Modifying OpenVPN firewall/iptables rule?

[Chris H]

I've noticed that a handful of IPs seem to be repeatedly trying to connect to my (asuswrt-merlin powered) router's OpenVPN server. I'm not too worried about it since I'm using key + password authentication, but I set up a simple ipset integration in "firewall-start" to block them anyway.

Unfortunately it looks like the iptables rule that's created for openvpn purposes is taking precedence; it's number 1 in the INPUT chain, right above my blacklist match:

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:1194
2    DROP       all  --  0.0.0.0/0            0.0.0.0/0            match-set jchblacklistnet src

Can someone recommend the best way to move this rule so that my blacklist takes precedence? Always removing rule #1 in my user script seems fragile, as does any kind of grepping the output of iptables, but that's the closest I've seen in searching other threads here.

 

[ColinTaylor]

This was discussed here. Particularly note "EDIT 3".

An alternate solution is to change OpenVPN to use a non-standard port.

 

[Chris H]

Thanks, @ColinTaylor - that worked, and strangely enough it was the same IP block from your example that was hitting me.