One iptables host simulates four gateways in different network environments

Iptables simulates four router functions for an openvpn site arrival Experiment

Real Environment: openvpn server-gateway-ISP-gateway-openvpn client-use openvpn client to connect the gateway to the virtual network (at least 6 hosts are required for experiments)

Using iptables to simulate different network gateways-ISP-Gateway is enough to use one (if there are two networks, save two, 3 networks, save four ...)

Iptables Policy

Access from all networks to port 1194 is allowed between different networks

Access from all networks between different networks to the Intranet CIDR block is denied except for port 1194.

All others are allowed (the lab can be completed with a higher permission. In this case, the actual environment is rejected)

Network 1 192.168.10.0/24

Network 2 192.168.11.0/24

Network 3 192.168.12.0/24

Network 4 192.168.20./ 24

(4 Network Analog sites-multi-site Communication)

# Enable routing

Echo 1>/proc/sys/net/ipv4/ip_forward

Sed-I s/net. ipv4.ip _ forward = 0/net. ipv4.ip _ forward = 1/g/etc/sysctl. conf

Configure iptables scripts

#! /Bin/bash

Iptables-F
Iptables-X
Iptables-Z

Iptables-P INPUT ACCEPT
Iptables-P OUTPUT ACCEPT
Iptables-P FORWARD DROP

Iptables-a input-s 192.168.10.0/24-d 192.168.10.0/24-m state -- state NEW, RELATED, ESTABLISHED-j ACCEPT
Iptables-a input-s 192.168.11.0/24-d 192.168.11.0/24-m state -- state NEW, RELATED, ESTABLISHED-j ACCEPT
Iptables-a input-s 192.168.12.0/24-d 192.168.12.0/24-m state -- state NEW, RELATED, ESTABLISHED-j ACCEPT
Iptables-a input-s 192.168.20./ 24-d 192.168.20./ 24-m state -- state NEW, RELATED, ESTABLISHED-j ACCEPT

Iptables-a input-d 192.168.10.0/24-p tcp -- dport 1194-j ACCEPT
Iptables-a input-d 192.168.11.0/24-p tcp -- dport 1194-j ACCEPT
Iptables-a input-d 192.168.12.0/24-p tcp -- dport 1194-j ACCEPT
Iptables-a input-d 192.168.20./ 24-p tcp -- dport 1194-j ACCEPT

Iptables-a input-d 192.168.10.0/24-m state -- state NEW, INVALID-j DROP
Iptables-a input-d 192.168.11.0/24-m state -- state NEW, INVALID-j DROP
Iptables-a input-d 192.168.12.0/24-m state -- state NEW, INVALID-j DROP
Iptables-a input-d 192.168.20./ 24-m state -- state NEW, INVALID-j DROP

Iptables-a forward-s 192.168.0.0/24-j ACCEPT
Iptables-a forward-d 192.168.0.0/24-j ACCEPT

Service iptables save
Service iptables restart