How to prevent VPN clients from accessing the Internet, leaving access only to a given ip (or domain)?

Question

openvpn

Hello, I have a router with custom firmware and a built-in openvpn server. How to restrict access to vpn clients using iptables, blocking all connections, leaving access to only one site?

Answer 1

Assuming that tun0 is the interface for vpn clients and eth0 is the internet, we can start with the following rules.

iptables -P FORWARD DROP
iptables -A FORWARD -i tun0 -o eth0 -m state --state RELATED,ESTABLISHED -m comment --comment "РАЗРЕШЕНО Установленные соединения" -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -p udp -m udp --dport 53 -m comment --comment "РАЗРЕШЕНО DNS/udp" -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -d yandex.ru -m conntrack --ctstate NEW -m comment --comment "РАЗРЕШЕНО Доступ к Яндексу" -j ACCEPT

I would recommend making rules 2 and 3 general, without being tied to an interface, but not knowing what you have limited to input (tun0) and output (eyh0) interfaces.