Can someone explain these rules for a specific user and a VPN in iptables?

Question

I used a script from here to setup rules that make sure user transmission-daemon can only send traffic via the VPN i use.

At least that's what the author says. I have troubles understanding the following output. For example, what does the line tcp spt:9091 owner GID match debian-transmission mean? Why is there no traffic on that rule?

Hint: My ethernet port is enp3s0 (like eth0).

$ sudo iptables -L -v
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  436 35225 f2b-sshd   tcp  --  any    any     anywhere             anywhere             multiport dports ssh
 1085  221K ACCEPT     all  --  tun0   any     anywhere             anywhere            
 2913  923K ACCEPT     all  --  enp3s0 any     anywhere             anywhere            
  112 12221 ACCEPT     all  --  lo     any     anywhere             anywhere
Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

    0     0            all  --  any    any     anywhere             anywhere
Chain OUTPUT (policy ACCEPT 4540 packets, 1267K bytes)
 pkts bytes target     prot opt in     out     source               destination

    0     0 ACCEPT     tcp  --  any    enp3s0  anywhere             192.168.100.0/25     tcp spt:9091 owner GID match debian-transmission
    0     0 ACCEPT     udp  --  any    enp3s0  anywhere             192.168.100.0/25     udp spt:9091 owner GID match debian-transmission
 2263  202K ACCEPT     all  --  any    tun0    anywhere             anywhere             owner GID match debian-transmission
   12  2581 ACCEPT     all  --  any    lo      anywhere             anywhere             owner GID match debian-transmission
    0     0 REJECT     all  --  any    any     anywhere             anywhere             owner GID match debian-transmission reject-with icmp-port-unreachable

score 1 · Accepted Answer · edited Dec 15 '20 at 14:53

the rule:

iptables -A OUTPUT -d 192.168.100.0/25 -p tcp --sport 9091 -m owner --gid-owner debian-transmission -o enp3s0 -j ACCEPT

will ACCEPT the packet IF it is to any IP in the range 192.168.100.0 - 192.168.100.127 AND the protocol is tcp AND the source port is 9091 AND the packet owner is debian-transmission AND it is destined for the network interface enp3s0 ELSE go to the next iptables rule.

Can someone explain these rules for a specific user and a VPN in iptables?

1 Answers1