iptables: Create OVPNNAT chain after CUSTOM* chains.

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index 1cbca2db8508a4560aef37fb2e3bb7238921ccd2..cc6bebb1db6b95154b6913aa43247c0301075020 100644 (file)
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -90,11 +90,9 @@ iptables_init() {
        /sbin/iptables -N OUTGOINGFW
        /sbin/iptables -A OUTPUT -j OUTGOINGFW
        /sbin/iptables -t nat -N CUSTOMPREROUTING
-       /sbin/iptables -t nat -N OVPNNAT
        /sbin/iptables -t nat -A PREROUTING -j CUSTOMPREROUTING
        /sbin/iptables -t nat -N CUSTOMPOSTROUTING
        /sbin/iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING
-       /sbin/iptables -t nat -A POSTROUTING -j OVPNNAT
 
        # Guardian (IPS) chains
        /sbin/iptables -N GUARDIAN
@@ -107,6 +105,10 @@ iptables_init() {
                /sbin/iptables -A ${i} -j OVPNBLOCK
        done
 
+       # OpenVPN transfer network translation
+       /sbin/iptables -t nat -N OVPNNAT
+       /sbin/iptables -t nat -A POSTROUTING -j OVPNNAT
+
        # IPTV chains for IGMPPROXY
        /sbin/iptables -N IPTVINPUT
        /sbin/iptables -A INPUT -j IPTVINPUT