While editing some firewall rules on a machine that has an OpenVPN client running, I was trying to determine its remote port, as I usually do, using
# ss -anup | grep openvpn UNCONN6528 0 0.0.0.0:52012 0.0.0.0:* users:(("openvpn",pid=333,fd=3))
It came up empty.
From config, I can see that the client must be connected to
10.0.0.5:389 over UDP. I verified this in
# cat /proc/net/nf_conntrack | grep udp | grep 389 ipv4 2 udp 17 175 src=10.0.7.8 dst=10.0.0.5 sport=52012 dport=389 src=10.0.0.5 dst=10.0.7.8 sport=389 dport=52012 [ASSURED] mark=0 zone=0 use=2
Both these commands were run in quick succession after doing an outbound connection and verifying it to be working,
curl ipinfo.io having returned the expected result.
I tried a normal UDP connection with netcat (
nc -l -u 12345 on server and
nc -u 10.0.0.5 12345 on the client) to see the output of
ss on the client:
# ss -anup | grep nc ESTAB 0 0 10.0.7.8:52051 10.0.0.5:12345 users:(("nc",pid=2002,fd=3))
Why is the
ss output for OpenVPN in
UNCONN state and not the expected
ESTAB state, as it is in the simple netcat case?
# uname -a Linux tank 4.16.3-1-ARCH #1 SMP PREEMPT Thu Apr 19 09:17:56 UTC 2018 x86_64 GNU/Linux # pacman -Qo /usr/bin/ss /usr/bin/ss is owned by iproute2 4.16.0-1