1

I am trying to setup openvpn and am making some good progress.

I'm not at the point yet where I am testing the tunnel- i am firstly making sure that the ports are all set correctly through the firewall.

If I telnet port 1194 to the server with iptables on, and run tcpdump, I get:

22:39:28.933049 IP xxx.56236 > ip.openvpn: S 4157464468:4157464468(0) win 8192 <mss 1460,nop,nop,sackOK>
22:39:28.934723 IP ip.openvpn > xxx.56236: R 0:0(0) ack 4157464469 win 0

But if I turn iptables back on, It only seems to get the packet, but doesnt send a reply:

22:39:28.933049 IP xxx.56236 > ip.openvpn: S 4157464468:4157464468(0) win 8192 <mss 1460,nop,nop,sackOK>

Any ideas why? My iptables look like this:

[root@westc01-01-01 sysconfig]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports http
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports https
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports submission
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports imap
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports imaps
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports smtps
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports smtp
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports ms-wbt-server
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport ports 8884
ACCEPT     udp  --  anywhere             anywhere            udp multiport ports domain
ACCEPT     tcp  --  anywhere             westc01-01-01.local tcp multiport ports ndmp
ACCEPT     gre  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pptp
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     esp  --  anywhere             anywhere
ACCEPT     ah   --  anywhere             anywhere
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited
ACCEPT     udp  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED udp dpt:openvpn
5
  • It is not clear from which host these iptables rules are. Is iptables configure on the server or on the client?
    – Alex
    Aug 8, 2012 at 12:55
  • Sorry- this is the server.
    – Lock
    Aug 8, 2012 at 13:06
  • 1
    As an aside, OpenVPN prefers to use UDP, not TCP. Telnet is a TCP protocol, so you're not actually testing your rules. I'm not sure what's sending the ACK, unless you've configured OpenVPN to use TCP. If you are using TCP, read sites.inka.de/bigred/devel/tcp-tcp.html
    – cjc
    Aug 8, 2012 at 13:16
  • Thanks for the response. How do I test udp connectivity? It is definitely set to use udp
    – Lock
    Aug 8, 2012 at 21:39
  • OK so you are right about the TCP/UDP thing. The reason it is not working is because my rule says to allow UDP on 1194, but it is coming in as TCP, so it is being rejected. I wander what is replying though on tcp 1194? A netstat shows that 1194 is only in use by udp: [root@westc01-01-01 openvpn]# netstat -an | grep 1194 udp 0 0 xxx:1194 0.0.0.0:*
    – Lock
    Aug 9, 2012 at 7:23

1 Answer 1

7

Why not switch the order of these rules?

REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited
ACCEPT     udp  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED udp dpt:openvpn
2
  • 1
    Yep I can now see that is a mistake. Thanks for pointing that out
    – Lock
    Aug 9, 2012 at 7:25
  • Do not worry, it happens :)
    – tombolinux
    Aug 9, 2012 at 8:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .