|
|
Hi Stefan Lamby schrieb: > Hi. > > I have been watching this list for a while and also read the manual. > Trying to solve this for a month now, but dont understand: > > I am using openvpn in the standard configuration with dev=tun, udp on > port 1194. > > My server running openvpn is a linux box, running SuSE linux with > SuSEfirewall2 running. > > The intention is to remote control clients via tightvnc. > > When I shut down my firewall script, everything is running, so it is > obvious that the problem is caused by the firewall. > > How can I find out, where exactly my problem is? Oh my, if we would get a dime for everyone who runs into the same old problem. I guess we are in need of a comprehensive TCP debugging course. The simple answer is, follow the packet trail and look into the firewall logs. > I used tcpdump -i tun0 at the server and when I like to get a connection > from my openvpn client to the tightvnc server (the client 192.168.10.25 > behind the openvpn server) the output is as follows: Looks like some packets made it through the tunnel at least 19:17:47.724969 IP 10.8.0.6.citriximaclient > 192.168.10.25.5900: S 543787865:543787865(0) win 16384 <mss 1118,nop,nop,sackOK> > > Please help me understand, I am not an expert to iptables but I got the > basics. Time, source address and port, destination address and port, some IP stuff, tcp window size, mss size, and tcp flags The questions here are: did this packet make it to 192.168.10.25 or not, was it replied to and did 192.168.10.25 have a reasonable route to 10.8.0.6. Your tcpdump entry does not give us an answer as it only looks at the tun interface. To answer the first question first find which interface leads to 192.168.10.25 'ip route get 192.168.10.25' should reveal it. Then do a tcpdump on that interface and have a look for the packet. If you cannot see it you need to review your firewall rules. If you have difficulties to decipher the tcpdump output, then save it with tcpdump ..... -w filename and open it with a tool like wireshark, which will break up the packet for you. cheers Erich ____________________________________________ Openvpn-users mailing list Openvpn-users@xxxxxxxxxxxxxxxxxxxxx https://lists.sourceforge.net/lists/listinfo/openvpn-users |