allow clients to resolve DNS (i.e. query knot-resolver)

e7b521b3 · Gui · micah · c76abe8e · e7b521b3
Unverified Commit e7b521b3 authored 3 years ago by Gui Committed by micah 3 years ago
--- a/config/roles/openvpn/templates/50openvpn.firewall.j2
+++ b/config/roles/openvpn/templates/50openvpn.firewall.j2
@@ -16,4 +16,6 @@ add_rule6 -A FORWARD -d {{ openvpn_network6 }} -m state --state RELATED,ESTABLIS
 add_rule4 -A FORWARD -i tun0 -o tun0 -j DROP
 add_rule6 -A FORWARD -i tun0 -o tun0 -j DROP

-
+# allow vpn clients to resolve DNS (i.e. query knot-resolver)
+add_rule -A user-input -i tun0 -p udp --dport 53 -j ACCEPT
+add_rule -A user-input -i tun0 -p tcp --dport 53 -j ACCEPT