1

So I have a virtual server set up on amazon, which I will call OSERV, to run openvpn on 3 different ports. All of the OpenVPN servers are acting as routing gateways. 2 of the servers that are running over TCP work great, but my UDP server, while it is able to make local connections, always times out for external IPs. I will call it UDPSERV.

So when I ssh through UDPSERV to OSERV, it works fine. But when I try to ssh (or do any other type of activity) anywhere else through UDPSERV, the connection times out. I will call the external server i am testing on as EXSERV. I have been watched the log at verbosity level 6, and I see the packets being sent and received when trying to make the connection to EXSERV. So I know that works. I have also ran wireshark on the client machine, and see it sending and receiving packets just fine also when SSHing to EXSERV.

ssh root@ESERV -o ConnectTimeout=60
Connection reset by ESERV port 22

Though oddly, when I watch the log when doing activity through UDPSERV to OSERV, it doesn't seem to show it.

I have confirmed the MTU is not a problem. Interestingly enough, I can actually push >4000 bytes through as the MTU. I did attempt setting it to 500 at one point.

So I think that's everything I can say for the setup of this question. If anyone can help me figure out why this isn't working, I'd really appreciate it. Below this are all of my configurations.

[Edit] Oh yeah. I did a netcat through UDPSERV from my client to EXSERV and it worked fine.

All 3 of the openvpn server configs have the following relevant settings:

dev tun
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
comp-lzo
persist-key
persist-tun

Different settings:
Serv1:

port 80
proto tcp
server 10.8.0.0 255.255.255.0

Serv2:

port 443
proto tcp
server 10.8.1.0 255.255.255.0

UDPSERV:

port 123
proto udp
server 10.8.2.0 255.255.255.0

The amazon security settings have the following allowances:
Incoming ACCEPT: TCP22, TCP80, TCP443, UDP123
Outgoing ACCEPT: Everything

The following is my iptables setup:

#Clear everything out
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -t raw -F
iptables -t raw -X

#All connections
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

#Serv1
iptables -I FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -t nat -I POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE

#Serv2
iptables -I FORWARD -i tun1 -o eth0 -s 10.8.1.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -t nat -I POSTROUTING -o eth0 -s 10.8.1.0/24 -j MASQUERADE

#UDPSERV
iptables -I FORWARD -i tun2 -o eth0 -s 10.8.2.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -t nat -I POSTROUTING -o eth0 -s 10.8.2.0/24 -j MASQUERADE

I have also tried the following settings for UDPSERV:

iptables -A INPUT -i eth0 -m state --state NEW -p udp --dport 123 -j ACCEPT
iptables -I FORWARD -i tun2 -j ACCEPT
iptables -I FORWARD -i tun2 -o eth0  -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -I POSTROUTING -o eth0 -s 10.8.2.0/24 -j MASQUERADE

The following is the openvpn log at verbosity level 6. The client connected from 45.16.1.12 . I then connected to the OSERV's ssh. I then attempted to connect to EXSERV SSH which timed out after 30-ish seconds. OpenVPN log . Please let me know if you have trouble downloading the file and I'll try a different service.

  • can you post openvpn log from UDPSERV? – Guntis Dec 18 '16 at 18:51
  • The following is the openvpn log at verbosity level 6. The client connected from 45.16.1.12 . I then connected to the OSERV's ssh. I then attempted to connect to EXSERV SSH which timed out after 30-ish seconds. OpenVPN log Please let me know if you have trouble downloading the file and I'll try a different service. – Dakusan Dec 18 '16 at 19:46
  • I guess there is some routing problem. try google for MULTI: bad source address from client – Guntis Dec 19 '16 at 8:05
1

So it turns out the problem is that I was running on udp port 123 (the ntpd port). I guess some router out there must have special coding for that port to only allow small packets, or something. Time to find a different common udp port to run on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.