Hi, I'm having some issues with changing OpenVPN UDP to TCP. UDP, as configured, works perfectly fine - I am able to connect to VPN server, and access all internet services.
When I make the appropriate configurations in server.conf to change from UDP to TCP, I can connect to the VPN server just fine; I am able to access all services via the VPN - but with one exception: anything that runs over port 443. So for instance, I can visit
http://www.website.com, but not
https://www.website.com. This has got to be a simple iptables fix, but I can't figure it out. I post server.conf and iptables configuration below. Thank you so much for your help!!
dev tun
proto tcp
port 443
ca blah
cert blah
key blah
dh blah
server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.0.30 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
push "dhcp-option DNS 192.168.0.1" # This should already match your router address and not need to be changed.
push "redirect-gateway def1"
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-256-CBC
keysize 256
comp-lzo
user pi
group pi
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 6
For simplicity, I'm going to just post my firewall script:
# Flush all current rules from iptables
iptables -F
#
#
# Set access for localhost - necessary for many programs
iptables -A INPUT -i lo -j ACCEPT
#
#
# Accept packets belonging to established and related connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#
#
# This is essential when working on remote servers via SSH to prevent locking yourself out of the system
# iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
#
#
# Allows VPN traffic to Forward
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
#
#
# Make and exception to 'iptables -P FORWARD DROP', allowing specifically 1194 connections to forward. Note that 192.168.0.30 could come with a port, i.e., 192.168.0.30:22 (or even a range of ports), allowing the VPN client to forward (access) only one port on the outbound. See http://www.thegeekstuff.com/2011/06/iptables-rules-examples/
#iptables -t nat -A PREROUTING -p udp --dport 1194 -j DNAT --to 192.168.0.30
iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to 192.168.0.30
#
#
# Allows proper routing of VPN subnet
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
#iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.0.30
#
#
# Set default policies for INPUT, FORWARD and OUTPUT chains
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
#
#
# Save settings
/sbin/service iptables save
#
#
# List rules, verbose
iptables -L -v
Again, thanks so much for any help with this!!
