Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to setup openvpn and am making some good progress.

I'm not at the point yet where I am testing the tunnel- i am firstly making sure that the ports are all set correctly through the firewall.

If I telnet port 1194 to the server with iptables on, and run tcpdump, I get:

22:39:28.933049 IP xxx.56236 > ip.openvpn: S 4157464468:4157464468(0) win 8192 <mss 1460,nop,nop,sackOK>
22:39:28.934723 IP ip.openvpn > xxx.56236: R 0:0(0) ack 4157464469 win 0

But if I turn iptables back on, It only seems to get the packet, but doesnt send a reply:

22:39:28.933049 IP xxx.56236 > ip.openvpn: S 4157464468:4157464468(0) win 8192 <mss 1460,nop,nop,sackOK>

Any ideas why? My iptables look like this:

[root@westc01-01-01 sysconfig]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports http
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports https
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports submission
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports imap
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports imaps
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports smtps
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports smtp
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports ms-wbt-server
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports 8884
ACCEPT     udp  --  anywhere             anywhere            udp multiport ports domain
ACCEPT     tcp  --  anywhere             westc01-01-01.local tcp multiport ports ndmp
ACCEPT     gre  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pptp
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     esp  --  anywhere             anywhere
ACCEPT     ah   --  anywhere             anywhere
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited
ACCEPT     udp  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED udp dpt:openvpn
share|improve this question
    
It is not clear from which host these iptables rules are. Is iptables configure on the server or on the client? –  Alex Aug 8 '12 at 12:55
    
Sorry- this is the server. –  Lock Aug 8 '12 at 13:06
1  
As an aside, OpenVPN prefers to use UDP, not TCP. Telnet is a TCP protocol, so you're not actually testing your rules. I'm not sure what's sending the ACK, unless you've configured OpenVPN to use TCP. If you are using TCP, read sites.inka.de/bigred/devel/tcp-tcp.html –  cjc Aug 8 '12 at 13:16
    
Thanks for the response. How do I test udp connectivity? It is definitely set to use udp –  Lock Aug 8 '12 at 21:39
    
OK so you are right about the TCP/UDP thing. The reason it is not working is because my rule says to allow UDP on 1194, but it is coming in as TCP, so it is being rejected. I wander what is replying though on tcp 1194? A netstat shows that 1194 is only in use by udp: [root@westc01-01-01 openvpn]# netstat -an | grep 1194 udp 0 0 xxx:1194 0.0.0.0:* –  Lock Aug 9 '12 at 7:23
add comment

1 Answer

up vote 7 down vote accepted

Why not switch the order of these rules?

REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited
ACCEPT     udp  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED udp dpt:openvpn
share|improve this answer
1  
Yep I can now see that is a mistake. Thanks for pointing that out –  Lock Aug 9 '12 at 7:25
    
Do not worry, it happens :) –  tombolinux Aug 9 '12 at 8:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.