I have a server client openvpn setup with all client traffic directed through the tunnel via udp. Id like to restrict what type of applications the client can use whilst connected to my vpn. To begin with id just like the clients to be able to browse.

How would you go about doing this with iptables?

At what end would you place these restrictions, i.e on the servers tun adapter or its public facing eth0 adapter?

******* UPDATE ***** as per PQDs suggestion i updated my iptables but for some reason its allowing traffic on other ports to be forwarded. To test I tried downloading ubuntu via torrent as a client on my vpn and it worked fine when it shouldnt (the port number in the torrent client is not to blame).

Can anyone spot a mistake in my iptables?


# Flush all current rules from iptables
 iptables -F

# Allow SSH connections on tcp port 22

 iptables -A INPUT -p tcp --dport 22 -s $HOME_IP -j ACCEPT
 iptables -A OUTPUT -p tcp --sport 22 -d $HOME_IP -j ACCEPT

#Only ping my server from my home 
 iptables -A INPUT -p icmp --icmp-type 8 -s $HOME_IP -j ACCEPT

# Set default policies for INPUT, FORWARD and OUTPUT chains
 iptables -P INPUT DROP
 iptables -P FORWARD DROP
 iptables -P OUTPUT ACCEPT

# Set access for localhost
 iptables -A INPUT -i lo -j ACCEPT

# Accept packets belonging to established and related connections
 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#Setup OpenVpn
 iptables -A INPUT -i tun+ -j ACCEPT
 iptables -A OUTPUT -o tun+ -j ACCEPT
 iptables -A INPUT -i venet0 -p udp --dport 1194 -j ACCEPT
 iptables -A INPUT -i venet0 -p tcp --dport 1194 -j ACCEPT
 iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
 iptables -A FORWARD -s $CLIENT_IP_RANGE -p tcp --dport 80 -j ACCEPT
 iptables -A FORWARD -s $CLIENT_IP_RANGE -p tcp --dport 8000 -j ACCEPT
 iptables -A FORWARD -s $CLIENT_IP_RANGE -p icmp -j ACCEPT
#Setup NAT for openvpn
 iptables -t nat -A POSTROUTING -o venet0 -j MASQUERADE

# Save settings
 /sbin/service iptables save

update with iptables -nL FORWARD

Chain FORWARD (policy DROP)
target     prot opt source               destination
ACCEPT     all  --             state RELATED,ESTABLISHED
ACCEPT     tcp  --           tcp dpt:80
ACCEPT     tcp  --           tcp dpt:8000
ACCEPT     icmp --
DROP       all  --
  • are you sure vpn client was actually transfering data via your central vpn node? your rule-set seems correct. for starters - can you post output of iptables -nL FORWARD from central vpn node and sniff with tcpdump on wan interface of vpn router while downloading something via bittorent to make sure this traffic actually is going via central server? – pQd Oct 15 '09 at 18:34
  • hi pQd, ive updated my post to show what im forwarding on my central vpn node. When you say to tcpdump on the wan interface of my vpn router, are you talking about the interface on my client machine (i.e. my home pc)? – adam Oct 17 '09 at 5:56
  • @adam - run tcpdump on wan interface of your server, not a home machine with bittorrent. – pQd Oct 17 '09 at 7:31

i would do it just based on source ip [ in this example i assume vpn users have addreses from ]:

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -s -p tcp --dport 80 --j ACCEPT
iptables -A FORWARD -s -p icmp --j ACCEPT
iptables -A FORWARD -s --j DROP

do remember that smarter users might tunnel unwanted traffic over http/https

  • hi pQd thanks for the input. I tried this but probably due to my existing iptable rules it doesnt restrict. I cant figure out why (im relatively new to iptables). Ive updated my post with my rules. If you can see something wrong please let me know. Many Thanks for your help. – adam Oct 15 '09 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.