我想阻止eth0传入stream量，22,80,443的例外，并允许tun0上的所有传入stream量。
我有openvpn客户端configuration与route-nopull和我添加路由从route add -net 10.8.0.0/24 dev tun0和服务器上我有client-to-client并指定静态ips与client-config-dir
我发现ufw搞乱了我的configuration，所以我想用传统的iptables规则。 根据以下规则，除了我在互联网上广泛开放以外，一切都按需要运作。
-P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N f2b-sshd -A INPUT -i tun0 -m conntrack --ctstate ESTABLISHED -j ACCEPT -A INPUT -i tun0 -m conntrack --ctstate ESTABLISHED -j ACCEPT -A INPUT -i tun0 -m conntrack --ctstate ESTABLISHED -j ACCEPT -A OUTPUT -o lo -m owner --uid-owner 1001 -j ACCEPT -A OUTPUT -o tun0 -m owner --uid-owner 1001 -j ACCEPT -A OUTPUT ! -s EXTERNALIP/32 -o enp0s20f0 -j REJECT --reject-with icmp-port-unreachable -A OUTPUT -o lo -m owner --uid-owner 1002 -j ACCEPT -A OUTPUT -o tun0 -m owner --uid-owner 1002 -j ACCEPT -A OUTPUT ! -s EXTERNALIP/32 -o enp0s20f0 -j REJECT --reject-with icmp-port-unreachable -A OUTPUT -o lo -m owner --uid-owner 1003 -j ACCEPT -A OUTPUT -o tun0 -m owner --uid-owner 1003 -j ACCEPT -A OUTPUT ! -s EXTERNALIP/32 -o enp0s20f0 -j REJECT --reject-with icmp-port-unreachable
当我尝试用下面的命令来解决这个问题时，我不能再连接到1194.我仍然可以通过eth0连接到ssh和http。
-A INPUT -p tcp -m multiport --dports 22,80,443 -j ACCEPT -A OUTPUT -p tcp -m multiport --sports 22,80,443 -j ACCEPT -A INPUT -p udp -m state --state NEW,ESTABLISHED --dport 1194 -j ACCEPT -A OUTPUT -p udp -m state --state ESTABLISHED --sport 1194 -j ACCEPT -A INPUT -i tun0 -j ACCEPT -A OUTPUT -o tun0 -j ACCEPT -A INPUT -i eth0 -j DROP
具体来说，一切工作，直到我添加最后一行…
我想出了使用这个configuration的答案：
-P INPUT DROP -P FORWARD ACCEPT -P OUTPUT ACCEPT -N f2b-sshd -A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd -A INPUT -i tun0 -m conntrack --ctstate ESTABLISHED -j ACCEPT -A INPUT -m pkttype --pkt-type broadcast -m comment --comment "Block Broadcast INPUT (No log)" -j DROP -A INPUT -m pkttype --pkt-type multicast -m comment --comment "Block Multicast INPUT (No Log)" -j DROP -A INPUT -i lo -m comment --comment "Accept localhost Input" -j ACCEPT -A INPUT -p udp -m udp --sport 1194 -m state --state ESTABLISHED -m comment --comment "Allow the server to reply (related to lport)" -j ACCEPT -A INPUT -p tcp -m multiport --dports 22,80,443 -j ACCEPT -A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -s 8.8.8.8/32 -p udp -m udp --sport 53 -m state --state ESTABLISHED -m comment --comment "Allow the DNS1 to answer" -j ACCEPT -A INPUT -s 8.8.4.4/32 -p udp -m udp --sport 53 -m state --state ESTABLISHED -m comment --comment "Allow the DNS2 to answer" -j ACCEPT -A INPUT -m limit --limit 10/min -m comment --comment "Log Input" -j LOG --log-prefix "FW DROP INPUT: " --log-level 7 -A INPUT -i tun+ -m comment --comment "Accept TUN Input" -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -m limit --limit 10/min -m comment --comment "Log Forward" -j LOG --log-prefix "FW DROP FORWARD: " --log-level 7 -A OUTPUT -o lo -m owner --uid-owner 1001 -j ACCEPT -A OUTPUT -o tun0 -m owner --uid-owner 1001 -j ACCEPT -A OUTPUT ! -s $EXTERNALIP -o $EXT_INT -j REJECT --reject-with icmp-port-unreachable -A OUTPUT -o lo -m owner --uid-owner 1002 -j ACCEPT -A OUTPUT -o tun0 -m owner --uid-owner 1002 -j ACCEPT -A OUTPUT ! -s $EXTERNALIP/32 -o $EXT_INT -j REJECT --reject-with icmp-port-unreachable -A OUTPUT -o lo -m owner --uid-owner 1003 -j ACCEPT -A OUTPUT -o tun0 -m owner --uid-owner 1003 -j ACCEPT -A OUTPUT ! -s $EXTERNALIP/32 -o $EXT_INT -j REJECT --reject-with icmp-port-unreachable -A OUTPUT -o lo -m comment --comment "Accept localhost Output" -j ACCEPT -A OUTPUT -p udp -m udp --dport 1194 -m comment --comment "Allow my computer to query the DNS server" -j ACCEPT -A OUTPUT -p tcp -m multiport --sports 22,80,443 -j ACCEPT -A OUTPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT -A OUTPUT -o $EXT_INT -p tcp -m multiport --dports 80,443 -m state --state NEW -j ACCEPT -A OUTPUT -o $EXT_INT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT -A OUTPUT -o lo -j ACCEPT -A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT -A OUTPUT -d 8.8.8.8/32 -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -m comment --comment "Allow my machine to connect to the DNS1" -j ACCEPT -A OUTPUT -d 8.8.4.4/32 -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -m comment --comment "Allow my machine to connect to the DNS2" -j ACCEPT -A OUTPUT -m limit --limit 10/min -m comment --comment "Log Output" -j LOG --log-prefix "FW DROP OUTPUT: " --log-level 7 -A OUTPUT -p icmp -m icmp --icmp-type 0 -m state --state RELATED,ESTABLISHED -m comment --comment "Allow ping to Outside" -j ACCEPT -A OUTPUT -o tun+ -m comment --comment "Accept TUN Output" -j ACCEPT -A f2b-sshd -j RETURN