First daemon working fine, second daemon not routing

pyrobisqit

I have set up an OpenVPN server for port 443 on protocol TCP, to circumvent restrictions and make it look like HTTPS (sort of) so it doesn't look too suspicious.

Now I also want to use the same certificates on port 443, but this time on protocol UDP, so I can connect from home and not have the overhead TCP generates with confirming each packet.

I know both servers can't coexist in the same virtual network address space. The TCP server is using 10.9.8.x, while the UDP server is using 10.11.12.x.

I have also updated my firewall rules (ufw) to allow UDP traffic. I have even updated iptables rules for traffic forwarding (using this tiny script I wrote myself a few months ago https://github.com/pyrobisqit/ovpn-forward) replacing 10.9.8.0 with 10.11.12.0 for the UDP server.

I also removed ipp.txt from both config files.

Like I said, the TCP server works fine, but the UDP server won't let me browse the web from the client machine. While connecting to the TCP server and checking my IP shows my OpenVPN server address.

I also get millions of these messages

pyrobisqit-pc/x.x.x.x:65502 MULTI: bad source address from client [x:x:x:x:x:x:x:x], packet dropped

on both TCP and UDP protocols, but while TCP works fine, UDP doesn't.

I really don't know what else can I do. I'm completely lost.

maikcat

post your configs used & your NAT rules.

the bad source address errors comes from win clients with ipv6 enabled.

Michael.

pyrobisqit

This is the TCP server:
http://goo.gl/C0Fa6Z

And this is the UDP server:
http://goo.gl/jmzlFN

This is the routing table:
http://goo.gl/3PQfJ5

These are my NAT rules:
http://goo.gl/onJRUv

I just realized that after installing the modified ovpn-forward daemon, (I called it ovpn-forward-udp), I forgot to start it...

# service ovpn-forward-udp start

fixes it.

Now my NAT rules look like this:
http://goo.gl/pGtiI6

(and clients do browse the web using the OpenVPN server IP address, of course)

Interestinly enough, I fixed the problem myself. But only posting this in the forums made me realize my mistake.

Now, what can I do about the bad source address errors? Can it be safely ignored? Or is there a parameter in the server-side or client-side config file? Because if my users have to change settings through control panel, they won't know how to do it 😛

maikcat

Now, what can I do about the bad source address errors? Can it be safely ignored? Or is there a parameter in the server-side or client-side config file? Because if my users have to change settings through control panel, they won't know how to do it 😛

yeap they can ignored,you can always disable ipv6 on your clients tap adapter...

Michael.