Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I found this after googling:

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT #allow loopback access
iptables -A OUTPUT -d 255.255.255.255 -j ACCEPT #make sure you can communicate with any DHCP server
iptables -A INPUT -s 255.255.255.255 -j ACCEPT #make sure you can communicate with any DHCP server
iptables -A INPUT -s 192.168.0.0/16 -d 192.168.0.0/16 -j ACCEPT #make sure that you can communicate within your own network
iptables -A OUTPUT -s 192.168.0.0/16 -d 192.168.0.0/16 -j ACCEPT
iptables -A FORWARD -i eth+ -o tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -o eth+ -j ACCEPT # make sure that eth+ and tun+ can communicate
iptables -t nat -A POSTROUTING -o tun+ -j MASQUERADE # in the POSTROUTING chain of the NAT table, map the tun+ interface outgoing packet IP address, cease examining rules and let the header be modified, so that we don't have to worry about ports or any other issue - please check this rule with care if you have already a NAT table in your chain
iptables -A OUTPUT -o eth+ ! -d a.b.c.d -j DROP # if destination for outgoing packet on eth+ is NOT a.b.c.d, drop the packet, so that nothing leaks if VPN disconnects

Edited: I add the following to make it easier for forum members to contribute their ideas

Here's what I did:

A. As I am using Ubuntu 12.04 LTS, I installed iptables-persistent.

B. I issued the command

sudo gedit /etc/iptables/rules.v4

and replace the default in it with the following:

*filter
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT #allow loopback access
-A OUTPUT -d 255.255.255.255 -j ACCEPT #make sure you can communicate with any DHCP server
-A INPUT -s 255.255.255.255 -j ACCEPT #make sure you can communicate with any DHCP server
-A INPUT -s 192.168.0.0/16 -d 192.168.0.0/16 -j ACCEPT #make sure that you can communicate within your own network
-A OUTPUT -s 192.168.0.0/16 -d 192.168.0.0/16 -j ACCEPT
-A FORWARD -i eth+ -o tun+ -j ACCEPT
-A FORWARD -i tun+ -o eth+ -j ACCEPT # make sure that eth+ and tun+ can communicate
-t nat -A POSTROUTING -o tun+ -j MASQUERADE # in the POSTROUTING chain of the NAT table, map the tun+ interface outgoing packet IP address, cease examining rules and let the header be modified, so that we don't have to worry about ports or any other issue - please check this rule with care if you have already a NAT table in your chain
-A OUTPUT -o eth+ ! -d 111.222.333.444 -j DROP # if destination for outgoing packet on eth+ is NOT a.b.c.d, drop the packet, so that nothing leaks if VPN disconnects
COMMIT

C. I save the changes to /etc/iptables/rules.v4 and reboot the computer. Note that 111.222.333.444 is an example of an IP address of the VPN server located in XYZ country

D. Upon reboot, I am unable to connect to the VPN server. Something is wrong with the contents of rules.v4

Any help is welcome

share|improve this question
2  
Hi & Welcome to AU. It will be great if you could explain more in-detail as what you're trying to achieve using iptables despite just posting the iptables rules. :) –  AzkerM Apr 26 at 13:18
    
@AzkerM: The iptables rules are to control internet traffic flow when using a vpn. If vpn suddenly drops, internet access is cut off immediately. By doing this, there is no leak of real IP address. Do I need to make a executable out of the iptables rules? Into which folder should I put them? –  user274541 Apr 26 at 19:34
    
See the Ubuntu docs for info on how to use IPtables: help.ubuntu.com/community/IptablesHowTo –  Nattgew Apr 28 at 19:01
    
@Nattgew: Thanks for the URL. But as with most Linux guides, they contain everything except a real-world scenario/example. The guide referenced by your URL ought to provide a real-world example. –  user274541 May 1 at 14:24
    
See the logging section of the guide, set up some logging to see what is being dropped: help.ubuntu.com/community/IptablesHowTo#More_detailed_Logging –  Nattgew May 1 at 14:56
show 7 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.