*filter
-A INPUT -i tun -j ACCEPT
-A FORWARD -s 192.168.254.0/255.255.255.0 -j ACCEPT
*nat
-A POSTROUTING -s 192.168.254.0/24 -j MASQUERADE