Allowing VPN Traffic Through the Firewall

[Gyroscope352]

Okay, so my question probably has a very simple answer, but I'm having trouble figuring it out because my setup is just *slightly* weird. Here's the lowdown:

I'm running OpenVPN to connect to the https://mullvad.net/ service on my FreeNAS box, to anonymize all the traffic coming from that box. It works well. However, I want to set up my firewall so that if and when OpenVPN quits or restarts that it doesn't leave my IP address open for all to see.

From what I've been told, this essentially means configuring my firewall to block all traffic except the traffic going through OpenVPN, which is port 1194. However, this doesn't seem to work at all. I enable the firewall, start up OpenVPN, and I still don't have access to the internet. My system log says this:

Code: Select all

Mar 28 17:23:01 	heimdall 	openvpn[6745]: OpenVPN 2.1.4 i386-portbld-freebsd7.4 [SSL] [LZO2] built on Jan 31 2011
Mar 28 17:23:01 	heimdall 	openvpn[6745]: NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mar 28 17:23:01 	heimdall 	openvpn[6745]: LZO compression initialized
Mar 28 17:23:01 	heimdall 	openvpn[6745]: Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mar 28 17:23:01 	heimdall 	openvpn[6745]: Socket Buffers: R=[42080->65536] S=[9216->65536]
Mar 28 17:23:01 	heimdall 	openvpn[6745]: RESOLVE: Cannot resolve host address: openvpn.mullvad.net: [TRY_AGAIN] A temporary error occurred on an authoritative name server.
Mar 28 17:23:01 	heimdall 	openvpn[6745]: Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mar 28 17:23:01 	heimdall 	openvpn[6745]: Local Options hash (VER=V4): '41690919'
Mar 28 17:23:01 	heimdall 	openvpn[6745]: Expected Remote Options hash (VER=V4): '530fdded'
Mar 28 17:23:01 	heimdall 	openvpn[6746]: RESOLVE: Cannot resolve host address: openvpn.mullvad.net: [TRY_AGAIN] A temporary error occurred on an authoritative name server.

And my firewall configuration looks like this:



(Ignore the lines about allowing "Jotunn", that's just so my desktop can access the FreeNAS web interface to do all of this).

This may or may not be enough information to go off of, so if I need to include something else, let me know what else I should dig for.

[janjust]

it looks like the server running openvpn is not capable/allowed to do name resolution...

[Gyroscope352]

it looks like the server running openvpn is not capable/allowed to do name resolution...

I don't think the server is necessarily running openvpn. Remember, I'm using openvpn to connect to Mullvad.net, a VPN privacy service. It's also worth noting that openvpn works fine when the firewall is disabled...it's only when I start blocking traffic that it doesn't work.

[Gyroscope352]

Ah ha! I think I'm getting somewhere. I think the problem may lie within the DNS.

So, essentially, everything works fine when the firewall's turned off. However, when it's turned on, I have the above error. I can ping sites from the command line though successfully, I just can't ping urls (i.e., pinging 8.8.8.8 or 208.73.210.29 works, but pinging www.google.com does not work).

I assume that I have to somehow allow for DNS lookups in my firewall, but I'm not really sure what I need to do to get that working. Either that, or it's a much deeper problem with resolv.conf or something like that. Any ideas?

[Gyroscope352]

Alright, it looks like the DNS issues were more suited to the folks over at the FreeNAS forums, since it didn't actually have anything to do with OpenVPN. However, now that I'm at the next step, my problem seems to be something that is a bit more suited to those experienced with OpenVPN.

This is what my firewall in FreeNAS looks like.



OpenVPN connects to Mullvad fine, but I'm getting "ping: sendto: permission denied" whenever I try to, say, ping Google. OpenVPN can connect, but then I can't connect to the internet at all. Is there something wrong with my firewall? I'm close, I think--I want that "permission denied" when OpenVPN isn't connected, but allowing traffic through port 1194 should allow me to connect to the internet whenever OpenVPN is running (and then, if it goes down, I disconnect from the internet to keep my IP away from prying eyes). Any idea what I might be doing wrong here?