Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to setup a VPN server with OpenVPN, so client PCs can access each other like they were in the same physical network.

One problem I encountered is, that I cannot connect via UDP. When I change server+client configuration to use TCP connections, clients can successfully connect to the server. I read TCP over TCP is bad and incurs a lot of overhead.

The server is behind a router with a public IP and the server's IP is configured to be in the DMZ of the router.

Is there a way I can test where the connection fails when using UDP? At the client's router, at the client's ISP, at my router, somewhere else? Is such a setup even possible with UDP or do I have to resort to TCP?

If I missed essential details, let me know and I'll be happy to add them.

share|improve this question
Are you using an SSH tunnel to test this ? – Lucas Kauffman Mar 4 '12 at 20:24
@LucasKauffman: no, I'm simply running openvpn server.conf on the server and openvpn client.conf on the client – knittl Mar 4 '12 at 20:26
What do your error logs say ? – Lucas Kauffman Mar 4 '12 at 20:27
@LucasKauffman: Something along the lines of "Key exchange failed after 60 seconds" on the client, I don't think the server made any output. I can check again tomorrow (~12 hrs) – knittl Mar 4 '12 at 20:30
Do you have any firewall rules running to prevent UDP packets? – Lucas Kauffman Mar 4 '12 at 20:42

Sounds like a firewall is blocking traffic. I'd recommend using a udp sniffer..for linux, try tcpdump (which despite its name does also udp).

share|improve this answer

Being in the DMZ does not mean you have full access from the Internet or anywhere else on the network. Many filewalls only permit the required ports into and out of the DMZ. If your ports aren't on the allowed list then they will not arrive at your server.

UDP failures are not as easy to investigate as TCP failures.

  • An ICMP monitor may indicate where the packet was rejected. It will fail if the packet was dropped.
  • Firewall logs at either end may indicate the traffic is being dropped. Temporary logging rules can indicate if the traffic is arriving at the firewall.
  • A tool like tcpdump can be used to determine what traffic is being sent and/or arriving.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.