Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was recently setting up an OpenVPN server on Linux in ethernet bridging mode.

The Linux server had iptables rules enabled, so I had to specify inbound access via UDP on port 1194:

iptables -A INPUT -p udp --dport 1194 -j ACCEPT

However, the OpenVPN server wasn't working properly until I also specified these rules:

iptables -A INPUT -i tap+ -j ACCEPT
iptables -A FORWARD -i tap+ -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

Since OpenVPN is configured in bridging mode, I thought that once the VPN connection was established:

  • Communication between a connected OpenVPN client and nodes in the internal network occurs over layer 2 (ethernet bridging mode)
  • iptables works only on layer 3

And yet, these can't both be true. Why was iptables blocking those packets going from tap0 to other servers on the same subnet?

share|improve this question
    
This is impossible to answer without the context. Show your firewall and complete network configuration. –  Michael Hampton Aug 12 '13 at 3:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.