openvpn and upd stops working

dkorzhevin

Hi,

I try to block upd traffic on server - upd ports more than 1026, using iptables with next rules:

iptables -A INPUT -p udp -m udp --dport 1026:5999 -j DROP
iptables -A OUTPUT -p udp -m udp --dport 1026:5999 -j DROP
iptables -A FORWARD -p udp -m udp --dport 1026:5999 -j DROP
iptables -A INPUT -p udp -m udp --dport 6001:65535 -j DROP
iptables -A OUTPUT -p udp -m udp --dport 6001:65535 -j DROP
iptables -A FORWARD -p udp -m udp --dport 6001:65535 -j DROP

But, after i apply this rules, i can't connect to openvpn 6000 udp port. Please advice?

maikcat

with a quick look to your rules i noticed that you also drop
outgoing udp traffic to your openvpn clients...

which port they are using as their source port?

Michael.

dkorzhevin

Hi!

Openvpn server works on 6000 udp

maikcat

you dont answering my question... :S

when you open a connection (lets say from your client to your openvpn server) this session
has 4 properties:

source ip
source port
destination ip
destination port

6000/udp is DESTINATION port,your openvpn session has also source port which you probably filter with these rules

iptables -A OUTPUT -p udp -m udp --dport 6001:65535 -j DROP
iptables -A OUTPUT -p udp -m udp --dport 1026:5999 -j DROP

do something else,
try to add one rule at a time and see which rule causes your openvpn to fail...

Michael.

dkorzhevin

Hi,

Thank you for answer! Can you please advice the best way to:

1. Allow both tcp and udp ports 1-1024
2. Allow openvpn on ports:

21 tcp
443 tcp
6000 udp
3. block all udp ports >1024, except 21,443,6000

And thank you for your help

dkorzhevin

I try next iptables rules:

iptables -I OUTPUT 2 -p udp --dport 53 -j ACCEPT
iptables -I OUTPUT 2 -p udp --dport 1700:1750 -j ACCEPT
iptables -I OUTPUT 3 -p udp -m udp --dport 1812 -j ACCEPT
iptables -I OUTPUT 5 -p udp -m udp --dport 1813 -j ACCEPT
iptables -I OUTPUT 5 -p udp -m udp --dport 5950:6050 -j ACCEPT
iptables -I OUTPUT 5 -p udp -m udp --dport 499:510 -j ACCEPT
iptables -I OUTPUT 5 -p udp -m udp --dport 4490:4550 -j ACCEPT
iptables -I OUTPUT 20 -p udp -j DROP

But after apply: ipsec, l2tp and openvpn upd on port 6000 stops working..

maikcat

just curious...

why are you filtering OUTGOING traffic?

Michael.

dkorzhevin

I trying to block torrents, as they use UDP traffic and ports >6000