Iptables INPUT на роутере.

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT                          
iptables -A INPUT -m state --state INVALID -j DROP                                        
iptables -A INPUT ! -i br0 -j PTCSRVWAN
iptables -A INPUT -i br0 -j PTCSRVLAN                                                     
iptables -A INPUT -i br0 -m state --state NEW -j ACCEPT                                   
iptables -A INPUT -i lo -m state --state NEW -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -s 192.168.1.0/24 -d 192.168.1.1/32 -p tcp -m tcp -4 --dport 65534 -j ACCEPT
iptables -A INPUT -s 10.8.0.0/29 -d 192.168.1.1/32 -p tcp -m tcp -4 --dport 65534 -j ACCEPT
iptables -A INPUT -p tcp -m tcp -4 --dport 8080 -j ACCEPT
iptables -A INPUT -s 192.168.1.0/24 -d 192.168.1.1/32 -i tun0 -4 -j ACCEPT                
iptables -A INPUT -s 10.8.0.0/29 -d 192.168.1.1/32 -i tun0 -4 -j ACCEPT
iptables -t nat -I PREROUTING -p tcp --dport 8080 -j ACCEPT
iptables -A FORWARD -i tun0 -j ACCEPT
iptables -A INPUT -j DROP