How to configure iptables for openvpn

How to configure iptables for openvpn 1393/05/19

If you have installed the openvpn server and iptable is blocking the service by default then use these configurations for openvpn to function properly. First let's allow the tcp connection on the openvpn port. If you are using udp or another port number then change this line accordingly.

iptables -A INPUT -i eth0 -m state --state NEW -p udp --dport 1194 -j ACCEPT

Allow TUN interface connections to OpenVPN server

iptables -A INPUT -i tun+ -j ACCEPT

Allow TUN interface connections to be forwarded through other interfaces

iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT

NAT the VPN client traffic to the Internet. change the ip address mask according to your info of tun0 result while running "ifconfig" command.

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

If your default iptables OUTPUT value is not ACCEPT, you will also need a line like:

iptables -A OUTPUT -o tun+ -j ACCEPT

That's it now restart the iptables service and you are finished.

Comments

Nico — 2015-09-24
Hello Arash, thanks for sharing the knowledge!
I'm trying to connect an openvpn client using tun udp and port 15000 and the connection works with iptables service stopped but when i start iptables service i can't ping the openvpn server...
Would you have a clue for the right iptables config to allow openvpn connection?
Best regards,
Nico
Viktor — 2015-09-28
It's work for me. Thanks your for this post.
Adam Robertson — 2016-05-05
Thanks! Works for me

Any thoughts? Please leave a reply

I'll use your email to show your picture using gravatar. I hate spam too.
Back to home

I'm Arash Milani, hacker & happiness ninja.
@narmand is our teams's lab to experiment awesome things in it.

I write and talk about hacking, developing web apps, teamwork and designing for better user experience.

You can always contact me via me[at]arashmilani.com email address.