##########
# FILTER #
##########
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

#########
# INPUT #
#########
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT

# SSH
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
# HTTP
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
# HTTPS
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
# OpenVPN
-A INPUT -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 1194 -j ACCEPT
# More OpenVPN ports
#-A INPUT -p udp -m state --state NEW -m udp --dport 1194:1197 -j ACCEPT
#-A INPUT -p tcp -m state --state NEW -m tcp --dport 1194:1197 -j ACCEPT
# Local DNS for VPN clients
#-A INPUT -s 10.0.0.0/8 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
#-A INPUT -s 10.0.0.0/8 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited

###########
# FORWARD #
###########
-A FORWARD -i tun+ ! -o tun+ -j ACCEPT
-A FORWARD ! -i tun+ -o tun+ -j ACCEPT

# Be more specific through which interfaces routing is allowed
#-A FORWARD -i tun+ -o eth0 -j ACCEPT
#-A FORWARD -i eth0 -o tun+ -j ACCEPT

# Do not allow VPN clients to be contacted from the outside
#-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
#-A FORWARD -i tun+ -o eth0 -j ACCEPT

-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

#######
# NAT #
#######
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

-A POSTROUTING -s 10.0.0.0/8 -j MASQUERADE
#-A POSTROUTING -s 10.0.0.0/8 -j SNAT --to-source 192.0.2.1
# Distribute NAT over IPs between 192.0.2.1 and 192.0.2.8 (inclusive)
#-A POSTROUTING -s 10.0.0.0/8 -j SNAT --to-source 192.0.2.1-192.0.2.8
COMMIT