Firewalld Blocking OpenVPN Connections on Non-Standard Port

Question

I've recently upgraded my CentOS 6 server to CentOS 7 and was busy configuring OpenVPN to run on a non-default port (1197) but I've run into a firewalld related issue.

I am unable to connect to server while firewalld is running but as soon as I stop the connection works fine.

Google said that the following should be enough to have firewalld working with OpenVPN

Firewalld Config
# firewall-cmd –-add-service openvpn –-permanent 
# firewall-cmd –-add-masquerade –-permanent 

Additional Config for Non-Standard Port
# firewall-cmd --add-port=1197/tcp --permanent

Apply Firewalld Changes
# firewall-cmd --reload
# systemctl restart firewalld 

OpenVPN Execute
# systemctl start openvpn@server 
# systemctl enable openvpn@server

This seems to have worked, I can see it applied

# firewall-cmd –-list-all 

public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client openvpn ssh
  ports: 80/tcp 1197/tcp
  protocols:
  masquerade: yes
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

Yet only when firewalld is running it doesn't connect, is there addidtional setup on firewalld required?

Answer 1

The firewall must accept packets for both the protocol and port which OpenVPN uses. So in this case the firewall configuration has to be changed from tcp/1197 to udp/1197