# OpenVPN's iptables rules

# Main forward rules + LAN access

iptables -I INPUT -i tun+ -j ACCEPT;

iptables -I FORWARD -i tun+ -j ACCEPT;

iptables -I OUTPUT -o tun+ -j ACCEPT;

iptables -I FORWARD -o tun+ -j ACCEPT;

# Allow traffic initiated from VPN to access LAN
iptables -I FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -d 172.12.0.0/24 -m conntrack --ctstate NEW -j ACCEPT;

# Allow traffic initiated from VPN to access "the world"
iptables -I FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT;

# Allow established traffic to pass back and forth
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT;

# Masquerade traffic from VPN to "the world" -- done in the nat table
iptables -t nat -I POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE;

# Masquerade traffic from LAN to "the world"
iptables -t nat -I POSTROUTING -o eth0 -s 172.12.0.0/24 -j MASQUERADE;

# int_switch's network

# Allow traffic initiated from VPN to access "int_switch"
iptables -I FORWARD -i tun0 -o eth1 -s 10.8.0.0/24 -d 10.0.1.0/24 -m conntrack --ctstate NEW -j ACCEPT;

# Allow traffic initiated from VPN through "int_switch" to access "the world"
iptables -I FORWARD -i tun0 -o eth1 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT;


# Masquerade traffic from VPN through "int_switch" to "the world"
iptables -t nat -I POSTROUTING -o eth1 -s 10.8.0.0/24 -j MASQUERADE;

# Masquerade traffic from "int_switch" to "the world"
iptables -t nat -I POSTROUTING -o eth1 -s 10.0.1.0/24 -j MASQUERADE;

# lif1_nfs's network

# Allow traffic initiated from VPN to access "lif1_nfs"
iptables -I FORWARD -i tun0 -o eth2 -s 10.8.0.0/24 -d 10.0.2.0/24 -m conntrack --ctstate NEW -j ACCEPT;

# Allow traffic initiated from VPN through "lif1_nfs" to access "the world"
iptables -I FORWARD -i tun0 -o eth2 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT;

# Masquerade traffic from VPN through "lif1_nfs" to "the world"
iptables -t nat -I POSTROUTING -o eth2 -s 10.8.0.0/24 -j MASQUERADE;

# Masquerade traffic from "lif1_nfs" to "the world"
iptables -t nat -I POSTROUTING -o eth2 -s 10.0.2.0/24 -j MASQUERADE;
# End OpenVPN