Hey there. I've got a working openVPN installation on my server and had successfully connected a client but only with deactivated firewall. I tracked the problem down to a port issue:
I am using the standardport 1194 and without any restrictions by iptables can see this in tcpdump (excerpt) and a successful connection between client and server:
tcpdump when it's working (without firewall)
[...]
01:34:07.703209 IP CLIENT_IP.28550 > SERVER_IP.1194: UDP, length 97
01:34:08.225493 IP SERVER_IP.1194 > CLIENT_IP.28550: UDP, length 22
01:34:08.225927 IP SERVER_IP.1194 > CLIENT_IP.28550: UDP, length 22
01:34:08.226265 IP SERVER_IP.1194 > CLIENT_IP.28550: UDP, length 22
01:34:08.237752 IP SERVER_IP.1194 > CLIENT_IP.28550: UDP, length 126
01:34:08.238049 IP SERVER_IP.1194 > CLIENT_IP.28550: UDP, length 114
01:34:08.238238 IP SERVER_IP.1194 > CLIENT_IP.28550: UDP, length 114
01:34:08.238426 IP SERVER_IP.1194 > CLIENT_IP.28550: UDP, length 114
01:34:08.333188 IP CLIENT_IP.28550 > SERVER_IP.1194: UDP, length 22
01:34:08.333437 IP SERVER_IP.1194 > CLIENT_IP.28550: UDP, length 114
01:34:08.346746 IP CLIENT_IP.28550 > SERVER_IP.1194: UDP, length 22
01:34:08.346966 IP SERVER_IP.1194 > CLIENT_IP.28550: UDP, length 114
01:34:08.348711 IP CLIENT_IP.28550 > SERVER_IP.1194: UDP, length 22
01:34:08.348929 IP SERVER_IP.1194 > CLIENT_IP.28550: UDP, length 114
[...]
if i use my firewall the server get's an initial packet, because the client calls on the right port and the packet gets forwarded to the process, but the answer is not sent out on the right port:
tcpdump when it's not working (with firewall)
01:36:09.344439 IP CLIENT_IP.27385 > SERVER_IP.1194: UDP, length 14
01:36:09.347539 IP SERVER_IP.1024 > CLIENT_IP.27385: UDP, length 26
01:36:11.602758 IP SERVER_IP.1024 > CLIENT_IP.27385: UDP, length 14
01:36:11.628571 IP CLIENT_IP.27385 > SERVER_IP.1194: UDP, length 14
01:36:11.628810 IP SERVER_IP.1024 > CLIENT_IP.27385: UDP, length 22
In the openvpn-server log i can see the following:
serverlog when it's not working (with firewall)
Wed Mar 26 02:00:33 2014 CLIENT_IP:15329 Re-using SSL/TLS context
Wed Mar 26 02:00:33 2014 CLIENT_IP:15329 LZO compression initialized
Wed Mar 26 02:00:33 2014 CLIENT_IP:15329 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Mar 26 02:00:33 2014 CLIENT_IP:15329 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Mar 26 02:00:33 2014 CLIENT_IP:15329 Local Options hash (VER=V4): '530fdded'
Wed Mar 26 02:00:33 2014 CLIENT_IP:15329 Expected Remote Options hash (VER=V4): '41690919'
Wed Mar 26 02:00:33 2014 CLIENT_IP:15329 TLS: Initial packet from [AF_INET]CLIENT_IP:15329, sid=b3684ccc efabe00a
As you can see, in the first case the server is answering on port 1194 and in the second case it does not. it uses 1024 as to be the first port for free use in the portrange above 1024. But why? 😃
I began by scratch and activating rule after rule in iptables, to see which rule breaks this up. still i can not explain, why openvpn does change it's behaviour here, because even after the following rules, it begins to use port 1024 for the answer.
Here is the flattened iptables script from that point on when it does not work anymore:
flattened iptables script when it's not working
IPT=/sbin/iptables
# FLUSH iptables
$IPT -F
$IPT -F -t nat
# POLICIES
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
# # # # # # # # # # #
# PREROUTING RULES #
# # # # # # # # # # #
$IPT -t nat -A PREROUTING -p udp -i $EXT --dport 1194 -j DNAT --to 192.168.2.1:1194
# # # # # # # # # # #
# INPUT RULES #
# # # # # # # # # # #
$IPT -A INPUT -i $LO -j ACCEPT #loopback interface
$IPT -A INPUT -i $INT -j ACCEPT #LAN interface
$IPT -A INPUT -d 192.168.2.1 -p udp --dport 1194 -j ACCEPT
I do not use masquerading here, as you can see and the output chain has no rule but accept (via policy)
i have tried the following without success:
- using REDIRECT instead of DNAT in the prerouting chain.
- using different ports internally and externally.
- tried to SNAT from 1024 to 1194 outbound port in POSTROUTING
- using NAT in the OUTPUT chain to reroute port
- adding / changing lport and rport in config files of server and host
What is iptables doing here? Or is it a openVPN issue? I am out of ideas! 🙁
As I said, the config files for server and client are correct, as the connection works fine without my firewall script. You can see them here:
server.conf
port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa2/keys/ca.crt
cert /etc/openvpn/easy-rsa2/keys/server.crt
key /etc/openvpn/easy-rsa2/keys/server.key # This file should be kept secret
dh /etc/openvpn/easy-rsa2/keys/dh2048.pem
server 192.168.250.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.2.0 255.255.255.0"
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
client.conf
client
dev tun
proto udp
remote $SERVER_NAME 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert thinkpflonk.crt
key thinkpflonk.key
ns-cert-type server
comp-lzo
verb 3
If you can tell me something like "you're dumb as 5 meters of dirt track, set this option here and there" I would be so glad, as i dont want to let down my trousers by deactivating the firewall every time i need to use openVPN 😃
thanks in advance
pflonk
