Server cannot start

xmteam

Whenever I try to start my OpenVPN server from the web interface (Access Server), I get this message: "Error: iptables service not started because of error (SVC_RUN_EXCEPT)". A quick search of the web said that this: http://www.openvpn.net/index.php/access-server/docs/admin-guides/186-how-to-run-access-server-on-a-vps-container.html would work, but it didn't.

I am getting this on a VPS container running CentOS 5.8 x64.
Does anyone have a solution?

ddog800

Log into the console as root and run

# service iptables start

and see how that goes. If it starts OK, then try to start the AS server again.

Also, if you don't have iptables running already, then you will want to make sure you have a good set of rules in place. Run

# cat /etc/sysconfig/iptables

to see what's configured at boot time and

# iptables -L

to see what's there at the moment. and make sure you have some rules in place.

xmteam

Running "service iptables start" returns 4 OK's, and running "cat /etc/sysconfig/iptables" returns this:

# Generated by iptables-save v1.3.5 on Thu Apr 19 13:12:12 2012
*mangle
:PREROUTING ACCEPT [3477:2633547]
:INPUT ACCEPT [3477:2633547]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [3273:1676234]
:POSTROUTING ACCEPT [3273:1676234]
COMMIT
# Completed on Thu Apr 19 13:12:12 2012
# Generated by iptables-save v1.3.5 on Thu Apr 19 13:12:12 2012
*filter
:INPUT DROP [15:756]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:VZ_FORWARD - [0:0]
:VZ_INPUT - [0:0]
:VZ_OUTPUT - [0:0]
-A INPUT -j VZ_INPUT
-A FORWARD -j VZ_FORWARD
-A OUTPUT -j VZ_OUTPUT
-A VZ_INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A VZ_INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A VZ_INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A VZ_INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A VZ_INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A VZ_INPUT -p udp -m udp --dport 53 -j ACCEPT
-A VZ_INPUT -p tcp -m tcp --dport 32768:65535 -j ACCEPT
-A VZ_INPUT -p udp -m udp --dport 32768:65535 -j ACCEPT
-A VZ_INPUT -p tcp -m tcp --dport 8880 -j ACCEPT
-A VZ_INPUT -p tcp -m tcp --dport 8443 -j ACCEPT
-A VZ_INPUT -s 127.0.0.1 -d 127.0.0.1 -p tcp -j ACCEPT
-A VZ_INPUT -s 127.0.0.1 -d 127.0.0.1 -p udp -j ACCEPT
-A VZ_INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A VZ_INPUT -p tcp -m tcp --dport 943 -j ACCEPT
-A VZ_INPUT -p tcp -m tcp --dport 1194 -j ACCEPT
-A VZ_INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A VZ_OUTPUT -p tcp -m tcp --sport 80 -j ACCEPT
-A VZ_OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT
-A VZ_OUTPUT -p tcp -m tcp --sport 25 -j ACCEPT
-A VZ_OUTPUT -p tcp -m tcp --sport 110 -j ACCEPT
-A VZ_OUTPUT -p tcp -m tcp --sport 53 -j ACCEPT
-A VZ_OUTPUT -p udp -m udp --sport 53 -j ACCEPT
-A VZ_OUTPUT -p tcp -j ACCEPT
-A VZ_OUTPUT -p udp -j ACCEPT
-A VZ_OUTPUT -p tcp -m tcp --sport 8880 -j ACCEPT
-A VZ_OUTPUT -p tcp -m tcp --sport 8443 -j ACCEPT
-A VZ_OUTPUT -s 127.0.0.1 -d 127.0.0.1 -p tcp -j ACCEPT
-A VZ_OUTPUT -s 127.0.0.1 -d 127.0.0.1 -p udp -j ACCEPT
-A VZ_OUTPUT -p tcp -m tcp --sport 443 -j ACCEPT
-A VZ_OUTPUT -p tcp -m tcp --sport 943 -j ACCEPT
-A VZ_OUTPUT -p tcp -m tcp --sport 1194 -j ACCEPT
-A VZ_OUTPUT -p tcp -m tcp --sport 1194 -j ACCEPT
COMMIT
# Completed on Thu Apr 19 13:12:12 2012
# Generated by iptables-save v1.3.5 on Thu Apr 19 13:12:12 2012
*nat
:PREROUTING ACCEPT [155:7782]
:POSTROUTING ACCEPT [152:10639]
:OUTPUT ACCEPT [152:10639]
COMMIT
# Completed on Thu Apr 19 13:12:12 2012

Running "iptables -L" returns this:

Chain INPUT (policy DROP)
target     prot opt source               destination
VZ_INPUT   all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
VZ_FORWARD  all  --  anywhere             anywhere

Chain OUTPUT (policy DROP)
target     prot opt source               destination
VZ_OUTPUT  all  --  anywhere             anywhere

Chain VZ_FORWARD (1 references)
target     prot opt source               destination

Chain VZ_INPUT (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere            tcp dpts:filenet-tms:65535
ACCEPT     udp  --  anywhere             anywhere            udp dpts:filenet-tms:65535
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:cddbp-alt
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pcsync-https
ACCEPT     tcp  --  localhost.localdomain  localhost.localdomain
ACCEPT     udp  --  localhost.localdomain  localhost.localdomain
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:943
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:openvpn
ACCEPT     udp  --  anywhere             anywhere            udp dpt:openvpn

Chain VZ_OUTPUT (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:http
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:smtp
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:pop3
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:domain
ACCEPT     udp  --  anywhere             anywhere            udp spt:domain
ACCEPT     tcp  --  anywhere             anywhere
ACCEPT     udp  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:cddbp-alt
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:pcsync-https
ACCEPT     tcp  --  localhost.localdomain  localhost.localdomain
ACCEPT     udp  --  localhost.localdomain  localhost.localdomain
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:https
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:943
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:openvpn
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:openvpn

ddog800

Looks like the iptables service is running fine now. Are you now able to start the AS service as well?

xmteam

I was always able to start the access server from "/etc/init.d/openvpnas start", and I can access the web admin interface, but it just gives me the "SVC_RUN_EXCEPT" to do with iptables when I try to start the server from the web admin.

danblee

Hey I know this is an old post, but I thought this would help. Odds are you are not only running this on a VPS, but your host is using OpenVZ, which means TUN/TAP is not enabled on the container. I made a quick post about it on my blog. Hope this helps!

http://danblee.com/iptables-service-not-started-because-of-error-svc_run_except/