Hello friends,
I have some small trouble with iptables. I configured OpenVPN as internet gateway. So far everything is working fine! Now I tried to add a ruleset to force all internet traffic through tap0. On the local machine it ist already working, but not for the client which are forwarded. When I stop the openvpn daemon, the clients go with the public IP from my ISP in internet again. I want to prevent this. Here is are my iptables-rules:
# Generated by iptables-save v1.4.14 on Tue May 21 22:41:01 2013
*nat
:PREROUTING ACCEPT [30:5973]
:INPUT ACCEPT [30:5973]
:OUTPUT ACCEPT [56:6253]
:POSTROUTING ACCEPT [38:3741]
-A POSTROUTING -o tap+ -j MASQUERADE
COMMIT
# Completed on Tue May 21 22:41:01 2013
# Generated by iptables-save v1.4.14 on Tue May 21 22:41:01 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i tap+ -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -s vpn.provider.tld -j ACCEPT
-A INPUT -s 192.168.1.0/24 -j ACCEPT
-A INPUT -j DROP
-A OUTPUT -o tap+ -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -d vpn.provider.tld -j ACCEPT
-A OUTPUT -d 192.168.1.0/24 -j ACCEPT
-A OUTPUT -j DROP
COMMIT
# Completed on Tue May 21 22:41:01 2013
Kind regards,
Philipp Speck
