openvpn iptable

#! /bin/bash
# Niftiest Software – www.niftiestsoftware.com
# Modified version by HTPC Guides – www.htpcguides.com

export INTERFACE="tun0"
export VPNUSER="vpnuser"
export LOCALIP="192.168.0.8"
export NETIF="enp3s0"

# flushes all the iptables rules, if you have other rules to use then add them into the script
iptables -F -t nat
iptables -F -t mangle
iptables -F -t filter

# mark packets from $VPNUSER
iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
iptables -t mangle -A OUTPUT ! --dest $LOCALIP -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT --dest $LOCALIP -p udp --dport 53 -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT --dest $LOCALIP -p tcp --dport 53 -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT ! --src $LOCALIP -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT -j CONNMARK --save-mark

# allow responses
iptables -A INPUT -i $INTERFACE -m conntrack --ctstate ESTABLISHED -j ACCEPT

# block everything incoming on $INTERFACE to prevent accidental exposing of ports
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -i $INTERFACE -p icmp --icmp-type 8 -j ACCEPT
iptables -A INPUT -i $INTERFACE -p tcp --dport 58846 -j ACCEPT
iptables -A INPUT -i $INTERFACE -p udp --dport 58846 -j ACCEPT
iptables -t nat -A PREROUTING -i $INTERFACE -p tcp --dport 58846 -j DNAT --to 127.0.0.1:58846
iptables -t nat -A PREROUTING -i $INTERFACE -p udp --dport 58846 -j DNAT --to 127.0.0.1:58846
#iptables -t nat -A PREROUTING -i $NETIF -p udp --dport 58846 -j DNAT --to 127.0.0.1:58846
iptables -t nat -A PREROUTING -i $NETIF -p tcp -m tcp --dport 58846 -j DNAT --to 127.0.0.1:58846
iptables -t nat -A PREROUTING -i $NETIF -p udp -m udp --dport 58846 -j DNAT --to 127.0.0.1:58846

iptables -A FORWARD -i $NETIF -o lo -p tcp -m tcp -d 127.0.0.1 --dport 58846 -j ACCEPT
iptables -A FORWARD -i $NETIF -o lo -p udp -m udp -d 127.0.0.1 --dport 58846 -j ACCEPT
#iptables -A INPUT -i $INTERFACE -j REJECT

# let $VPNUSER access lo and $INTERFACE
iptables -A OUTPUT -o lo -m owner --uid-owner $VPNUSER -j ACCEPT
iptables -A OUTPUT -o $INTERFACE -m owner --uid-owner $VPNUSER -j ACCEPT
# all packets on $INTERFACE needs to be masqueraded
iptables -t nat -A POSTROUTING -o $INTERFACE -j MASQUERADE

# reject connections from predator IP going over $NETIF
iptables -A OUTPUT ! --src $LOCALIP -o $NETIF -j REJECT


# Start routing script
/etc/openvpn/routing.sh
service docker restart
exit 0