OpenVPN Gateway IPtables (Default Deny Policy)

vpn.iptables.rules

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i tun+ -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp --dport 22 -s 192.168.0.0/24 -j ACCEPT #SSH ONLY FROM LOCAL NET
-A INPUT -p udp --dport 53 -j ACCEPT #DNS
-A INPUT -p udp --dport 68 -j ACCEPT #DHCP
-A INPUT -p udp --dport 123 -j ACCEPT #NTP
-A INPUT -p udp --dport 1194 -j ACCEPT #VPN
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT #PING
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -o tun+ -j ACCEPT
-A OUTPUT -o tun+ -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp --sport 22 -d 192.168.0.0/24 -j ACCEPT
-A OUTPUT -p udp --sport 68 -j ACCEPT
-A OUTPUT -p udp --sport 123 -j ACCEPT
-A OUTPUT -p udp --sport 1194 -j ACCEPT
-A OUTPUT -p udp --sport 1024:65535 -j ACCEPT
-A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o tun+ -j MASQUERADE
COMMIT