这几天一直在配置openvpn，刚遇到一个防火墙的问题，有高手能教教我么

figonet

想在gentoo上配置一下openvpn，连上vpn之后，要通过nat转发出去，以前没用过iptables，刚把内核配置了一下，重新编译 ，安装iptables，也写了点规则，但是现在根本连不上去了，openvpn我用的是11194端口，nat还没做，
附：我的防火墙规则
*nat
REROUTING ACCEPT [2853:223175]
OSTROUTING ACCEPT [3:197]
:OUTPUT ACCEPT [3:197]
-A PREROUTING -i eth0 -p udp -m udp --dport 11194 -j ACCEPT
COMMIT
# Completed on Mon Mar 17 05:42:18 2008
# Generated by iptables-save v1.3.8 on Mon Mar 17 05:42:18 2008
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2206:250454]
-A INPUT -s 127.0.0.1 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 20 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 11194 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 137:139 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 426 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 445 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 6881:6886 -j ACCEPT
#-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i tun+ -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 11194 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 11194 -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 11194 -j ACCEPT
COMMIT
# Completed on Mon Mar 17 05:42:18 2008

figonet

想在gentoo上配置一下openvpn，连上vpn之后，要通过nat转发出去，以前没用过iptables，刚把内核配置了一下，重新编译 ，安装iptables，也写了点规则，但是现在根本连不上去了，openvpn我用的是11194端口，nat还没做，连接的时候提示UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)

附：我的防火墙规则
*nat
REROUTING ACCEPT [2853:223175]
OSTROUTING ACCEPT [3:197]
:OUTPUT ACCEPT [3:197]
-A PREROUTING -i eth0 -p udp -m udp --dport 11194 -j ACCEPT
COMMIT
# Completed on Mon Mar 17 05:42:18 2008
# Generated by iptables-save v1.3.8 on Mon Mar 17 05:42:18 2008
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2206:250454]
-A INPUT -s 127.0.0.1 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 20 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 11194 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 137:139 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 426 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 445 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 6881:6886 -j ACCEPT
#-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i tun+ -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 11194 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 11194 -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 11194 -j ACCEPT
COMMIT
# Completed on Mon Mar 17 05:42:18 2008

blackwhite

你去看这个版上发的shorewall＋VPN什么的。用那个方便点。自己写iptable规则麻烦。