1

I have a very strange behaviour of my UFW on Ubuntu 18.04. I set up basic rules, everything is OK until I connect client to this server through VPN. On the client side ping works fine but nslookup / domain ping is being refused. Once I will turn off ufw, it is working well. UFW configuration: VPN subnet is 10.99.0.0/24 (using OpenVPN):

ufw default deny incoming
ufw default allow outgoing
1194                       ALLOW       Anywhere
Anywhere                   ALLOW       10.99.0.0/24
6969                       ALLOW       10.99.0.0/24
10.99.0.0/24               ALLOW       Anywhere

And from the log (using 8.8.8.8 and 1.0.0.1 as DNS):

Dec  7 23:40:28 snm kernel: [15432.700282] [UFW BLOCK] IN=tun0 OUT=eth0 MAC= SRC=10.99.0.2 DST=1.0.0.1 LEN=71 TOS=0x00 PREC=0x00 TTL=127 ID=1189 PROTO=UDP SPT=64312 DPT=53 LEN=51
Dec  7 23:41:08 snm kernel: [15472.370487] [UFW BLOCK] IN=tun0 OUT=eth0 MAC= SRC=10.99.0.2 DST=1.0.0.1 LEN=71 TOS=0x00 PREC=0x00 TTL=127 ID=1192 PROTO=UDP SPT=50962 DPT=53 LEN=51
Dec  7 23:41:09 snm kernel: [15473.384535] [UFW BLOCK] IN=tun0 OUT=eth0 MAC= SRC=10.99.0.2 DST=8.8.8.8 LEN=71 TOS=0x00 PREC=0x00 TTL=127 ID=1193 PROTO=UDP SPT=50962 DPT=53 LEN=51

Do you have any advise how to debug this?

closed as off-topic by Jeff Schaller, RalfFriedl, Mr Shunz, user34720, Scott Dec 15 '18 at 0:15

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions describing a problem that can't be reproduced and seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – Jeff Schaller, RalfFriedl, Mr Shunz, Community
If this question can be reworded to fit the rules in the help center, please edit the question.

  • You need to provide more information regarding your setup. Also, subnets like 255.255.255.0 define the prefixes used in normal IP nets like your 10.99.0.0 prefixed LAN network. – Michael Prokopec Dec 8 '18 at 1:33
  • What exactly do you mean? OpenVPN server.conf or? Also I don't understand your comment about subnet I choose. – Filip Niko Dec 8 '18 at 9:29
  • Yes, your server config files. Also your complete client-side setup. The subnet is chosen based on what IP range you want to use and is often chosen based on network class. This is however not of concern if you are on the same subnet/ using the same IP range scheme. It would be if you intend on traversing from one subnet to another or connecting through other subnets. Also please sanitize your private information. – Michael Prokopec Dec 8 '18 at 19:53
2

Ok, finally I solved my issue by adjusting IPTABLES:

iptables -I FORWARD -i tun0 -o eth0 \
         -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT

iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED \
         -j ACCEPT

iptables -t nat -I POSTROUTING -o eth0 \
          -s 10.8.0.0/24 -j MASQUERADE

I could make ufw rules lighter now:

To                         Action      From
--                         ------      ----
1194                       ALLOW       Anywhere
22                         ALLOW       10.8.0.0/24

And change IP pool, if I want to in server.conf, but I have to amend ip tables accordingly.

port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
#push "redirect-gateway def1 bypass-dhcp"
#push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
log-append /var/log/openvpn/openvpn.log
status openvpn-status.log
verb 3
crl-verify crl.pem
  • Also goood to makre iptables persistent after reboot using: iptables-save – Filip Niko Dec 9 '18 at 20:18
1

If all you are looking at is the domain ping failure, the server and or client firewall needs to be made to allow forwarding:

# Allow TUN interface connections to OpenVPN server
iptables -A INPUT -i tun+ -j ACCEPT

# Allow TUN interface connections to be forwarded through other interfaces
iptables -A FORWARD -i tun+ -j ACCEPT

More information: HERE

Also look into the client-to-client setting, this is required to gain access to other computers on the VPN, if not enabled you can't see the other computers connected.

  • Uncomment out the client-to-client directive if you would like connecting clients to be able to reach each other over the VPN. By default, clients will only be able to reach the server.

More information found: HERE

  • Could not tell if you actually solved your issue or not? The comment and the answer post occurred around the same time. – Michael Prokopec Dec 9 '18 at 18:40
  • 1
    Yes, I did. I had to make iptables rule persistent and it is working well now! Thank you for your help! – Filip Niko Dec 10 '18 at 0:03
  • You are welcome. – Michael Prokopec Dec 10 '18 at 0:08
0

Discovered, I changed DHCP pool using wrong way (only edit server.conf). Changing IP pool using other way helped.

  • So are you all good now? If not just ask, someone here will do their best to help you. – Michael Prokopec Dec 8 '18 at 19:57
  • I though yes, but after ufw reload it is back again - not working. Let me share more details of my config with you. – Filip Niko Dec 9 '18 at 10:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.