iptables for dummies please?

[Deleted member 27741]

Let's say these are the first five iptables rules. Can anyone tell me if my explantion is wrong?

Chain INPUT
num__target___ prot__opt__in____out __source______destination
1 ____ACCEPT__all ___-- __tap22 _any __anywhere____anywhere
2 ____ACCEPT__udp__-- __any___any __anywhere____anywhere___udp dpt:www
3 ____ACCEPT__all___-- __tap21 _any___anywhere____anywhere
4 ____ACCEPT__tcp___-- __any__any ___anywhere ___anywhere___tcp dpt:https
5 ____logdrop__all___-- __eth0__any___141.212.122.0/24_anywhere

Rule #1 accept packet from anywhere of any protocol coming to openvpnserver2 and send them anywhere.
Rule #2 accept udp packets from anywhere to port 80 to any interface send out any interface to anywhere.
Rule #3 from anywhere accept packets of any protocol coming to openvpnserver1 and send them anywhere.
Rule #4 accept tcp packets from anywhere to port 443 to any interface send out any interface to anywhere.
Rule # 5 logdrop packets of any protocol coming to the wan interface from source 141.212.122.0/24

Question- would it be a good/bad idea to restrict rules 1 and 3 to the openvpnserver listening ports? Restrict to tcp/udp depending on openvpnserver procotol?

How do I go about changing default iptables?

 

[ColinTaylor]

Question- would it be a good/bad idea to restrict rules 1 and 3 to the openvpnserver listening ports?

No. Think about it.

tap21/22 are tunnels so you want them to carry ALL of your usual type of traffic, i.e. http, https, ftp, etc.

The VPN listening port (1194 I think?) is on the WAN interface (eth0).

Sorry, that's not a very clear explanation.