# Block OpenVPN transfer networks
iptables -N OVPNBLOCK
iptables -A INPUT -i tun+ -j OVPNBLOCK
- iptables -A OUTPUT -o tun+ -j OVPNBLOCK
iptables -A FORWARD -i tun+ -j OVPNBLOCK
iptables -A FORWARD -o tun+ -j OVPNBLOCK
# DNAT rules
iptables -t nat -N NAT_DESTINATION
iptables -t nat -A PREROUTING -j NAT_DESTINATION
+ iptables -t nat -A OUTPUT -j NAT_DESTINATION
iptables -t mangle -N NAT_DESTINATION
iptables -t mangle -A PREROUTING -j NAT_DESTINATION
iptables -t nat -N REDNAT
iptables -t nat -A POSTROUTING -j REDNAT
+ # Filter logging of incoming broadcasts.
+ iptables -N BROADCAST_FILTER
+ iptables -A INPUT -j BROADCAST_FILTER
+
+ iptables -A BROADCAST_FILTER -i "${GREEN_DEV}" -d "${GREEN_BROADCAST}" -j DROP
+
+ if [ -n "${BLUE_DEV}" -a -n "${BLUE_BROADCAST}" ]; then
+ iptables -A BROADCAST_FILTER -i "${BLUE_DEV}" -d "${BLUE_BROADCAST}" -j DROP
+ fi
+
+ if [ -n "${ORANGE_DEV}" -a -n "${ORANGE_BROADCAST}" ]; then
+ iptables -A BROADCAST_FILTER -i "${ORANGE_DEV}" -d "${ORANGE_BROADCAST}" -j DROP
+ fi
+
# Apply OpenVPN firewall rules
/usr/local/bin/openvpnctrl --firewall-rules
# Outgoing masquerading (don't masqerade IPSEC (mark 50))
iptables -t nat -A REDNAT -m mark --mark 50 -o $IFACE -j RETURN
- iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE
+
+ if [ "$IFACE" != "$GREEN_DEV" ]; then
+ iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE
+ fi
fi