In the default config of OpenVPN there is this commented blocked at the client-to-client line:
# By default, clients will only see the server. # To force clients to only see the server, you # will also need to appropriately firewall the # server's TUN/TAP interface.
I've been wondering for years what they actually mean with "appropriately" firewall the interface. A quick Google also didn't give any specific iptables rules to execute to 'solve' this.
What does this comment mean, and how can I appropriately firewall it using iptables?