3

I configured openvpn (OpenVPN 2.1.0) and apache 2 ( to listen respectively on 443 and 10443 (with modssl). The two applications are listening well:

tcp        0      0 x.x.x.x:10443           0.0.0.0:*        LISTEN      1130/apache2
tcp        0      0 0.0.0.0:443             0.0.0.0:*        LISTEN      7860/openvpn

But, for a reason I'm trying to determine, the port-share option configured as follow (with public ip) is not working:

port 443
port-share x.x.x.x 10443

The error in the openvpn log is:

TCP connection established with [AF_INET]y.y.y.y:3123  Socket Buffers: R=[131072->131072] S=[131072->131072]  
TCPv4_SERVER link     local: [undef]  
TCPv4_SERVER link remote: [AF_INET]y.y.y.y:3123
y.y.y.y:3123 Non-OpenVPN client protocol detected  
PORT SHARE PROXY: connect to port-share server failed
y.y.y.y:3123 SIGTERM[soft,port-share-redirect] received, client-instance exiting  
TCP/UDP: Closing socket

I suppose that openvpn has not the right to connect, but it is launched as root

root 7862 0.0 0.0 99552 924 ? S Sep22 0:00 /usr/sbin/openvpn --writepid /var/run/openvpn.server.pid --daemon ovpn-server --cd /etc/openvpn --config /etc/openvpn/server.conf --script-security 2

The 443 and 10443 ports are open on the firewall.

Thank you for any comments and suggestion !

I already consulted:

Edit for iptables rules:

Chain ufw-user-input (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www
ACCEPT     udp  --  anywhere             anywhere            udp dpt:www
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp
ACCEPT     udp  --  anywhere             anywhere            udp dpt:25
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain
ACCEPT     udp  --  anywhere             anywhere            udp dpt:openvpn
ACCEPT     tcp  --  10.0.0.0/8           anywhere            tcp dpt:mysql
ACCEPT     udp  --  10.0.0.0/8           anywhere            udp dpt:mysql
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https
ACCEPT     udp  --  anywhere             anywhere            udp dpt:https
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:10443
ACCEPT     udp  --  anywhere             anywhere            udp dpt:10443

Edit for better explanation of the error log: The openvpn remote connection is working (I connect successfully to the VPN on port 443). The port forward is not working. HTTPS connection on 10443 is working, but HTTPS connection on port 443 is not working with port-share option.

10
  • Could you please show us the iptables rules?
    – quanta
    Sep 24, 2011 at 5:03
  • Sure, I added input rules, feel free to ask for an other specific relevant section of iptables.
    – snowflake
    Sep 26, 2011 at 7:02
  • How about the iptables forward rules? Also, do you have something like apparmor running?
    – cjc
    Sep 27, 2011 at 3:09
  • My chain ufw-user-forward is empty. apparmor is not running.
    – snowflake
    Sep 28, 2011 at 7:58
  • Are you able to telnet x.x.x.x 10443? Can you include pcap/tcpdump output of the interface that x.x.x.x is on when openvpn attempts to connect? Does it just never get a SYN/ACK back? If you ufw disable does it work?
    – polynomial
    Sep 30, 2011 at 1:29

1 Answer 1

0

I finally found the answer to this problem.

Despite firewall rules seems correct, the fact that openvpn were listening on a different host (public ip) than apache was the problem. Using same host (and public ip) for openvpn and apache solved it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .