On Friday, 28 April 2017 11:00:57 AM AEST Robert White wrote: > On 04/27/17 05:21, Kevin wrote: > > (... DROP rules and a tun+ device but virtually no rules that ACCEPT the > > packet so it can get into the tun+ device ...) > So you've got these policies... > > > $IPT -t filter --policy INPUT DROP > > $IPT -t filter --policy FORWARD DROP > > $IPT -t filter --policy OUTPUT DROP > > And you've got these post TUN/TAP decode rules > > > $IPT -A INPUT -i tun+ -s 999.999.999.999 -j ACCEPT > > $IPT -A FORWARD -i tun+ -s 999.999.999.999 -j ACCEPT > > $IPT -A OUTPUT -o tun+ -d 999.999.999.999 -j ACCEPT > > But you've got no > > $IPT -A INPUT -i ethX (Whatever the tunnel needs) -j ACCEPT As I indicated in my original message, the rules I included were only the initial rules in my configuration. My question was not so much why my VPN was not working as expected by what happened to the packet. Why were the no log entries on the mangle and filter input chains? As per my previous message, that has been explained. I did not know about the rp-filter mechanism. Those expected log entries now appear. And, for the record, I did try with all chain policies as ACCEPT. Cheers, Kevin -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
