptables -A INPUT -i tap+ -j ACCEPT iptables -A FORWARD -i tap+ -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
Since OpenVPN is configured in bridging mode, I thought that once the VPN connection was established:
- Communication between a connected OpenVPN client and nodes in the internal network occurs over layer 2 (ethernet bridging mode)
- iptables works only on layer 3
And yet, these can't both be true. Why was iptables blocking those packets going from tap0 to other servers on the same subnet?