Home / server / Questions / 686059
In Process
John Tate
Asked: 2015-04-28 23:02:27 +0800 CST

OpenVPN server, UDP port no longer accessible

  • 772

I am having a strange problem with OpenVPN. The server has worked fine and with no modification for a long time, except for updates. It suddenly stopped working and I can't figure out why. I cannot access its UDP port remotely, from the domU, or the local machine. I can reach all other services.

I have tried disabling iptables as an experiment but I still cannot reach the port. I cannot see anything wrong in the OpenVPN config. Running netstat -lp | grep openvpn reveals that the port is listening. Yet I can't even access it from the local machine.

Here is the OpenVPN config: http://pastebin.com/Gq8CDwVK

Here is the output of iptables -nvL: http://pastebin.com/5MCqTWCE

Here is the output of iptables -nvL -t nat: http://pastebin.com/XxFf0Kb4

I think I've eliminated all the other factors it could be. Please help me diagnose this issue further.

This is the log of the service starting...

Tue Apr 28 07:04:39 2015 us=123021 OpenVPN 2.3.6 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Apr 27 2015
Tue Apr 28 07:04:39 2015 us=123031 library versions: OpenSSL 1.0.1l 15 Jan 2015, LZO 2.08
Tue Apr 28 07:04:39 2015 us=127292 Diffie-Hellman initialized with 2048 bit key
Enter Private Key Password:
Tue Apr 28 07:04:47 2015 us=695418 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Apr 28 07:04:47 2015 us=698002 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Apr 28 07:04:47 2015 us=698025 Socket Buffers: R=[212992->131072] S=[212992->131072]
Tue Apr 28 07:04:47 2015 us=698114 ROUTE_GATEWAY 167.114.15.64/255.255.255.0 IFACE=eth0 HWADDR=ba:e5:54:4f:ef:d7
Tue Apr 28 07:04:47 2015 us=698259 TUN/TAP device tun0 opened
Tue Apr 28 07:04:47 2015 us=698294 TUN/TAP TX queue length set to 100
Tue Apr 28 07:04:47 2015 us=698317 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Apr 28 07:04:47 2015 us=698340 /bin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Tue Apr 28 07:04:47 2015 us=699313 /bin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Tue Apr 28 07:04:47 2015 us=699853 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Apr 28 07:04:47 2015 us=700326 GID set to openvpn
Tue Apr 28 07:04:47 2015 us=700368 UID set to openvpn
Tue Apr 28 07:04:47 2015 us=700394 UDPv4 link local (bound): [AF_INET]167.114.15.70:1194
Tue Apr 28 07:04:47 2015 us=700407 UDPv4 link remote: [undef]
Tue Apr 28 07:04:47 2015 us=700422 MULTI: multi_init called, r=256 v=256
Tue Apr 28 07:04:47 2015 us=700460 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Tue Apr 28 07:04:47 2015 us=700480 ifconfig_pool_read(), in='client-johntate,10.8.0.4', TODO: IPv6
Tue Apr 28 07:04:47 2015 us=700498 succeeded -> ifconfig_pool_set()
Tue Apr 28 07:04:47 2015 us=700511 ifconfig_pool_read(), in='client-lucasmarshall2,10.8.0.8', TODO: IPv6
Tue Apr 28 07:04:47 2015 us=700521 succeeded -> ifconfig_pool_set()
Tue Apr 28 07:04:47 2015 us=700531 ifconfig_pool_read(), in='client-testuser4,10.8.0.12', TODO: IPv6
Tue Apr 28 07:04:47 2015 us=700543 succeeded -> ifconfig_pool_set()
Tue Apr 28 07:04:47 2015 us=700556 IFCONFIG POOL LIST
Tue Apr 28 07:04:47 2015 us=700570 client-obfuscated1,10.8.0.4
Tue Apr 28 07:04:47 2015 us=700582 client-obfuscated2,10.8.0.8
Tue Apr 28 07:04:47 2015 us=700593 client-obfuscated3,10.8.0.12
Tue Apr 28 07:04:47 2015 us=700632 Initialization Sequence Completed

Edit: I did a further test and it seems the system can't listen on UDP at all. Even with the firewall disabled. This doesn't make any sense at all. To test I used socat to listen to UDP, and hping to test it.

openvpn

1 Answers

  1. Is it VPS (OVH) @ Canada? If so then you should contact your support. Your setup looks perfectly normal for me. According to iptables counters dump OS kernel does not receive anything @ openvpn's port (1194/UDP). It smells like connection issues for me. That's why openvpn doesn't work. You can't diagnose it, only your provider can. They usually use complex setup to minimize costs and provide best public IP addresses distribution. It's very easy to do some mistake there.

    Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
    15 3291 ACCEPT all -- * * 10.8.0.0/24 0.0.0.0/0
    217M 74G ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 3155K 189M ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
    53874 3814K DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID 357K 12M ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8 ctstate NEW 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194 305K 68M UDP udp -- * * 0.0.0.0/0 0.0.0.0/0 ctstate NEW 3802K 204M TCP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02 ctstate NEW 290K 67M REJECT udp -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable 125K 6870K REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-proto-unreachable 0 0 sshguard all -- * * 0.0.0.0/0 0.0.0.0/0

    Can you provide also ifconfig -a output? You can look at tcpdump/wireshark output as well. It should prove what I say. You may try to find available udp port in bellow way:

    @ server

    tshark -i ethX udp or tshark -i ethX -f 'udp' depending on version

    @ some client

    nmap -sU server's_IP_address -p 1-65535

    And observe output @ server. This should tell u what UDP ports are open. To test OpenVPN u can switch to TCP, it will rule out OpenVPN configuration problems and provide backup connectivity for now.

    And good luck!

    • 0