1

I've installed an OpenVPN server (server-bridge) on Fedora 20, but I cannot get it to work. I'm almost sure that It's a firewall issue.

I'm trying to connect from an OSX client, but I can connect (just connect to VPN server, without access to anything) before the bridge is configured in server, however once I configure the bridge interface (using this script), then I cannot connect anymore. I've configured it as server-bridge, following these HOW-TOs from Fedora and OpenVPN Ethernet-Bridge.

The firewall config is explained using iptables:

iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT

However, in Fedora 20, by default, It's installed firewalld, so, Can anyone tell me the equivalent commands using firewall-cmd ? I read the firewalld guide, but It's not clear to me how to achieve it (I'm a developer, no SysAdmin).

I know that I can install iptables, but I want it to work with firewalld.

UPDATE: After some reading on firewall-cmd man page, I tried to apply the previous commands using --passthroughoption, that is:

# firewall-cmd --permanent --direct --passthrough ipv4 -A FORWARD -i br0 -j ACCEPT
# firewall-cmd --permanent --direct --passthrough ipv4 -A INPUT -i br0 -j ACCEPT
# firewall-cmd --permanent --direct --passthrough ipv4 -A FORWARD -i br0 -j ACCEPT

The commands are successfully executed, but It doesn't work, I also tried to use eb instead of ipv4 with the same result.

The ifconfig output is something like:

br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.40  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 fe80::c9:aff:fe02:d953  prefixlen 64  scopeid 0x20<link>
        ether 02:c9:09:02:d9:53  txqueuelen 0  (Ethernet)
        RX packets 11276  bytes 1374285 (1.3 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 899  bytes 240110 (234.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST>  mtu 1500
        inet6 fe80::c9:afa:fe02:d953  prefixlen 64  scopeid 0x20<link>
        ether 03:c9:0a:02:d9:53  txqueuelen 1000  (Ethernet)
        RX packets 13548  bytes 1942379 (1.8 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1162  bytes 269258 (262.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 117  base 0xc000  

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 16436
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 0  (Local Loopback)
        RX packets 6883  bytes 2061608 (1.9 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6883  bytes 2061608 (1.9 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

p2p0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet6 fe80::9831:16ff:fe81:3658  prefixlen 64  scopeid 0x20<link>
        ether 9a:3b:16:84:36:58  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tap0: flags=4355<UP,BROADCAST,PROMISC,MULTICAST>  mtu 1500
        ether d6:6c:20:12:f3:b6  txqueuelen 100  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.41  netmask 255.255.255.0  broadcast 0.0.0.0
        inet6 fe80::9a5b:16ff:fe81:3658  prefixlen 64  scopeid 0x20<link>
        ether 98:3b:11:81:36:58  txqueuelen 1000  (Ethernet)
        RX packets 2643  bytes 230523 (225.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 5512  bytes 1726039 (1.6 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
2

firewalld has some services already pre-configured which can be seen with:

firewall-cmd --get-services

(Configuration file /usr/lib/firewalld/services/openvpn.xml)

If you see openvpn as already available service you can enable it with:

firewall-cmd --add-service openvpn
  • 1
    I've already do that, the problem is not OpenVPN service, but the config of tap and bridge (br) network interfaces in the firewalld. – rsc1975 Aug 23 '14 at 10:36
1

The answer to my original question is:

# firewall-cmd --permanent --direct --passthrough ipv4 -A FORWARD -i br0 -j ACCEPT
# firewall-cmd --permanent --direct --passthrough ipv4 -A INPUT -i br0 -j ACCEPT
# firewall-cmd --permanent --direct --passthrough ipv4 -A FORWARD -i br0 -j ACCEPT

Then, if you execute:

# firewall-cmd --permanent  --direct --get-all-passthroughs

You'll get this:

ipv4 -A INPUT -i tap0 -j ACCEPT
ipv4 -A INPUT -i br0 -j ACCEPT
ipv4 -A FORWARD -i br0 -j ACCEPT

However there is still something wrong, I cannot connect to the VPN server, so any idea/clue will be welcome.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.