I need to configure OpenVPN on Centos 7 using firewalld.

I used iptables on Centos 6.5 and only had to add the following lines to /etc/sysconfig/iptables:

-A POSTROUTING -s "" -o "wlan0" -j MASQUERADE 
-A FORWARD -p tcp -s -d -j ACCEPT 
run the command: echo 1 > /proc/sys/net/ipv4/ip_forward 
open port 443.

Use the firewall-cmd command.

Assuming you're opening the firewall up to OpenVPN on the default zone, carry out the following commands. If you are running it on a non-default zone, then add --zone=<zone> to the commands.

Note: If you use default public zone for your external facing network adapter then your loopback interface could also be masqueraded (dependant on the version of firewalld you're running) which can cause issues if you are running a service (such as mySQL) that is accessed locally.

First, list what's currently open:

# firewall-cmd --list-services
http https ssh

Next, add the openvpn service:

# firewall-cmd --add-service openvpn

A quick check:

# firewall-cmd --list-services
http https openvpn ssh

The above will allow openvpn to work, which you can now test. However, it won't last over restarts. To make it permanent, add the --permanent option:

# firewall-cmd --permanent --add-service openvpn`

Note that this last command doesn't open the port until the next restart, so you need to use both commands.

Finally, add the masquerade:

# firewall-cmd --add-masquerade

And make it permanent after a restart:

# firewall-cmd --permanent --add-masquerade

Confirm it:

# firewall-cmd --query-masquerade

Note that if your incoming OpenVPN connection is in a different zone to your Internet facing connection the masquerade should be on the latter and you'll need to use the --zone=<zone> option with the --add-masquerade commands.

  • How do you tell what the definition of the openvpn service is in firewalld? For example, how can you verify that it's allowing openvpn over TCP 443? – Christopher Mar 4 '16 at 2:13
  • @Christopher - Service files are located in /lib/firewalld/services/. In your case, it will be openvpn.xml within that directory. User defined services go in /etc/firewalld/services. Note that the default port for openvpn is UDP/1194. – garethTheRed Mar 4 '16 at 7:24
  • 1
    Thanks. I was having a problem, and thought it might be firewalld. The only thing I did differently from the above instructions was use "https" instead of "openvpn" as the service name to add. Turns out, it wasn't firewalld with the problem. I was just being dumb, and forgot to configure my client properly to use "tun" instead of "tap". The above instructions work perfectly. – Christopher Mar 6 '16 at 8:51
  • 1
    I've noticed a problem with adding masquerade to the entire zone. This tries to NAT my connections to the loopback interface, when I am running other services on localhost. I'd like to limit the masquerading to just Any idea how you might do that? – Christopher Mar 12 '16 at 6:16
  • 1
    This bug may be the cause. Basically, if your default zone is the public zone then it masquerades the loopback interface. It turns out that I'd previously set my default zone to be external, so never faced the issue you're seeing. Try moving the services and the adapter to another zone to see if that helps. Let me know :-) – garethTheRed Mar 12 '16 at 7:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.