Iptables forwarding für openvpn-Verbindung

min_server:~# route -n
Kernel IP Routentabelle
Ziel            Router          Genmask         Flags Metric Ref    Use Iface
217.0.119.59    *               255.255.255.255 UH    0      0        0 ppp0
80.xxx.xxx.41   *               255.255.255.255 UH    0      0        0 tun0
80.xxx.xxx.248  93.217.101.230  255.255.255.255 UGH   0      0        0 ppp0
192.168.xxx.0     *               255.255.255.224 U     0      0        0 eth0
default         80.xxx.xxx.41   0.0.0.0         UG    0      0        0 tun0

eth0      Protokoll:Ethernet  Hardware Adresse xx:xx:xx:xx:xx 
          inet Adresse:192.168.x.y  Bcast:192.168.x.31  Maske:255.255.255.224
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:94127491 errors:0 dropped:0 overruns:0 frame:0
          TX packets:75411629 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenlänge:1000 
          RX bytes:3882524601 (3.6 GiB)  TX bytes:3400403615 (3.1 GiB)

lo        Protokoll:Lokale Schleife  
          inet Adresse:127.0.0.1  Maske:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:248720 errors:0 dropped:0 overruns:0 frame:0
          TX packets:248720 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenlänge:0 
          RX bytes:63182485 (60.2 MiB)  TX bytes:63182485 (60.2 MiB)

ppp0      Protokoll:Punkt-zu-Punkt Verbindung  
          inet Adresse:93.217.101.230  P-z-P:217.0.119.59  Maske:255.255.255.255
          UP PUNKTZUPUNKT RUNNING NOARP MULTICAST  MTU:1492  Metric:1
          RX packets:52 errors:0 dropped:0 overruns:0 frame:0
          TX packets:48 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenlänge:3 
          RX bytes:11016 (10.7 KiB)  TX bytes:6711 (6.5 KiB)

tun0      Protokoll:UNSPEC  Hardware Adresse 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet Adresse:80.xxx.xxx.42  P-z-P:80.xxx.xxx.41  Maske:255.255.255.255
          UP PUNKTZUPUNKT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:42 errors:0 dropped:0 overruns:0 frame:0
          TX packets:38 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenlänge:100 
          RX bytes:7410 (7.2 KiB)  TX bytes:3590 (3.5 KiB)

#!/bin/sh
#
# Programs
IPT="/sbin/iptables"  

# Interfaces
INTIF="eth0"  
EXTIF="ppp0"  
OVPNIF="tun0"  

# Networks
LAN="192.168.x.0/27"  

# IP Adresses
INTIP=`ifconfig $INTIF | grep inet | cut -d : -f 2 | cut -d \  -f 1`
EXTIP=`ifconfig $EXTIF | grep inet | cut -d : -f 2 | cut -d \  -f 1`
OVPNIP=`ifconfig $OVPNIF | grep inet | cut -d : -f 2 | cut -d \  -f 1`

# Share internet connection?
SHARE="yes"  

# Do you run a Web server? Caution: ports for Tomcat are opened, too!
WEB="yes"  
WEBPUBLIC="yes"  
SPOINT="yes"  

# Set default chain policy
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP

# Flush all chains
$IPT -F
$IPT -X
$IPT -t nat -F PREROUTING
$IPT -t nat -F POSTROUTING

# Add custom chains
$IPT -N inet-in
$IPT -N inet-out
$IPT -N lan-in
$IPT -N lan-out
$IPT -N ip_reject

# Set egress-filtering-rules:
$IPT -A INPUT -i $EXTIF -s 127.0.0.0/8 -j DROP
$IPT -A INPUT -i $OVPNIF -s 127.0.0.0/8 -j DROP
$IPT -t nat -A PREROUTING -i $EXTIF -s 127.0.0.0/8 -j DROP
$IPT -A FORWARD -s 127.0.0.0/8 -j DROP
$IPT -A OUTPUT -s 127.0.0.1/8 -o $EXTIF -j LOG
$IPT -A OUTPUT -s 127.0.0.1/8 -o $EXTIF -j DROP
$IPT -A OUTPUT -o $EXTIF -d $EXTIP -j DROP

# Set basic INPUT rules
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -i $EXTIF -j inet-in
$IPT -A INPUT -i $OVPNIF -j inet-in
$IPT -A ip_reject -j DROP
$IPT -A INPUT -i $INTIF -s $LAN -j lan-in
$IPT -A INPUT -m state --state NEW,INVALID -j DROP
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Set FORWARD rules
if [ "$SHARE" = "yes" ]; then  
        modprobe ip_tables
        modprobe iptable_nat
        modprobe ip_conntrack_ftp
        $IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
        $IPT -A FORWARD -i $INTIF -s $LAN -m state --state NEW -j ACCEPT
        $IPT -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
        echo 1 > /proc/sys/net/ipv4/ip_forward
        echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
        $IPT -t nat -A POSTROUTING -o $EXTIF -s $LAN -j MASQUERADE
        $IPT -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP
        $IPT -t nat -A POSTROUTING -o $OVPNIF -s $LAN -j MASQUERADE
        $IPT -t nat -A POSTROUTING -o $OVPNIF -j SNAT --to $OVPNIP
fi

## Set basic OUTPUT rules
$IPT -A OUTPUT -o lo -j ACCEPT
$IPT -A OUTPUT -o $EXTIF -j inet-out
$IPT -A OUTPUT -o $OVPNIF -j inet-out
$IPT -A OUTPUT -o $INTIF -d $LAN -j lan-out
$IPT -A OUTPUT -m state --state NEW,INVALID -j DROP
$IPT -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

if [ "$WEB" = "yes" ]; then  
        $IPT -A lan-in -p tcp --dport 80 -j ACCEPT
        $IPT -A lan-out -p tcp --sport 80 -j ACCEPT
        if [ "$WEBPUBLIC" = "yes" ]; then  
       	$IPT -A inet-in -p tcp --dport 80 -j ACCEPT
	$IPT -A inet-out -p tcp --sport 80 -j ACCEPT
        fi
fi

if [ "$SPOINT" = "yes" ]; then  
	$IPT -A inet-in -p tcp --dport 443 -j ACCEPT
	$IPT -A inet-out -p tcp --sport 443 -j ACCEPT
	$IPT -A FORWARD -i $OVPNIF -p tcp --dport 443 -j ACCEPT
	$IPT -t nat -A PREROUTING -p tcp -i $OVPNIF --dport 443 -j DNAT --to-destination 192.168.a.b:443
fi