Iptables or UFW | Configuring OpenVPN Server?

Question

linux

Good evening.
There is a VPS server with Ubuntu on EC2 Amazon. I'm setting up an OpenVPN server. I found a very good tutorial for the current version of OpenVPN with Easy-rsa 3, but it has UFW. Did the basic setup well. I can’t figure out how to set up a firewall, on some articles they write a config under iptables on others under UFW. I myself want the standard iptables more.
I would like to understand the following UFW configurations and rewrite them under iptables.

Rules in /etc/ufw/before.rules

# START OPENVPN RULES
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0] 
# Allow traffic from OpenVPN client to eth0
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
COMMIT
# END OPENVPN RULES

In the file /etc/default/ufw
DEFAULT_FORWARD_POLICY="ACCEPT"

More commands for UFW

$ sudo ufw allow 1194/udp
$ sudo ufw allow OpenSSH

For clarity, I will cite the iptables setting from another article

iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Here are other settings under iptables

iptables -A FORWARD -s 10.128.0.0/24 -j ACCEPT
iptables -A FORWARD -d 10.128.0.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.128.0.0/24 -j SNAT --to-source 123.45.67.89

Help who can.

Answer 1

Search keywords: "iptables gateway".
Option to forward traffic through the host:
echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
sysctl -p
To access the Internet, use SNAT instead of masquerading (but this is if you have a static external IPv4):
iptables -t nat -A POSTROUTING -o eth0 -s
10.8.0.0/24 -j SNAT --to-source 211.233.44.5 these must come first:
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A FORWARD -s 10.8.0.0 /24 -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
Allow 1194/udp, SSH:
iptables -I INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
iptables -I INPUT -p udp -m udp --dport 1194 -j ACCEPT Block
all the rest:
iptables -P INPUT DROP
iptables -P FORWARD DROP