# enable vpn_gw to lan
ipt -A fw_vpn_gw -o $if_lan -j ACCEPT

# SNAT source ip to LAN ip
ipt4 -t nat -A post_lan -s $if_vpn_gw_net4 -d $if_lan_net4 -j SNAT --to $if_lan_ip4

# accept ESTABLISHED from LAN to vpn_gw
ipt -A fw_lan -o $if_vpn_gw -m state --state RELATED,ESTABLISHED -j ACCEPT