I installed Openvpn in my server which already had UFW installed i enabled ip forward in vi /etc/sysctl.conf applied changes using sysctl -p

I also enabled forwarding using echo 1 > /proc/sys/net/ipv4/ip_forward

frowarding using ip table

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

allowed ufw

ufw allow 1194/udp  
ufw allow 1194/tcp

I restarted server, openvpn and all but client doesn't connect but if i disable ufw using ufw disable connection is successful.

below is content of /etc/default/ufw

# /etc/default/ufw                                                                                                                                                                                                                                                                  

# Set to yes to apply rules to support IPv6 (no means only IPv6 on loopback                                                                                                                                                                                                         
# accepted). You will need to 'disable' and then 'enable' the firewall for                                                                                                                                                                                                          
# the changes to take affect.                                                                                                                                                                                                                                                       

# Set the default input policy to ACCEPT, DROP, or REJECT. Please note that if                                                                                                                                                                                                      
# you change this you will most likely want to adjust your rules.                                                                                                                                                                                                                   

# Set the default output policy to ACCEPT, DROP, or REJECT. Please note that if                                                                                                                                                                                                     
# you change this you will most likely want to adjust your rules.                                                                                                                                                                                                                   

# Set the default forward policy to ACCEPT, DROP or REJECT.  Please note that                                                                                                                                                                                                       
# if you change this you will most likely want to adjust your rules                                                                                                                                                                                                                 

# Set the default application policy to ACCEPT, DROP, REJECT or SKIP. Please                                                                                                                                                                                                        
# note that setting this to ACCEPT may be a security risk. See 'man ufw' for                                                                                                                                                                                                        
# details                                                                                                                                                                                                                                                                           

# By default, ufw only touches its own chains. Set this to 'yes' to have ufw                                                                                                                                                                                                        
# manage the built-in chains too. Warning: setting this to 'yes' will break                                                                                                                                                                                                         
# non-ufw managed firewall rules                                                                                                                                                                                                                                                    

# IPT backend                                                                                                                                                                                                                                                                       
# only enable if using iptables backend                                                                                                                                                                                                                                             

# Extra connection tracking modules to load. Complete list can be found in                                                                                                                                                                                                          
# net/netfilter/Kconfig of your kernel source. Some common modules:                                                                                                                                                                                                                 
# nf_conntrack_irc, nf_nat_irc: DCC (Direct Client to Client) support                                                                                                                                                                                                               
# nf_conntrack_netbios_ns: NetBIOS (samba) client support                                                                                                                                                                                                                           
# nf_conntrack_pptp, nf_nat_pptp: PPTP over stateful firewall/NAT                                                                                                                                                                                                                   
# nf_conntrack_ftp, nf_nat_ftp: active FTP support                                                                                                                                                                                                                                  
# nf_conntrack_tftp, nf_nat_tftp: TFTP support (server side)                                                                                                                                                                                                                        
IPT_MODULES="nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns"     

below is content of /etc/ufw/before.rules

# rules.before                                                                                                                                                                                                                                                                      
# Rules that should be run before the ufw command line added rules. Custom                                                                                                                                                                                                          
# rules should be added to one of these chains:                                                                                                                                                                                                                                     
#   ufw-before-input                                                                                                                                                                                                                                                                
#   ufw-before-output                                                                                                                                                                                                                                                               
#   ufw-before-forward                                                                                                                                                                                                                                                              

# START OPENVPN RULES                                                                                                                                                                                                                                                               
# NAT table rules                                                                                                                                                                                                                                                                   
:POSTROUTING ACCEPT [0:0]                                                                                                                                                                                                                                                           
# Allow traffic from OpenVPN client to eth0                                                                                                                                                                                                                                         
-A POSTROUTING -s -o eth0 -j MASQUERADE                                                                                                                                                                                                                                 


-A ufw-before-input -i tun+ -j ACCEPT                                                                                                                                                                                                                                               
-A ufw-before-output -i tun+ -j ACCEPT                                                                                                                                                                                                                                              
-A ufw-before-forward -s -j ACCEPT                                                                                                                                                                                                                                      
-A ufw-before-forward -d -j ACCEPT                                                                                                                                                                                                                                      
# don't delete the 'COMMIT' line or these rules won't be processed                                                                                                                                                                                                                  
  • I have no idea about how ufw might interfere with Netfilter (iptables) but I'd say your ruleset for the FORWARD chain in the filter table misses one crucial bit: allowing the flow of packets to your OpenVPN's network. You currently allow the packets from it (the -s option meaning "source") so the kernel will forward the packets decapsulated from the OpenVPN tunnels; but what about them coming backwards? – kostix Sep 25 '15 at 18:28
  • i executed iptables -A ufw-before-forward -d -j ACCEPT and iptables -t nat -A POSTROUTING -d -o eth0 -j MASQUERA DE, But still i am not able to connect. – Madhurendra Sachan Sep 26 '15 at 1:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.