verts Hello everyone. The question is effectively about firewall settings, but the firewall is on a machine that's different from the one OpenVPN is running on. That's why I can't apply the usual advice to 'open all connections for the TUN interface' - in my case, those connections are intermixed with the rest. Simply put, I need to know which ports to open on the gateway machine. I've had my share of packet monitoring, and certainly can see that the ovpn machine opens a number of ephemeral high ports to communicate with the server's port 443. (I use UDP as a matter of choice). So far, so good. However, even after I allowed that traffic, I still get TLS errors ('key negotiation failed' and 'handshake failed'). I should add that OpenVPN works flawlessly in the absence of filtering rules on the gateway. But ditching the gateway is not an option. I can't figure out what's going on by just looking at the packets. Could someone shed some light, please? [oconf=]firewall / gateway[/oconf]
MikeRobinson The only port that needs to be open on the gateway is the UDP port, but you must also be sure that the traffic is successfully routed from the gateway to and from the OpenVPN service machine. if you see UDP traffic flowing successfully in both directions, the communications issue should now be solved and the next root-cause error is somewhere else.
