Hi, I have just install openvpn on a Debian11. I have write iptables command to let coming input/output/forward a port, but it still closed. So, what is the commande line to have the same iptables line, like this : (cause the 943 is officialy open....) [b]AS0_WEBACCEPT tcp -- anywhere mywebsite.com state NEW tcp dpt:943[/b] With another tcp / udp port ? Cause if I write : iptables -I INPUT -p udp --dport XXXX -j ACCEPT The port still closed. Thanks for your help Best regards

Hi jc, Two things. First, in recent Debian you're not actually using iptables; it's using [b]iptables-nft[/b], the translation layer for [b]nft[/b]. We do not support this. Use [b]update-alternatives(1)[/b] to set [b]iptables[/b] to [b]iptables-legacy[/b]. Second, if a port is forwarded using a DNAT target in the [b]nat[/b] table, that packet will not be seen in the [b]filter[/b] table's [b]INPUT[/b] chain. It would go into the [b]FORWARD[/b] chain. Show your [code]iptables-save -c[/code] output if you need help with this (of course after you update-alternatives, and then to be sure nft is gone, reboot.) regards, rob0

iptables for AS0_WEBACCEPT

jcpamart

Hi,
I have just install openvpn on a Debian11.
I have write iptables command to let coming input/output/forward a port, but it still closed.
So, what is the commande line to have the same iptables line, like this : (cause the 943 is officialy open....)

AS0_WEBACCEPT tcp -- anywhere mywebsite.com state NEW tcp dpt:943
With another tcp / udp port ?

Cause if I write : iptables -I INPUT -p udp --dport XXXX -j ACCEPT
The port still closed.

Thanks for your help
Best regards

openvpn_inc

Hi jc,

Two things. First, in recent Debian you're not actually using iptables; it's using iptables-nft, the translation layer for nft. We do not support this. Use update-alternatives(1) to set iptables to iptables-legacy.

Second, if a port is forwarded using a DNAT target in the nat table, that packet will not be seen in the filter table's INPUT chain. It would go into the FORWARD chain.

Show your

iptables-save -c

output if you need help with this (of course after you update-alternatives, and then to be sure nft is gone, reboot.)

regards, rob0