Unable to connect to my OpenVPN AS

[risker]

I'm under the impression that OpenVPN AS does all the port forwarding and so forth with the latest version and I'm having some issues. I think my ports aren't forwarded correctly and everywhere I look, gives me the same iptables to add but it doesn't fix my problem.


When I attempt to connect on the 1194 port I get this error;
Unable to obtain Session ID from vps.clanmn.net:1194: XML-RPC: ConnectionRefusedError: 10061: No connection could be made because the target machine actively refused it..

But I try connect on the openvpn 443 I get this error;
OpenVPNClient start vps_clanmn_net_443_u2906: process started but is unresponsive

Below I have the netstat, which shows that neither 443 or 1943 are possible and after that I'll have my iptables file. I have quite basic knowledge with what I'm doing and my host wanted $80 to assist me with this, so I decided I'd go with your support plus I think you guys will know what you're doing better. ^_^

I have my TAP/TUN, NAT and iptable modules all enabled and I believe that's all I need. I'm also using all default settings.


netstat -lnp

Code: Select all

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:904 0.0.0.0:* LISTEN 2004/python
tcp 0 0 127.0.0.1:905 0.0.0.0:* LISTEN 2004/python
tcp 0 0 127.0.0.1:906 0.0.0.0:* LISTEN 2004/python
tcp 0 0 127.0.0.1:907 0.0.0.0:* LISTEN 2004/python
tcp 0 0 127.0.0.1:908 0.0.0.0:* LISTEN 2004/python
tcp 0 0 127.0.0.1:909 0.0.0.0:* LISTEN 2004/python
tcp 0 0 103.4.16.128:943 0.0.0.0:* LISTEN 2004/python
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1528/httpd
tcp 0 0 103.4.16.128:914 0.0.0.0:* LISTEN 2016/openvpn
tcp 0 0 103.4.16.128:915 0.0.0.0:* LISTEN 2023/openvpn
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1493/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1510/sendmail
udp 0 0 103.4.16.128:916 0.0.0.0:* 2031/openvpn
udp 0 0 103.4.16.128:917 0.0.0.0:* 3096/openvpn
Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node PID/Program name Path
unix 2 [ ACC ] STREAM LISTENING 22538411 2001/python /usr/local/openvpn_as/etc/sock/sagent
unix 2 [ ACC ] STREAM LISTENING 22538415 2001/python /usr/local/openvpn_as/etc/sock/sagent.localroot
unix 2 [ ACC ] STREAM LISTENING 22538417 2001/python /usr/local/openvpn_as/etc/sock/sagent.api
unix 2 [ ACC ] STREAM LISTENING 22421327 1202/iscsiuio @ISCSID_UIP_ABSTRACT_NAMESPACE

iptables --list

Code: Select all

Chain INPUT (policy ACCEPT)
target prot opt source destination
AS0_ACCEPT all -- anywhere anywhere state RELATED,ESTA BLISHED
AS0_ACCEPT all -- anywhere anywhere
AS0_IN_PRE all -- anywhere anywhere MARK match 0x20000 00/0x2000000
AS0_ACCEPT tcp -- anywhere vps.clanmn.net state NEW tcp dpt: 915
AS0_ACCEPT tcp -- anywhere vps.clanmn.net state NEW tcp dpt: 914
AS0_ACCEPT udp -- anywhere vps.clanmn.net state NEW udp dpt: 917
AS0_ACCEPT udp -- anywhere vps.clanmn.net state NEW udp dpt: 916
AS0_WEBACCEPT all -- anywhere anywhere state RELATED,E STABLISHED
AS0_WEBACCEPT tcp -- anywhere vps.clanmn.net state NEW tcp d pt:943

Chain FORWARD (policy ACCEPT)
target prot opt source destination
AS0_ACCEPT all -- anywhere anywhere state RELATED,ESTA BLISHED
AS0_IN_PRE all -- anywhere anywhere MARK match 0x20000 00/0x2000000
AS0_OUT_S2C all -- anywhere anywhere
ACCEPT all -- 5.5.16.0/20 anywhere
REJECT all -- anywhere anywhere reject-with icmp-po rt-unreachable

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
AS0_OUT_LOCAL all -- anywhere anywhere

Chain AS0_ACCEPT (7 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain AS0_IN (4 references)
target prot opt source destination
ACCEPT all -- anywhere 5.5.0.1
AS0_IN_POST all -- anywhere anywhere

Chain AS0_IN_POST (1 references)
target prot opt source destination
AS0_OUT all -- anywhere anywhere
DROP all -- anywhere anywhere

Chain AS0_IN_PRE (2 references)
target prot opt source destination
AS0_IN all -- anywhere 5.5.0.0/20
AS0_IN all -- anywhere 192.168.0.0/16
AS0_IN all -- anywhere 172.16.0.0/12
AS0_IN all -- anywhere 10.0.0.0/8
ACCEPT all -- anywhere anywhere

Chain AS0_OUT (2 references)
target prot opt source destination
DROP all -- anywhere anywhere

Chain AS0_OUT_LOCAL (1 references)
target prot opt source destination
DROP icmp -- anywhere anywhere icmp redirect
ACCEPT all -- anywhere anywhere

Chain AS0_OUT_S2C (1 references)
target prot opt source destination
AS0_OUT all -- anywhere anywhere

Chain AS0_WEBACCEPT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere

wget http://swupdate.openvpn.org/as/openvp...
rpm -i openvpn-as-1.8.4-CentOS5.i386.rpm
passwd openvpn

This is all I did to setup my OpenVPN AS, anything I'm missing?

[risker]

Code: Select all

iptables -L -v -n
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    3   240 AS0_ACCEPT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 AS0_ACCEPT  all  --  lo     *       0.0.0.0/0            0.0.0.0/0
    0     0 AS0_IN_PRE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           MARK match 0x2000000/0x2000000
    0     0 AS0_ACCEPT  tcp  --  *      *       0.0.0.0/0            103.4.16.128        state NEW tcp dpt:915
    0     0 AS0_ACCEPT  tcp  --  *      *       0.0.0.0/0            103.4.16.128        state NEW tcp dpt:914
    0     0 AS0_ACCEPT  udp  --  *      *       0.0.0.0/0            103.4.16.128        state NEW udp dpt:917
    0     0 AS0_ACCEPT  udp  --  *      *       0.0.0.0/0            103.4.16.128        state NEW udp dpt:916
    0     0 AS0_WEBACCEPT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 AS0_WEBACCEPT  tcp  --  *      *       0.0.0.0/0            103.4.16.128        state NEW tcp dpt:943
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:1194
    3   152 ACCEPT     all  --  venet0 *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  as0t0  *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  as0t1  *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:1194
    0     0 ACCEPT     all  --  as0t0  *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  as0t1  *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 AS0_ACCEPT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 AS0_IN_PRE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           MARK match 0x2000000/0x2000000
    0     0 AS0_OUT_S2C  all  --  *      as0t+   0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      *       5.5.16.0/20          0.0.0.0/0
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable
    0     0 ACCEPT     all  --  as0t0  *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  as0t1  *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 9 packets, 636 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 AS0_OUT_LOCAL  all  --  *      as0t+   0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spt:1194
    0     0 ACCEPT     all  --  *      as0t0   0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      as0t1   0.0.0.0/0            0.0.0.0/0

Chain AS0_ACCEPT (7 references)
 pkts bytes target     prot opt in     out     source               destination
    3   240 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain AS0_IN (4 references)
 pkts bytes target     prot opt in     out     source               destination

Been messing around with iptables, trying to allow access.

[risker]

After looking around the internet, I believe this is what I'm missing.

Code: Select all

AS0_WEBACCEPT  tcp  --  anywhere             x          state NEW tcp dpt:1194

Now I just need to work out the IPTables command for this! xD