openvpn can't ping Internet with udp enabled; works with tcp

lcguy229

Hi,

I am having problem with openVPN using "udp". It works well with tcp.
I am testing with CentOS 5.7.
Here is the layout.

Client (XP) ----> CentOS5.7 (virtualbox) eth0 (192.168.0.50) gw (192.168.0.1) --> Host OS is Window 7.

Server config file is as follow;

local 192.168.0.50
port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 192.168.0.1"
duplicate-cn
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn.log
verb 6

IP Tables is as follows.

*nat
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
*filter
-A INPUT -i lo -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A INPUT -i tun1 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A INPUT -p esp -j ACCEPT
-A INPUT -p ah -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 1194 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i tun0 -o eth0 -j ACCEPT
-A FORWARD -i tun1 -o lo -j ACCEPT
-A FORWARD -i eth0 -o tun0 -j ACCEPT
-A FORWARD -i lo -o tun1 -j ACCEPT
COMMIT

One notices is that when I used UDP, there is two tunnel interfaces tun0 and tun1. After I manually shutdown loopback (lo), it works well with UDP. I have no idea with it.

In using with TCP, there is no two tunnels up and working well.

Any help is much appreciated

maikcat

One notices is that when I used UDP, there is two tunnel interfaces tun0 and tun1. After I manually shutdown loopback (lo), it works well with UDP. I have no idea with it.

:?: :?: :?: :?:

are you stopping the tcp based openvpn before you start the udp one?

can you post the output of

ps ax | grep openvpn | grep -v grep

when there are 2 tun interfaces up?

Michael