IPTables Configuration Not Affecting Traffic

[AussieKlutz]

Hi Guys,

I'm creating a OpenVPN tunnel to a vps from my Mark V.

Its working fine to access the Mark V from the vps, however I'm having some trouble getting the iptables to apply properly to allow internet traffic to be forwarded over the tunnel.

The iptables commands i'm using are:

iptables -t nat -A POSTROUTING -s 172.16.42.0/24 -o tun0 -j MASQUERADE
iptables -A FORWARD -s 172.16.42.0/24 -o tun0 -j ACCEPT
iptables -A FORWARD -d 172.16.42.0/24 -m state --state ESTABLISHED,RELATED -i tun0 -j ACCEPT

After I run the commands, then do an iptables-save, they show up but don't affect the traffic

# Generated by iptables-save v1.4.10 on Tue Nov 10 13:38:41 2015
*nat
:PREROUTING ACCEPT [117609:46924417]
:INPUT ACCEPT [76:7931]
:OUTPUT ACCEPT [383:28224]
:POSTROUTING ACCEPT [210:15594]
:delegate_postrouting - [0:0]
:delegate_prerouting - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_usb_rule - [0:0]
:postrouting_wan2_rule - [0:0]
:postrouting_wan_rule - [0:0]
:postrouting_wiredwan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_usb_rule - [0:0]
:prerouting_wan2_rule - [0:0]
:prerouting_wan_rule - [0:0]
:prerouting_wiredwan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_usb_postrouting - [0:0]
:zone_usb_prerouting - [0:0]
:zone_wan2_postrouting - [0:0]
:zone_wan2_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
:zone_wiredwan_postrouting - [0:0]
:zone_wiredwan_prerouting - [0:0]
-A PREROUTING -j delegate_prerouting 
-A POSTROUTING -s 172.16.42.0/24 -o tun0 -j MASQUERADE 
-A POSTROUTING -s 172.16.42.0/24 -o 3g-wan2 -j MASQUERADE 
-A POSTROUTING -j delegate_postrouting 
-A delegate_postrouting -m comment --comment "user chain for postrouting" -j postrouting_rule 
-A delegate_postrouting -o br-lan -j zone_lan_postrouting 
-A delegate_postrouting -o wlan1 -j zone_wan_postrouting 
-A delegate_postrouting -o usb0 -j zone_usb_postrouting 
-A delegate_postrouting -o   -j zone_wan2_postrouting 
-A delegate_prerouting -m comment --comment "user chain for prerouting" -j prerouting_rule 
-A delegate_prerouting -i br-lan -j zone_lan_prerouting 
-A delegate_prerouting -i wlan1 -j zone_wan_prerouting 
-A delegate_prerouting -i usb0 -j zone_usb_prerouting 
-A delegate_prerouting -i   -j zone_wan2_prerouting 
-A zone_lan_postrouting -m comment --comment "user chain for postrouting" -j postrouting_lan_rule 
-A zone_lan_prerouting -m comment --comment "user chain for prerouting" -j prerouting_lan_rule 
-A zone_usb_postrouting -m comment --comment "user chain for postrouting" -j postrouting_usb_rule 
-A zone_usb_postrouting -j MASQUERADE 
-A zone_usb_prerouting -m comment --comment "user chain for prerouting" -j prerouting_usb_rule 
-A zone_wan2_postrouting -m comment --comment "user chain for postrouting" -j postrouting_wan2_rule 
-A zone_wan2_postrouting -j MASQUERADE 
-A zone_wan2_prerouting -m comment --comment "user chain for prerouting" -j prerouting_wan2_rule 
-A zone_wan_postrouting -m comment --comment "user chain for postrouting" -j postrouting_wan_rule 
-A zone_wan_postrouting -j MASQUERADE 
-A zone_wan_prerouting -m comment --comment "user chain for prerouting" -j prerouting_wan_rule 
-A zone_wiredwan_postrouting -m comment --comment "user chain for postrouting" -j postrouting_wiredwan_rule 
-A zone_wiredwan_postrouting -j MASQUERADE 
-A zone_wiredwan_prerouting -m comment --comment "user chain for prerouting" -j prerouting_wiredwan_rule 
COMMIT
# Completed on Tue Nov 10 13:38:41 2015
# Generated by iptables-save v1.4.10 on Tue Nov 10 13:38:41 2015
*raw
:PREROUTING ACCEPT [123507:48622371]
:OUTPUT ACCEPT [3432:2747296]
:notrack - [0:0]
-A PREROUTING -j notrack 
COMMIT
# Completed on Tue Nov 10 13:38:41 2015
# Generated by iptables-save v1.4.10 on Tue Nov 10 13:38:41 2015
*mangle
:PREROUTING ACCEPT [123507:48622371]
:INPUT ACCEPT [3376:569065]
:FORWARD ACCEPT [2716:1150203]
:OUTPUT ACCEPT [3432:2747296]
:POSTROUTING ACCEPT [6148:3897499]
:fwmark - [0:0]
:mssfix - [0:0]
-A PREROUTING -j fwmark 
-A FORWARD -j mssfix 
-A mssfix -o wlan1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "wan (mtu_fix)" -j TCPMSS --clamp-mss-to-pmtu 
-A mssfix -o usb0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "usb (mtu_fix)" -j TCPMSS --clamp-mss-to-pmtu 
-A mssfix -o   -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "wan2 (mtu_fix)" -j TCPMSS --clamp-mss-to-pmtu 
COMMIT
# Completed on Tue Nov 10 13:38:41 2015
# Generated by iptables-save v1.4.10 on Tue Nov 10 13:38:41 2015
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:delegate_forward - [0:0]
:delegate_input - [0:0]
:delegate_output - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_usb_rule - [0:0]
:forwarding_wan2_rule - [0:0]
:forwarding_wan_rule - [0:0]
:forwarding_wiredwan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_usb_rule - [0:0]
:input_wan2_rule - [0:0]
:input_wan_rule - [0:0]
:input_wiredwan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_usb_rule - [0:0]
:output_wan2_rule - [0:0]
:output_wan_rule - [0:0]
:output_wiredwan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_usb_dest_ACCEPT - [0:0]
:zone_usb_forward - [0:0]
:zone_usb_input - [0:0]
:zone_usb_output - [0:0]
:zone_usb_src_ACCEPT - [0:0]
:zone_wan2_dest_ACCEPT - [0:0]
:zone_wan2_forward - [0:0]
:zone_wan2_input - [0:0]
:zone_wan2_output - [0:0]
:zone_wan2_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_ACCEPT - [0:0]
:zone_wiredwan_dest_ACCEPT - [0:0]
:zone_wiredwan_forward - [0:0]
:zone_wiredwan_input - [0:0]
:zone_wiredwan_output - [0:0]
:zone_wiredwan_src_ACCEPT - [0:0]
-A INPUT -j delegate_input 
-A FORWARD -s 172.16.42.0/24 -o tun0 -j ACCEPT 
-A FORWARD -d 172.16.42.0/24 -i tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -s 172.16.42.0/24 -o 3g-wan2 -j ACCEPT 
-A FORWARD -d 172.16.42.0/24 -i 3g-wan2 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -j delegate_forward 
-A OUTPUT -j delegate_output 
-A delegate_forward -m comment --comment "user chain for forwarding" -j forwarding_rule 
-A delegate_forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 
-A delegate_forward -i br-lan -j zone_lan_forward 
-A delegate_forward -i wlan1 -j zone_wan_forward 
-A delegate_forward -i usb0 -j zone_usb_forward 
-A delegate_forward -i   -j zone_wan2_forward 
-A delegate_forward -j reject 
-A delegate_input -i lo -j ACCEPT 
-A delegate_input -m comment --comment "user chain for input" -j input_rule 
-A delegate_input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 
-A delegate_input -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j syn_flood 
-A delegate_input -i br-lan -j zone_lan_input 
-A delegate_input -i wlan1 -j zone_wan_input 
-A delegate_input -i usb0 -j zone_usb_input 
-A delegate_input -i   -j zone_wan2_input 
-A delegate_output -o lo -j ACCEPT 
-A delegate_output -m comment --comment "user chain for output" -j output_rule 
-A delegate_output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 
-A delegate_output -o br-lan -j zone_lan_output 
-A delegate_output -o wlan1 -j zone_wan_output 
-A delegate_output -o usb0 -j zone_usb_output 
-A delegate_output -o   -j zone_wan2_output 
-A reject -p tcp -j REJECT --reject-with tcp-reset 
-A reject -j REJECT --reject-with icmp-port-unreachable 
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -j RETURN 
-A syn_flood -j DROP 
-A zone_lan_dest_ACCEPT -o br-lan -j ACCEPT 
-A zone_lan_forward -m comment --comment "user chain for forwarding" -j forwarding_lan_rule 
-A zone_lan_forward -m comment --comment "forwarding lan -> wan" -j zone_wan_dest_ACCEPT 
-A zone_lan_forward -m comment --comment "forwarding lan -> wiredwan" -j zone_wiredwan_dest_ACCEPT 
-A zone_lan_forward -m comment --comment "forwarding lan -> usb" -j zone_usb_dest_ACCEPT 
-A zone_lan_forward -m comment --comment "forwarding lan -> wan2" -j zone_wan2_dest_ACCEPT 
-A zone_lan_forward -j zone_lan_src_ACCEPT 
-A zone_lan_input -m comment --comment "user chain for input" -j input_lan_rule 
-A zone_lan_input -j zone_lan_src_ACCEPT 
-A zone_lan_output -m comment --comment "user chain for output" -j output_lan_rule 
-A zone_lan_output -j zone_lan_dest_ACCEPT 
-A zone_lan_src_ACCEPT -i br-lan -j ACCEPT 
-A zone_usb_dest_ACCEPT -o usb0 -j ACCEPT 
-A zone_usb_forward -m comment --comment "user chain for forwarding" -j forwarding_usb_rule 
-A zone_usb_forward -m comment --comment "forwarding usb -> lan" -j zone_lan_dest_ACCEPT 
-A zone_usb_forward -j zone_usb_src_ACCEPT 
-A zone_usb_input -m comment --comment "user chain for input" -j input_usb_rule 
-A zone_usb_input -j zone_usb_src_ACCEPT 
-A zone_usb_output -m comment --comment "user chain for output" -j output_usb_rule 
-A zone_usb_output -j zone_usb_dest_ACCEPT 
-A zone_usb_src_ACCEPT -i usb0 -j ACCEPT 
-A zone_wan2_dest_ACCEPT -o   -j ACCEPT 
-A zone_wan2_forward -m comment --comment "user chain for forwarding" -j forwarding_wan2_rule 
-A zone_wan2_forward -m comment --comment "forwarding wan2 -> lan" -j zone_lan_dest_ACCEPT 
-A zone_wan2_forward -j zone_wan2_src_ACCEPT 
-A zone_wan2_input -m comment --comment "user chain for input" -j input_wan2_rule 
-A zone_wan2_input -j zone_wan2_src_ACCEPT 
-A zone_wan2_output -m comment --comment "user chain for output" -j output_wan2_rule 
-A zone_wan2_output -j zone_wan2_dest_ACCEPT 
-A zone_wan2_src_ACCEPT -i   -j ACCEPT 
-A zone_wan_dest_ACCEPT -o wlan1 -j ACCEPT 
-A zone_wan_forward -m comment --comment "user chain for forwarding" -j forwarding_wan_rule 
-A zone_wan_forward -m comment --comment "forwarding wan -> lan" -j zone_lan_dest_ACCEPT 
-A zone_wan_forward -j zone_wan_src_ACCEPT 
-A zone_wan_input -m comment --comment "user chain for input" -j input_wan_rule 
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "Allow-DHCP-Renew" -j ACCEPT 
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "Allow-Ping" -j ACCEPT 
-A zone_wan_input -j zone_wan_src_ACCEPT 
-A zone_wan_output -m comment --comment "user chain for output" -j output_wan_rule 
-A zone_wan_output -j zone_wan_dest_ACCEPT 
-A zone_wan_src_ACCEPT -i wlan1 -j ACCEPT 
-A zone_wiredwan_forward -m comment --comment "user chain for forwarding" -j forwarding_wiredwan_rule 
-A zone_wiredwan_forward -m comment --comment "forwarding wiredwan -> lan" -j zone_lan_dest_ACCEPT 
-A zone_wiredwan_forward -j zone_wiredwan_src_ACCEPT 
-A zone_wiredwan_input -m comment --comment "user chain for input" -j input_wiredwan_rule 
-A zone_wiredwan_input -j zone_wiredwan_src_ACCEPT 
-A zone_wiredwan_output -m comment --comment "user chain for output" -j output_wiredwan_rule 
-A zone_wiredwan_output -j zone_wiredwan_dest_ACCEPT 
COMMIT
# Completed on Tue Nov 10 13:38:41 2015

If you can help me workout where I'm screwing up, it'd be most appreciated.

Thanks guys

Edited November 10, 2015 by AussieKlutz