I am trying to make OpenVPN AS (in routed mode) work with a ufw-managed firewall. It seems that connections to initiate VPN connections are somehow being blocked by the firewall rules:
Jan 9 10:24:16 air kernel: [37812176.285043] [UFW BLOCK] IN=eth0 OUT= MAC=00:22:19:89:35:77:00:d0:03:19:00:00:08:00 SRC=199.254.56.254 DST=86.58.167.65 LEN=44 TOS=0x00 PREC=0x00 TTL=248 ID=27367 DF PROTO=TCP SPT=53 DPT=40980 WINDOW=4380 RES=0x00 ACK SYN URGP=0
Jan 9 10:26:21 air kernel: [37812301.461773] [UFW BLOCK] IN=eth0 OUT= MAC=00:22:19:89:35:77:00:d0:03:19:00:00:08:00 SRC=75.126.16.5 DST=86.58.167.65 LEN=40 TOS=0x00 PREC=0x00 TTL=100 ID=766 DF PROTO=TCP SPT=21 DPT=1024 WINDOW=8192 RES=0x00 ACK SYN URGP=0
Jan 9 10:30:30 air kernel: [37812550.793821] [UFW BLOCK] IN=eth0 OUT= MAC=00:22:19:89:35:77:00:d0:03:19:00:00:08:00 SRC=199.254.56.254 DST=86.58.167.65 LEN=44 TOS=0x00 PREC=0x00 TTL=248 ID=1472 DF PROTO=TCP SPT=53 DPT=40980 WINDOW=4380 RES=0x00 ACK SYN URGP=0
Jan 9 10:34:00 air kernel: [37812760.462158] [UFW BLOCK] IN=eth0 OUT= MAC=00:22:19:89:35:77:00:d0:03:19:00:00:08:00 SRC=61.160.201.26 DST=86.58.167.66 LEN=48 TOS=0x00 PREC=0x00 TTL=112 ID=1145 PROTO=TCP SPT=56506 DPT=5900 WINDOW=65535 RES=0x00 SYN URGP=0
Jan 9 10:34:00 air kernel: [37812760.462777] [UFW BLOCK] IN=eth0 OUT= MAC=00:22:19:89:35:77:00:d0:03:19:00:00:08:00 SRC=61.160.201.26 DST=86.58.167.64 LEN=48 TOS=0x00 PREC=0x00 TTL=112 ID=56201 PROTO=TCP SPT=56506 DPT=5900 WINDOW=65535 RES=0x00 SYN URGP=0
Jan 9 10:34:00 air kernel: [37812760.487072] [UFW BLOCK] IN=eth0 OUT= MAC=00:22:19:89:35:77:00:d0:03:19:00:00:08:00 SRC=61.160.201.26 DST=86.58.167.65 LEN=48 TOS=0x00 PREC=0x00 TTL=113 ID=50392 PROTO=TCP SPT=56506 DPT=5900 WINDOW=65535 RES=0x00 SYN URGP=0
Jan 9 10:34:48 air kernel: [37812808.721257] [UFW BLOCK] IN=eth0 OUT= MAC=00:22:19:89:35:77:00:d0:03:19:00:00:08:00 SRC=110.34.147.185 DST=86.58.167.66 LEN=44 TOS=0x00 PREC=0x00 TTL=118 ID=1886 PROTO=TCP SPT=80 DPT=64324 WINDOW=16384 RES=0x00 ACK SYN URGP=0
I have attempted to open for all traffic on the virtual interfaces with the following rules in /etc/ufw/before.rules, but with no effect:
-A ufw-before-input -i as0t0 -j ACCEPT
-A ufw-before-forward -i as0t0 -j ACCEPT
-A ufw-before-input -i as0t1 -j ACCEPT
-A ufw-before-forward -i as0t1 -j ACCEPT
-A ufw-before-input -i as0t2 -j ACCEPT
-A ufw-before-forward -i as0t2 -j ACCEPT
-A ufw-before-input -i as0t3 -j ACCEPT
-A ufw-before-forward -i as0t3 -j ACCEPT
-A ufw-before-input -i as0t4 -j ACCEPT
-A ufw-before-forward -i as0t4 -j ACCEPT
What am I missing?
Thanks in advance.
