Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to understand some fundamental OpenVPN/networking basics. Let's assume the following scenario:

  • there is an openVPN server which is already configured properly
  • it runs in bridged mode
  • the names of the interfaces are eth0 (connection to WAN), eth1 (connection to LAN), tap0 and br0 (which bridges eth1 and tap0)

External users should be able to access the LAN via VPN. Thus, it is necessary to do some minimalistic iptables configuration.

First of all, users should be allowed to connect via port 1194:

iptables -A INPUT -i eth0 -p udp --dport 1194 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT 
iptables -A OUTPUT -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

But what rules are needed to allow the flow of decrypted VPN traffic between OpenVPN and the LAN?

From my point of understanding, the decrypted VPN-traffic enters and leaves via tap0, so it would be necessary to set up forwarding between tap0 and eth1. But obviously I am wrong at this point since the bridged-interface makes things more complicated.

The OpenVPN-docs suggest the following:

iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT
  • Does this really suit my (theoretical) scenario?
  • Why whould I need additional INPUT rules? In routing/tun-based scenarios, forwarding is the only thing to do (between tun0 and eth1)
  • I don't get the forward rule. So traffic enters via br0, but how does it leave?

I understand that br0 acts as a "software switch" with eth1 and tap0 connected, but not how iptables can affect it.

edit: by "affect it" I do not mean that I want to filter the bridged traffic which is not possible as Zoredache pointed out.

All I want to do is to configure iptables in a way that the bridged mode just works. My default-policy of iptables is DROP, so I assume I need some rules relating to br0 and/or tap0. I know that route-based VPN is another story, but there for example I had to allow traffic between tun0 and eth1 via forward-chain. I would expect to have to define something similar for the bridged-mode, or am I wrong?

share|improve this question
Iptables shouldn't affect it. It operates at layer 3. Bridging is at layer2. – Zoredache Jul 6 '14 at 18:12
@Zoredache Thank you! Please see my edit – Mario Jul 6 '14 at 18:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.