0

I installed Openvpn in my server which already had UFW installed i enabled ip forward in vi /etc/sysctl.conf applied changes using sysctl -p

I also enabled forwarding using echo 1 > /proc/sys/net/ipv4/ip_forward

frowarding using ip table

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

allowed ufw

ufw allow 1194/udp  
ufw allow 1194/tcp

I restarted server, openvpn and all but client doesn't connect but if i disable ufw using ufw disable connection is successful.

below is content of /etc/default/ufw

# /etc/default/ufw                                                                                                                                                                                                                                                                  
#                                                                                                                                                                                                                                                                                   

# Set to yes to apply rules to support IPv6 (no means only IPv6 on loopback                                                                                                                                                                                                         
# accepted). You will need to 'disable' and then 'enable' the firewall for                                                                                                                                                                                                          
# the changes to take affect.                                                                                                                                                                                                                                                       
IPV6=yes                                                                                                                                                                                                                                                                            

# Set the default input policy to ACCEPT, DROP, or REJECT. Please note that if                                                                                                                                                                                                      
# you change this you will most likely want to adjust your rules.                                                                                                                                                                                                                   
DEFAULT_INPUT_POLICY="DROP"                                                                                                                                                                                                                                                         

# Set the default output policy to ACCEPT, DROP, or REJECT. Please note that if                                                                                                                                                                                                     
# you change this you will most likely want to adjust your rules.                                                                                                                                                                                                                   
DEFAULT_OUTPUT_POLICY="ACCEPT"                                                                                                                                                                                                                                                      

# Set the default forward policy to ACCEPT, DROP or REJECT.  Please note that                                                                                                                                                                                                       
# if you change this you will most likely want to adjust your rules                                                                                                                                                                                                                 
DEFAULT_FORWARD_POLICY="ACCEPT"                                                                                                                                                                                                                                                     

# Set the default application policy to ACCEPT, DROP, REJECT or SKIP. Please                                                                                                                                                                                                        
# note that setting this to ACCEPT may be a security risk. See 'man ufw' for                                                                                                                                                                                                        
# details                                                                                                                                                                                                                                                                           
DEFAULT_APPLICATION_POLICY="SKIP"                                                                                                                                                                                                                                                   

# By default, ufw only touches its own chains. Set this to 'yes' to have ufw                                                                                                                                                                                                        
# manage the built-in chains too. Warning: setting this to 'yes' will break                                                                                                                                                                                                         
# non-ufw managed firewall rules                                                                                                                                                                                                                                                    
MANAGE_BUILTINS=no                                                                                                                                                                                                                                                                  

#                                                                                                                                                                                                                                                                                   
# IPT backend                                                                                                                                                                                                                                                                       
#                                                                                                                                                                                                                                                                                   
# only enable if using iptables backend                                                                                                                                                                                                                                             
IPT_SYSCTL=/etc/ufw/sysctl.conf                                                                                                                                                                                                                                                     

# Extra connection tracking modules to load. Complete list can be found in                                                                                                                                                                                                          
# net/netfilter/Kconfig of your kernel source. Some common modules:                                                                                                                                                                                                                 
# nf_conntrack_irc, nf_nat_irc: DCC (Direct Client to Client) support                                                                                                                                                                                                               
# nf_conntrack_netbios_ns: NetBIOS (samba) client support                                                                                                                                                                                                                           
# nf_conntrack_pptp, nf_nat_pptp: PPTP over stateful firewall/NAT                                                                                                                                                                                                                   
# nf_conntrack_ftp, nf_nat_ftp: active FTP support                                                                                                                                                                                                                                  
# nf_conntrack_tftp, nf_nat_tftp: TFTP support (server side)                                                                                                                                                                                                                        
IPT_MODULES="nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns"     

below is content of /etc/ufw/before.rules

   #                                                                                                                                                                                                                                                                                   
# rules.before                                                                                                                                                                                                                                                                      
#                                                                                                                                                                                                                                                                                   
# Rules that should be run before the ufw command line added rules. Custom                                                                                                                                                                                                          
# rules should be added to one of these chains:                                                                                                                                                                                                                                     
#   ufw-before-input                                                                                                                                                                                                                                                                
#   ufw-before-output                                                                                                                                                                                                                                                               
#   ufw-before-forward                                                                                                                                                                                                                                                              
#                                                                                                                                                                                                                                                                                   

# START OPENVPN RULES                                                                                                                                                                                                                                                               
# NAT table rules                                                                                                                                                                                                                                                                   
*nat                                                                                                                                                                                                                                                                                
:POSTROUTING ACCEPT [0:0]                                                                                                                                                                                                                                                           
# Allow traffic from OpenVPN client to eth0                                                                                                                                                                                                                                         
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE                                                                                                                                                                                                                                 
COMMIT                                                                                                                                                                                                                                                                              
# END OPENVPN RULES       

 .                                                                                                                                                                                                                                                     
 .                                                                                                                                                                                                                                  
 .                                                                                                                                                                                                                                                                                   

#openvpn                                                                                                                                                                                                                                                                            
-A ufw-before-input -i tun+ -j ACCEPT                                                                                                                                                                                                                                               
-A ufw-before-output -i tun+ -j ACCEPT                                                                                                                                                                                                                                              
-A ufw-before-forward -s 10.8.0.0/24 -j ACCEPT                                                                                                                                                                                                                                      
-A ufw-before-forward -d 10.8.0.0/24 -j ACCEPT                                                                                                                                                                                                                                      
# don't delete the 'COMMIT' line or these rules won't be processed                                                                                                                                                                                                                  
COMMIT                         
  • I have no idea about how ufw might interfere with Netfilter (iptables) but I'd say your ruleset for the FORWARD chain in the filter table misses one crucial bit: allowing the flow of packets to your OpenVPN's network. You currently allow the packets from it (the -s option meaning "source") so the kernel will forward the packets decapsulated from the OpenVPN tunnels; but what about them coming backwards? – kostix Sep 25 '15 at 18:28
  • i executed iptables -A ufw-before-forward -d 10.8.0.0/24 -j ACCEPT and iptables -t nat -A POSTROUTING -d 10.8.0.0/24 -o eth0 -j MASQUERA DE, But still i am not able to connect. – Madhurendra Sachan Sep 26 '15 at 1:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.