Iptables setup on VPN client having LAN
<p>I am struggling with some problem, probably because there is simply not enough information on the web regarding some specifics I am trying to setup.</p>

<p>I have bought OpenVPN service via tun (routing).
I connect to the OpenVPN server through Raspberry PI (serving me as router), which has two interfaces - <code>eth0</code> for handling Internet connection and <code>wlan0</code> for my internal LAN.</p>

<p>My goal is to setup firewall in such way, that I can filter <code>tun</code>-ned income traffic and be able to reach web from LAN behind <code>wlan0</code>. Also - everything should go via VPN.</p>

<p>From the architectural point of view I think it should look like this:</p>

<ul>
<li><code>INPUT</code>, <code>FORWARD</code> - dropped,</li>
<li><code>OUTPUT</code> - allowed,</li>
<li><code>eth0</code> allows to flow only packets via default OpenVPN service port,</li>
<li><code>tun</code> adapter should have all INPUT-related policies applied and should be NAT-ted.</li>
</ul>

<p>What you think - is this correct thinking? I have managed so far to be able to ping from SSH-ed Raspberry PI into web, but yet no DNS - do I understand correctly that I should have own DNS forwarder? DHCP server is set on Raspberry PI.</p>

<p>Thanks!</p>