Running a second conf file

john_es

I have OpenVPN running perfectly fine w/TCP/1134:

port 1194
proto tcp
dev tun
ca ca.crt
cert my.crt
key my.key
dh dh4096.pem
server 10.0.8.0 255.255.255.0
ifconfig-pool-persist ipp-tcp.txt
push "route 10.0.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
tls-auth ta.key 0
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA
cipher AES-256-CBC
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 5
mode server
tls-server
remote-cert-tls client

I want to also run it on UDP/1194, so I was thinking of doing something like adding a new conf file like this:

port 1194
proto udp
dev tun
ca ca.crt
cert my.crt
key my.key
dh dh4096.pem
server 10.0.9.0 255.255.255.0
ifconfig-pool-persist ipp-tcp.txt
push "route 10.0.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
tls-auth ta.key 0
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA
cipher AES-256-CBC
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 5
mode server
tls-server
remote-cert-tls client

Is there any reason why this won't work?

john_es

Currently I use:

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.0.8.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.0.8.0/24 -o eth0 -j MASQUERADE

so if I did a 2nd port, I'd also add:
iptables -A FORWARD -s 10.0.9.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.9.0/24 -o eth0 -j MASQUERADE

right?

I had notes to include:
iptables -I FORWARD -eth0 -o tun0 -j ACCEPT

But I don't use it, and everything seems to work w/o it. Any idea what that line would do?

Traffic

john_es wroteI have OpenVPN running perfectly fine w/TCP/1134:

Code:
port 1194

john_es wroteI want to also run it on UDP/1194, so I was thinking of doing something like adding a new conf file like this:

Code:
port 1194

Post the correct configs and the correct logs for further assistance ..

john_es

What do you mean by correct configs? I just pulled these from my server.

Traffic

Traffic wrotejohn_es wrote:
I have OpenVPN running perfectly fine w/TCP/1134:

Code:
port 1194

You made a mistake in your post .. 1134 ..

However, TCP-1194 + UDP1194 ought to work ..
I use the same TCP port for management as I do UDP for VPN and have had no issues.. (so far)