Multiple Server Ports Problem

GeoDirk

Hi Group,

What I'm looking to do is set up my OpenVPN server so that a client can connect to either of two ports: 1194 or 443. A desktop client will connect to only one or the other port at a time...I'm not looking to have two tunnels per client going at once. I have successfully been able to configure both ports to work individually but never simultaneously. When run simultaneously, I can connect to and browse the internet from the 1194 port (which is getting run first and therefore getting Tun0). I can connect to the 443 port (Tun1) successfully, ping to the VPN server, but can't ping out to the internet. It sounds like a firewall issue but I'm not spotting anything wrong. Any ideas?

Server 1194.conf

dev tun
server 10.10.10.0 255.255.255.0
ifconfig-pool-persist ipp1194.txt
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
push "route 10.10.10.0 255.255.255.0"
push "redirect-gateway"
push "dhcp-option DNS 8.8.8.8"
float
comp-lzo
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
group nobody
crl-verify crl.pem
verb 1
log /var/openvpn.log
status openvpn-status1194.log
management 184.82.xxx.xxx 5555
port 1194
proto udp
daemon

Server 443.config

dev tun
server 10.10.10.0 255.255.255.0
ifconfig-pool-persist ipp443.txt
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
push "route 10.10.10.0 255.255.255.0"
push "redirect-gateway"
push "dhcp-option DNS 8.8.8.8"
float
comp-lzo
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
group nobody
crl-verify crl.pem
verb 1
log /var/openvpn443.log
status openvpn-status443.log
management 184.82.xxx.xxx 5556
port 443
proto udp
daemon

Client 1194.ovpn

client
remote 184.82.xxx.xxx 1194
dev tun
comp-lzo
ca xxxxx.crt
cert xxxxx.crt
key xxxxx.key
route-delay 20
route-method exe
redirect-gateway def1
dhcp-option DNS 10.10.10.1
verb 3

Client 443.conf

client
remote 184.82.xxx.xxx 443
dev tun
comp-lzo
ca xxxxx.crt
cert xxxxx.crt
key xxxxx.key
route-delay 20
route-method exe
redirect-gateway def1
dhcp-option DNS 10.10.10.1
verb 3

iptables -L -v

Chain INPUT (policy ACCEPT 196K packets, 30M bytes)
 pkts bytes target     prot opt in     out     source               destination 

Chain FORWARD (policy ACCEPT 192K packets, 206M bytes)
 pkts bytes target     prot opt in     out     source               destination 
 143K   18M ACCEPT     all  --  tun0   venet0  anywhere             anywhere    
    0     0 ACCEPT     all  --  tun1   venet0  anywhere             anywhere    

Chain OUTPUT (policy ACCEPT 234K packets, 221M bytes)
 pkts bytes target     prot opt in     out     source               destination

Mimiko

server 10.10.10.0 255.255.255.0

You have to use different networks in different config files on server. You can't assign same network mask to two different interfaces.

GeoDirk

Hi Mimiko,

Thanks for the tip but I'm still not routing that second port yet. I keep the 1194 port's config file the same but modified the 443 port's config to look like this:

dev tun
server 10.10.40.0 255.255.255.0
ifconfig-pool-persist ipp443.txt
ca ca.crt
cert xxxx.crt
key xxxx.key
dh dh1024.pem
push "route 10.10.40.0 255.255.255.0"
push "redirect-gateway"
push "dhcp-option DNS 8.8.8.8"
float
comp-lzo
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
group nobody
crl-verify crl.pem
verb 1
log /var/openvpn443.log
status openvpn-status443.log
management xxx.xxx.xxx.xxx 5556
port 443
proto udp
daemon

I'm assuming that I had to change both of the following lines, right?

server 10.10.40.0 255.255.255.0
push "route 10.10.40.0 255.255.255.0"

After a successful openvpn restart, I can still connect fine through the port 1194 one but still can't pass traffic through the 443 port?

Thanks for the help thus far,

Dirk