I had the same problem and a couple of similar ones so here's my complete iptables OUTPUT chain which is all I use and should solve your problem and then some.
-A OUTPUT -d 192.168.1.0/24 -j ACCEPT
-A OUTPUT -o lo -m owner --uid-owner 110 -j ACCEPT
-A OUTPUT ! -o tun+ -m owner --uid-owner 110 -j DROP
Here's what all it's doing:
-A OUTPUT -d 192.168.1.0/24 -j ACCEPT
This command allows all traffic on your local network. The -d
parameter causes the rule to apply to all traffic going to the destination ip. Change 192.168.1
to the first three parts of your local network ip address. For example if your local network ip ranges is from 15.15.15.0
to 15.15.15.255
change that line to
-A OUTPUT -d 15.15.15.0/24 -j ACCEPT
The .0/24
at the end will include all ip addresses on that network.
-A OUTPUT -o lo -m owner --uid-owner 110 -j ACCEPT
This allows local programs on your computer to talk to each other. This was causing problems for me so I thought I would include it. Specifically one of my programs needed this to work with the vpn client.
-A OUTPUT ! -o tun+ -m owner --uid-owner 110 -j DROP
These two commands drop any outgoing packets that don't go out a tun connection. In yours you use eth0
instead of tun+
. Have you tested whether that actually works as a kill switch? I don't think it should because when your vpn connection goes down eth0 should remain.
In order for this to work the order matters. If the accept commands aren't first they will get blocked by the drop commands.