Listen to both TCP and UDP at the same time

chrispersson

I have a VPS that I have set up OpenVPN to listen to TCP and UDP.

Both work individually, both when running both at the same time I can still connect to both but can only with the TCP one can I browse the web.

Here is the configurations.
tcp.conf

port 443
proto tcp
dev tun
ca easy-rsa/keys/ca.crt
cert easy-rsa/keys/myserver.crt
key easy-rsa/keys/myserver.key  # This file should be kept secret
dh easy-rsa/keys/dh1024.pem
server 192.168.3.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.4.4"
push "dhcp-option DNS 8.8.8.8"
duplicate-cn
keepalive 10 120
cipher BF-CBC        # Blowfish (default)
comp-lzo
max-clients 100
persist-key
persist-tun
status openvpn-status.log
verb 3

chrispersson

udp.conf

port 1194
proto udp
dev tun
ca easy-rsa/keys/ca.crt
cert easy-rsa/keys/myserver.crt
key easy-rsa/keys/myserver.key  # This file should be kept secret
dh easy-rsa/keys/dh1024.pem
server 192.168.2.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.4.4"
push "dhcp-option DNS 8.8.8.8"
duplicate-cn
keepalive 10 120
cipher BF-CBC        # Blowfish (default)
comp-lzo
max-clients 100
persist-key
persist-tun
status openvpn-status.log
verb 3

And then I set up iptables like this:

iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -I INPUT -p tcp --dport 443 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -d 0.0.0.0/0 -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.3.0/24 -d 0.0.0.0/0 -o eth0 -j MASQUERADE
#default firewall in centos forbids these
iptables -I FORWARD -i eth0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o eth0 -j ACCEPT

#not sure if these are really necessary, they probably are the default.
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT

chrispersson

What am I doing wrong? Please help

maikcat

for testing disable firewall rules and leave only the ones for NAT.

also for the record please post the output of:

iptables -L -v
iptables -L -v -t nat

Michael.

chrispersson

[root@test11 ~]# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination 
    1    60 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ftp
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ftp
 168K   23M ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED
    8   288 ACCEPT     icmp --  any    any     anywhere             anywhere    
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere    
10508  628K ACCEPT     tcp  --  any    any     anywhere             anywhere            state NEW tcp dpt:ssh
 1732  105K REJECT     all  --  any    any     anywhere             anywhere            reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination 
    0     0 ACCEPT     all  --  tun0   eth0    anywhere             anywhere    
    0     0 ACCEPT     all  --  eth0   tun0    anywhere             anywhere    
    0     0 ACCEPT     all  --  tun0   eth0    anywhere             anywhere    
    0     0 ACCEPT     all  --  eth0   tun0    anywhere             anywhere    
    0     0 REJECT     all  --  any    any     anywhere             anywhere            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 104 packets, 17420 bytes)
 pkts bytes target     prot opt in     out     source               destination

chrispersson

iptables -L -v -t nat
Chain PREROUTING (policy ACCEPT 48 packets, 2388 bytes)
 pkts bytes target     prot opt in     out     source               destination 

Chain INPUT (policy ACCEPT 1 packets, 28 bytes)
 pkts bytes target     prot opt in     out     source               destination 

Chain OUTPUT (policy ACCEPT 4 packets, 280 bytes)
 pkts bytes target     prot opt in     out     source               destination 

Chain POSTROUTING (policy ACCEPT 4 packets, 280 bytes)
 pkts bytes target     prot opt in     out     source               destination 
    0     0 MASQUERADE  all  --  any    eth0    192.168.2.0/24       anywhere   
    0     0 MASQUERADE  all  --  any    eth0    192.168.3.0/24       anywhere   
    0     0 MASQUERADE  all  --  any    eth0    192.168.2.0/24       anywhere   
    0     0 MASQUERADE  all  --  any    eth0    192.168.3.0/24       anywhere

maikcat

using tun0 on your forward rules automatically drops traffic for tun1...

if you start tcp based first then udp ,tcp based traffic passes but udp get dropped..

try using tun+

Michael.

chrispersson

Thanks maikcat! That worked 🙂

maikcat

im glad you worked it out.

closing topic

Michael.