# Accept any packet being forwarded from eth0->tun1, from 172.0.0.x, which is
# initiating a new outbound connection.
$ iptables -A FORWARD -i eth0 -o tun1 -s 172.0.0.0/24 -m
  conntrack --ctstate NEW -j ACCEPT

# Accept any forwarded packet that's part of a connection that we already
# set up during the rule above.
$ iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Make all outbound packets use this router's IP as the source address.
$ iptables -A POSTROUTING -t nat -j MASQUERADE