m3tatr0n
Hi All,
I have a Debian Linux at home serving as a firewall. I have computers behind the firewall
that successfully connects to my work's openvpn server using tap. But from the firewall
itself the connection just hangs, this is the last line from the connection:
UDPv4 link remote: [AF_INET]openpvn_server_ip_address:1194
If I disable iptables. I can connect just fine.
TIA
m3tatr0n
Server
port 1194
proto udp
dev tap1
ca /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/ca.crt
cert /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/server.crt
key /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/server.key # This file should be kept secret
dh /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.10.1 255.255.255.0 192.168.10.100 192.168.10.110
duplicate-cn
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn/tdt_openvpn.log
log-append /var/log/openvpn/tdt_openvpn.log
verb 3
inactive 1800
management localhost 7505
Client
client
dev tun
proto udp
remote 66.11.95.1 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert mfoliot.crt
key mfoliot.key
comp-lzo
verb 3
I have a Debian Linux at home serving as a firewall. I have computers behind the firewall
that successfully connects to my work's openvpn server using tap. But from the firewall
itself the connection just hangs, this is the last line from the connection:
UDPv4 link remote: [AF_INET]openpvn_server_ip_address:1194
If I disable iptables. I can connect just fine.
m3tatr0n
I am very sorry... I got mixed up with the client config.
I am at work right now but have a copy of the client config on my computer here
at work but it looks like it was the old one. Also I have two server config one is listening
on 1194 and one on 1195.
I do believe it's an iptables issue but I have no idea what rules to add in order for the firewall
to connect to the OpenVPN server.
Server1
port 1194
proto udp
dev tap1
ca /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/ca.crt
cert /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/server.crt
key /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/server.key # This file should be kept secret
dh /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.10.1 255.255.255.0 192.168.10.100 192.168.10.110
duplicate-cn
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn/tdt_openvpn.log
log-append /var/log/openvpn/tdt_openvpn.log
verb 3
inactive 1800
management localhost 7505
Server2
port 1195
proto udp
dev tap0
ca /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/ca.crt
cert /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/server.crt
key /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/server.key # This file should be kept secret
dh /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.2.15 255.255.255.0 192.168.2.195 192.168.2.199
push "dhcp-option DNS 192.168.2.15"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-dmt-status.log
log /var/log/openvpn/dmt_openvpn.log
log-append /var/log/openvpn/dmt_openvpn.log
verb 3
inactive 1800
Cleint1
client
dev tap
proto udp
remote 66.11.95.1 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert mfoliot.crt
key mfoliot.key
comp-lzo
verb 3
Client2
client
dev tap
proto udp
remote 66.11.95.1 1195
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert robertof.crt
key robertof.key
comp-lzo
verb 3
m3tatr0n
added rule:
/sbin/iptables -A INPUT -p udp --source-port 1194 -j ACCEPT
m3tatr0n
Yes it is solved.
