henningdalgaard wroteokay, so I managed to delete the line and I am back on track but still not there yet 🙂
My iptables now looks like this:
iptables -I INPUT 1 -p tcp –dport 1194 -j ACCEPT
iptables -I FORWARD 1 –source 10.8.0.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o br0 -j MASQUERADE
However, when I test the connection (I connect to my phone's wifi hotspot to test the VPN) I still see my phones IP when I go to myip.com. I am guessing that I should be seeing an ip from the vpn server if my brother is to use my connection to access Danish content?
I did something similar, but then for belgian TV ;-).
Anyway:
i'll explain the iptable rules you have right now:
1. iptables -I INPUT 1 -p tcp –dport 1194 -j ACCEPT
This rule makes sure that your openvpn server is reachable from the internet
2. iptables -I FORWARD 1 –source 10.8.0.0/24 -j ACCEPT
This rule allows traffic from the vpn network to be forwarded by default
3. iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o br0 -j MASQUERADE
This is the most difficult one: this will change traffic coming from 10.8.0.x to the ip of your danish provider. But there are some mistakes:
br0 is your internet network bridge. this bridge makes one network from for instance your wireless + your wired interfaces. Those are separate devices and this bridge (hence the name br0) makes that into one big network. This is your internal net.
What should happen is that traffic from 10.8.0.x should change into your external network from your provider.
if you run the command
ifconfig
in your router you will see the output of all the interfaces and their names.
as I'm not sure what your external interface is i'll have to guess so please double check the correct interface before you copy and paste the things below:
# Allow connections to the openvpn server
iptables -I INPUT 1 -p tcp –dport 1194 -j ACCEPT
# Allow traffic from the tunnel
iptables -I INPUT -i tun0 -j ACCEPT
# Allow traffic from the local network to the tunnel and vice-versa
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
# Allow traffic from the tunnel interface to your internet (vlan2 is what you need to double-check, look at the output of ifconfig and use the interface name of your external net. If you cannot find it, just copy and paste the output of the command here, i'll help you further from there)
iptables -I FORWARD -i tun0 -o vlan2 -j ACCEPT
# hide (masq) the traffic from the tunnel from your provider
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o vlan2 -j MASQUERADE
Then to finish off: add the following to your openvpn client config:
redirect-gateway def1
This will make sure everything your brother sends (to anywhere in the world) is being sent over the tunnel to your router. From that point your router will decide what to do with it. Either send it over the internet to the provider or send it to your local network device (for example a printer).
This will send all traffic! so also traffic to the USA... So: if your brother visits a website in the USA the traffic will first to your home in denmark and afterwards will be sent to the USA again over the internet.
A better solution would be to find out which network should be accessed from your home (which ip's) and afterwards only send that traffic over the tunnel. But that is a bit more complicated ;-).
