thanks for replay
Traffic!
here is my iptables config:
echo "# Define variables"
IPT=/sbin/iptables
LOCAL_IFACE=eth0
WD_IP=192.168.2.2
INET_IFACE=wlan0
INET_ADDRESS=192.168.3.199
BASNET="192.168.3.0/24"
DNS=8.8.8.8,8.8.4.4
echo "# Flush the tables"
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -F INPUT
$IPT -F OUTPUT
$IPT -F FORWARD
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP
echo "# Set access for localhost"
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
echo "# Allow everything from and to eth0"
$IPT -A INPUT -i eth0 -j ACCEPT
$IPT -A OUTPUT -o eth0 -j ACCEPT
echo "# Allow related traffic"
$IPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
echo " Allow outgoing ping"
$IPT -A OUTPUT -p icmp --icmp-type 8 -s $INET_ADDRESS -d 0/0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
echo "Allow browsing internet and FTP from server"
/sbin/modprobe -i ip_conntrack_ftp
$IPT -A OUTPUT -o wlan0 -p tcp -m multiport --dports 80,443 -j ACCEPT
echo "# Block BASNET"
$IPT -A INPUT -i wlan0 -s $BASNET -j DROP
echo "# Allow out DNS"
$IPT -A OUTPUT -p udp --dport 53 -j ACCEPT
echo "# Allow forwarding packets:"
$IPT -A FORWARD -p ALL -i $LOCAL_IFACE -o $INET_IFACE -j ACCEPT
echo "# Packet masquerading"
$IPT -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_ADDRESS
echo "# Logging"
$IPT -N LOGNDROP
$IPT -A INPUT -j LOGNDROP
$IPT -A LOGNDROP -p tcp -m limit --limit 5/min -j LOG --log-prefix "ipt TCP: " --log-level 7
$IPT -A LOGNDROP -p udp -m limit --limit 5/min -j LOG --log-prefix "ipt UDP: " --log-level 7
$IPT -A LOGNDROP -p icmp -m limit --limit 5/min -j LOG --log-prefix "ipt ICMP: " --log-level 7
$IPT -A LOGNDROP -j DROP
and here's my client.conf
client
dev tun
proto udp
remote vpn.myvnc.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/config/riga/ca.crt
cert /etc/openvpn/config/riga/client.crt
key /etc/openvpn/config/riga/client.key
cipher BF-CBC
auth none
comp-lzo
verb 3
I red HOWTO, but I am not so good in iptables, I can't figure out how to apply it to my custom configuration.
