Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need some help configuring OpenVPN on Centos 7 using firewalld.

I used iptables on Centos 6.5 and only had to add the following lines to /etc/sysconfig/iptables:

-A POSTROUTING -s "10.0.0.0/24" -o "wlan0" -j MASQUERADE 
-A FORWARD -p tcp -s 10.0.0.0/24 -d 0.0.0.0/0 -j ACCEPT 
run the command: echo 1 > /proc/sys/net/ipv4/ip_forward 
open port 443.
share|improve this question
up vote 13 down vote accepted

Use the firewall-cmd command.

Assuming you're opening the firewall up to OpenVPN on the default zone, carry out the following commands. If you are running it on a non-default zone, then add --zone=<zone> to the commands.

Note: If you use default public zone for your external facing network adapter then your loopback interface could also be masqueraded (dependant on the version of firewalld you're running) which can cause issues if you are running a service (such as mySQL) that is accessed locally.

First, list what's currently open:

# firewall-cmd --list-services
http https ssh

Next, add the openvpn service:

# firewall-cmd --add-service openvpn
success

A quick check:

# firewall-cmd --list-services
http https openvpn ssh

The above will allow openvpn to work, which you can now test. However, it won't last over restarts. To make it permanent, add the --permanent option:

# firewall-cmd --permanent --add-service openvpn`
success

Note that this last command doesn't open the port until the next restart, so you need to use both commands.

Finally, add the masquerade:

# firewall-cmd --add-masquerade
success

And make it permanent after a restart:

# firewall-cmd --permanent --add-masquerade
success

Confirm it:

# firewall-cmd --query-masquerade
yes

Note that if your incoming OpenVPN connection is in a different zone to your Internet facing connection the masquerade should be on the latter and you'll need to use the --zone=<zone> option with the --add-masquerade commands.

share|improve this answer
    
How do you tell what the definition of the openvpn service is in firewalld? For example, how can you verify that it's allowing openvpn over TCP 443? – Christopher Mar 4 at 2:13
    
@Christopher - Service files are located in /lib/firewalld/services/. In your case, it will be openvpn.xml within that directory. User defined services go in /etc/firewalld/services. Note that the default port for openvpn is UDP/1194. – garethTheRed Mar 4 at 7:24
    
Thanks. I was having a problem, and thought it might be firewalld. The only thing I did differently from the above instructions was use "https" instead of "openvpn" as the service name to add. Turns out, it wasn't firewalld with the problem. I was just being dumb, and forgot to configure my client properly to use "tun" instead of "tap". The above instructions work perfectly. – Christopher Mar 6 at 8:51
    
I've noticed a problem with adding masquerade to the entire zone. This tries to NAT my connections to the loopback interface, when I am running other services on localhost. I'd like to limit the masquerading to just 10.8.0.0/16. Any idea how you might do that? – Christopher Mar 12 at 6:16
    
This bug may be the cause. Basically, if your default zone is the public zone then it masquerades the loopback interface. It turns out that I'd previously set my default zone to be external, so never faced the issue you're seeing. Try moving the services and the adapter to another zone to see if that helps. Let me know :-) – garethTheRed Mar 12 at 7:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.