No ping to server behind Norton 360 Firewall (solved)

felix57

I'm new to OpenVPN and new in this forum. First, therefore, a "Hello" from Austria to everybody.
As I found (almost) all answers to my questions in this forum, please let me share the solution I did not find here or elsewhere, for getting through the Norton 360 firewall ...

My configuration:
Win8 OVPN Client -> Internet -> "Pirelli" Router (from A1 Telecom) -> Fritzbox Router -> WinXP OVPN Server.
(I know, I could dump the Pirelli Router and connect directly with the Fritzbox. But this setup gives me the advantage of being able to have devices inside and outside my local Fritzbox network connected to the Internet)

The "Problem":
Norton 360 (German version) running on client and server.

UDP 1194 portforwarding and getting through the firewalls of the 2 routers (double NAT, sorry this is not nice but it works great) was not really a problem. OVPN Client and Server connected nicely after a few tries (learning OVPN) ... but no ping between client and server. Disabled Norton firewall and ping worked. But I still wanted to keep the Norton firewall! (maybe an overkill to have the server behind 3 firewalls :oops: ? but better safe than sorry :roll: !)

So, I started to fight for almost a day with the Norton Firewall:
In "Programmregeln" (program rules?) I added and allowed all OVPN exe files I could find in the bin-folder: nothing
In "Datenverkehrregeln" (data traffic rules?) I allowed anything related with port 1194 (UDP, TCP, incoming, outgoing, local, remote): nothing

After several hours trying I finally found a solution:
In "Eigenes Netzwerk" (own network?) I got into "Zugriffskontrolle" (access control?)
The dropdown box "Netzwerkdetails" (network details?) had 3 options: the normal LAN, the OVPN LAN and another "Zugriffskontrolle"
Tried to set the OVPN LAN at "Volles Vertrauen" (fully trusted?): no effect, no ping.
Finally I entered the VPN client's IP (10.8.0.6) in "Zugriffskontrolle" and set it to fully trusted and .... HURRAAA ping worked!

With this, the only additional thing to do was to configure the VPN client with a fixed IP (to make sure it keeps working)

Hope this helps others with similar problems.
Thanks for this forum with tons of excellent posts that helped me a lot!

All the best
felix

felix57

Thanks for the feedback and my apologies for not posting the configs. You are right, they might be useful for others to analyze the setup. Here they are:

server.ovpn: (on XP machine)

port 1194
proto udp
dev tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

client.ovpn: (on Win8.1 machine; real name replaced by "client")

client
dev tun
proto udp
remote XXXXXXXXXXX.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files (x86)\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\config\\client.crt"
key "C:\\Program Files (x86)\\OpenVPN\\config\\client.key"
ns-cert-type server
comp-lzo
verb 3
explicit-exit-notify 2
ping 10
ping-restart 60

C:\Program Files\OpenVPN\config\ccd\client: (real name replaced by "client", real IP even different from ...10, but definitively not ...6 which everyone would guess)

ifconfig-push 10.8.0.10 10.8.0.9

Now, regarding your comments:

felix57 wrote:
In "Programmregeln" (program rules?) I added and allowed all OVPN exe files I could find in the bin-folder: nothing
The only rule you need for Openvpn.exe on your server is to allow incoming connections/data to your server port. On the client you allow outgoing to the server on the port. EG: UDP:1194

All other packets (such as HTTP or ICMP) are still created/owned by the original application not OpenVPN.

felix57 wrote:
In "Datenverkehrregeln" (data traffic rules?) I allowed anything related with port 1194 (UDP, TCP, incoming, outgoing, local, remote): nothing
The reason you got nothing is because the rule will not be applied for ICMP echo reply.

You are absolutely right, no program rules are needed. During Windows installation on the XP server, Norton added openvpn.exe as "OpenVPN Daemon" as allowed program rule. (I then tried to add the other programs manually, which was useless). But even the automatically generated program rule allowing openvpn.exe seems to be unnecessary: Access control set at "fully trusted" for the client's OVPN IP 10.8.0.10 overrides any (tested) attempt of blocking openvpn.exe
--> I removed all OVPN related program rules on the server's Norton Firewall and it still works fine

You are also right regarding data traffic rules. Only incoming UDP traffic on the server's local 1194 port needs to be explicitly allowed. This seems to be mandatory (and is not done automatically by Norton during installation); without, it does not work at all. Access control "fully trusted" for the client's OVPN IP 10.8.0.10 is not overriding the traffic rule (different to what it does for program rules)
--> I removed all other OVPN related data traffic rules

Bottomline: I have on the server 1 OVPN related Norton firewall rule allowing incoming UDP 1194, and 1 rule setting the client's OVPN IP to fully trusted. There was no need to change anything on the client.

Thanks also for your hint regarding "topology subnet". However I still don't understand why Norton does not trust 10.8.0.10 if I add the entire 10.8.0.0 LAN as fully trusted (well, sometimes I have doubts whether even Norton understands what the Norton does :mrgreen: - nevermind). I might try this later, if I need to connect more clients. For now I'm happy with the solution to only trust the specific predefined fix IPs of my clients.

All the best
felix

felix57

You made me curious. Against the common rule of "if it is not broken, don't fix it", I read https://community.openvpn.net/openvpn/wiki/Topology and tested it:

Added 1 line to server.ovpn:

topology subnet

Changed 1 line in C:\Program Files\OpenVPN\config\ccd\client:

# ifconfig-push 10.8.0.10 10.8.0.9
ifconfig-push 10.8.0.10 255.255.255.0

and eliminated the Norton Access control "Volles Vertrauen" (=fully trusted) of the specific IP

Restarted the Service and: Surprise!!! (for me :shock:, probably not for you 😉 ) IT WORKS! for the entire 10.8.0.0 OVPN LAN!
For completeness: Access control of the Local Area Connection of the OVPN Network can be set in Norton 360 at 4 levels: "eingeschränkt" (limited?), "geschützt" (protected?), "freigegeben" (unprotected? ) and "volles Vertrauen" (=fully trusted?). It works with "freigegeben" or higher (fully trusted).

BTW: I have absolutely no clue what "fully trusted" actually means in Norton. I also doubt that they fully disclose the details. But anyway I guess this is off-topic here.

BTW2: I configured the Norton OVPN LAN Connection back to "protected" and "fully trusted" only the assigned fixed IP (in my opinion no need to keep all IPs available if I only want to connect 1 or 2 clients). The good thing is that in subnet mode I have 255 IPs to choose from and not only 63.

Thanks again for your comments!
I think I'll need to spend some more hours reading on topologies to understand what I did :mrgreen:

All the best
felix