disallow all incoming traffic on the VPN interface

[adrelanos]

As reported by @notDavid (#29 (comment)):

Another question though, i was wondering why to allow all incoming traffic on the VPN interface?

Doesn't this make the system vulnerable, for example a vpn-server config where clients can access each others ips internally in the vpn network, would expose all open ports?
Would it not be better to disable that rule by default, so that only established incoming connections are allowed?

[ghost]

I tried blocking incoming tun interface traffic but I had connectivity issues with that. IIRC there were problems with key renegotiation, maybe related to blocked ping from server. Anyway I don't think this can be recommended in general use.

To protect system I advice instead:

1. Don't use vpn server which allows p2p client access.
2. Don't open ports on your system.