1

I am trying to setup openvpn and am making some good progress.

I'm not at the point yet where I am testing the tunnel- i am firstly making sure that the ports are all set correctly through the firewall.

If I telnet port 1194 to the server with iptables on, and run tcpdump, I get:

22:39:28.933049 IP xxx.56236 > ip.openvpn: S 4157464468:4157464468(0) win 8192 <mss 1460,nop,nop,sackOK>
22:39:28.934723 IP ip.openvpn > xxx.56236: R 0:0(0) ack 4157464469 win 0

But if I turn iptables back on, It only seems to get the packet, but doesnt send a reply:

22:39:28.933049 IP xxx.56236 > ip.openvpn: S 4157464468:4157464468(0) win 8192 <mss 1460,nop,nop,sackOK>

Any ideas why? My iptables look like this:

[root@westc01-01-01 sysconfig]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports http
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports https
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports submission
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports imap
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports imaps
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports smtps
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports smtp
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports ms-wbt-server
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports 8884
ACCEPT     udp  --  anywhere             anywhere            udp multiport ports domain
ACCEPT     tcp  --  anywhere             westc01-01-01.local tcp multiport ports ndmp
ACCEPT     gre  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pptp
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     esp  --  anywhere             anywhere
ACCEPT     ah   --  anywhere             anywhere
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited
ACCEPT     udp  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED udp dpt:openvpn
Improve this question
5
  • It is not clear from which host these iptables rules are. Is iptables configure on the server or on the client?
    – Alex
    Aug 8, 2012 at 12:55
  • Sorry- this is the server.
    – Lock
    Aug 8, 2012 at 13:06
  • 1
    As an aside, OpenVPN prefers to use UDP, not TCP. Telnet is a TCP protocol, so you're not actually testing your rules. I'm not sure what's sending the ACK, unless you've configured OpenVPN to use TCP. If you are using TCP, read sites.inka.de/bigred/devel/tcp-tcp.html
    – cjc
    Aug 8, 2012 at 13:16
  • Thanks for the response. How do I test udp connectivity? It is definitely set to use udp
    – Lock
    Aug 8, 2012 at 21:39
  • OK so you are right about the TCP/UDP thing. The reason it is not working is because my rule says to allow UDP on 1194, but it is coming in as TCP, so it is being rejected. I wander what is replying though on tcp 1194? A netstat shows that 1194 is only in use by udp: [root@westc01-01-01 openvpn]# netstat -an | grep 1194 udp 0 0 xxx:1194 0.0.0.0:*
    – Lock
    Aug 9, 2012 at 7:23

1 Answer 1

Reset to default
7

Why not switch the order of these rules?

REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited
ACCEPT     udp  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED udp dpt:openvpn
Improve this answer
2
  • 1
    Yep I can now see that is a mistake. Thanks for pointing that out
    – Lock
    Aug 9, 2012 at 7:25
  • Do not worry, it happens :)
    – tombolinux
    Aug 9, 2012 at 8:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.