The local and remote IP's can vary depending what you want to do. Personally I have a separate IP range for VPN clients, but having them in the same subnet as other clients is fine as long as your IP's don't clash with anything on the local network. What did you set them to and what is the local net...

If you know the subnets that the VPS company assigns customer IP's from you could just accept forward traffic only from these ranges resulting in the faked traffic being dropped aslong as it's source IP is outside of the correct range?

- I don't know what conntrack is, will I need it, will it affect performance in my case, - and I am not sure whether I need IP firewall functionality (however I think I will) conntrack is connection tracking. It keeps a track of all port / address translations going through the router so the chance...