How to filter traffic if client-to-client directive enabled?

jefftan7729

Hi,
My server config:

port 1194
proto udp
dev tap
dev-node 1194
ca ca.crt
cert server.crt
key server.key  
dh dh1024.pem
server 10.0.0.0 255.255.0.0
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

My client config:

client
dev tap
dev-node MYTAP
proto udp
remote myvpnserver.com 1194
remote-random
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert CLIENT.crt
key CLIENT.key
ns-cert-type server
verb 3

Goal:
To filter traffic between clients.
Iptables was enabled on server, however i noticed the rules aren't filtering the traffic.
Thanks!

jefftan7729

Hi debbie10t,
Thanks for reply.
These are the rules that i applied:
iptables -P INPUT DROP
iptables -A INPUT -i em1 -p TCP --dport 22 -j ACCEPT
iptables -A INPUT -i em1 -p TCP --dport 1194 -j ACCEPT
iptables -A INPUT -i tap0 -p TCP --dport 67:68 -j DROP
iptables -A INPUT -i tap0 -p icmp -j DROP

iptables -P FORWARD DROP
iptables -A FORWARD -p TCP --dport 67:68 -j DROP
iptables -A FORWARD -p icmp -j DROP

iptables -P OUTPUT DROP
iptables -A OUTPUT -o tap0 -p TCP --dport 67:68 -j DROP
iptables -A OUTPUT -o tap0 -p icmp -j DROP

Note: em1 = my NIC with public IP
tap0 = VPN tunnel
I still able to ping my client to client.

jefftan7729

anyone can shed some lights one this...? 🙁

jefftan7729

debbie10t wroteTry saving then flushing your iptables. If you can connect you know your firewall rules are incorrect.

Hi debbie10t,
yes, i saved, flushed and restarted the service.
command i used:
iptables -F
apply the rules
service iptables save
service iptables restart

still dont have luck in filtering traffic between clients...