daledellutri
I use the following iptables command to set up MASQUERADE:
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
but would the same work if I use -i (in interface) instead of -s?
iptables -t nat -A POSTROUTING -i tun0 -o eth0 -j MASQUERADE
I bought the book OpenVPN 2 Cookbook that there are examples
where it uses both -i and -s. Isn't one or the other sufficient?
If I use just -i, should that work? After all, isn't the OpenVPN traffic
the only thing on tun0?
I don't have a machine that I can test this on. I really can't play
with my active OpenVPN machine.
Olipro
No, it won't work because it's not possible to match on the incoming interface in the POSTROUTING chain; any example that shows usage of -i is erroneous, it's not possible.
if you *must* match by incoming interface, I suggest applying a packet mark in mangle/PREROUTING
