block access from subnet, but allow access TO subnet

snieuw

Hi everybody,
first of all: openvpn is running smoothly 🙂
We have 10 clients connected via openvpn, 5 have a 10.8.0.x ip, and 5 a 10.8.100.x ip. I block those with 10.8.100.x via IPtables. works perfect!
Now i would like to allow connections initiated from within the local network! So i want to be able to SSH into the machines, but i do not want the machines to ssh into a client inside the servers LAN.

As this is simmilar to a Router Configuration of the firewall, I'm sure this has to be possible (masquerading??).

Any sugesstions on the iptables setup?
So far i allow everything, and drop connections from tun with source 10.8.100.0/24.

thanks!
Steffen