I'm trying to setup iptables rules, so that an openvpn server will only allow access to certain VPC subnets, if the client is in a particular subnet.
I'm defining the rules like so..
iptables -A FORWARD -d 10.141.0.0/18 -j ACCEPTiptables -A FORWARD -s 10.7.0.0/24 -d 10.140.0.0/18 -j ACCEPT
SO essentially I want to allow access to 10.141.0.0/18 for all vpn users, but only allow access to 10.140.0.0/18 for clients in the 10.7.0.0/24 subnet.
I can see that these rules are matching, because when I run the following command...
iptables -L -v
it shows data for the rules that I'm expecting to be used.
Now I want to make sure that if the rules don't match, then the request is dropped, I'm trying to do this with the following command.
iptables -P FORWARD DROP
However after I run this, it just drops all FORWARD request. It ignores the previous rules.
Output from sudo iptables -S...
-P INPUT ACCEPT-P FORWARD DROP-P OUTPUT ACCEPT-A FORWARD -d 10.141.0.0/18 -j ACCEPT-A FORWARD -s 10.7.0.0/24 -d 10.140.0.0/18 -j ACCEPT
Can someone please suggest what might be wrong with this?