`R2:` 
`$ ip route` 
`192.168.20.0/24 dev eth3 proto kernel scope link src 192.168.20.1` 
`192.168.30.0/24 dev eth2 proto kernel scope link src 192.168.30.1` 
`default via 203.0.113.9 dev eth1` 
`10.8.0.0/30 dev tun0 proto kernel scope link src 10.8.0.1` 
`192.168.40.0/24 via 10.8.0.2 dev tun0`
`$ iptables -t nat -S` 
`-P PREROUTING ACCEPT` 
`-P INPUT ACCEPT` 
`-P OUTPUT ACCEPT` 
`-P POSTROUTING ACCEPT` 
`-A POSTROUTING -o eth1 -j MASQUERADE`
`$ iptables -S FORWARD` 
`-P FORWARD DROP` 
`-A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT` 
`-A FORWARD -s 192.168.40.0/24 -d 192.168.30.10/32 -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT`

`R3:` 
`$ ip route` `192.168.40.0/24 dev eth2 proto kernel scope link src 192.168.40.1` 
`default via 203.0.113.13 dev eth1` 
`10.8.0.0/30 dev tun0 proto kernel scope link src 10.8.0.2` 
`192.168.20.0/24 via 10.8.0.1 dev tun0` 
`192.168.30.0/24 via 10.8.0.1 dev tun0`
`$ iptables -t nat -S` 
`-P PREROUTING ACCEPT` 
`-P INPUT ACCEPT` 
`-P OUTPUT ACCEPT` 
`-P POSTROUTING ACCEPT` 
`-A POSTROUTING -o eth1 -j MASQUERADE`

`PC Herobrine:` 
`$ ip route` 
`default via 192.168.40.1 dev eth0` 
`192.168.40.0/24 dev eth0 proto kernel scope link src 192.168.40.10`
