I'm setting up split tunnel vpn on my raspberry and want to make sure no incoming traffic is accepted on my VPN-interface (tun0) except for on the port I explicitly open: 56292. I use iptables for this and despite it seeming right to me I cant seem to get through the firewall. I've tried from outside the network as well as from the localhost with:

cat < /dev/tcp/

My iptables -L -nv looks like this:

Chain INPUT (policy ACCEPT 35680 packets, 6816K bytes)
pkts bytes target     prot opt in     out     source               destination         
58  7392 ACCEPT     all  --  tun0   *              ctstate RELATED,ESTABLISHED
1    60 ACCEPT     tcp  --  tun0   *              tcp dpt:56292
1    76 REJECT     all  --  tun0   *              reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
         pkts bytes target     prot opt in     out     source               destination  

Chain OUTPUT (policy ACCEPT 141K packets, 26M bytes)
 pkts bytes target     prot opt in     out     source               destination         
 9380 3625K ACCEPT     all  --  *      lo              owner UID match 1001
    0     0 ACCEPT     all  --  *      tun0              owner UID match 1001
83686   10M ACCEPT     all  --  *      *              ctstate RELATED,ESTABLISHED
    0     0 REJECT     all  --  *      eth0   !            reject-with icmp-port-unreachable

TCPDUMP shows me this: sudo tcpdump port 56292 -v -i tun0 tcpdump: listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes 21:37:51.114955 IP (tos 0x0, ttl 55, id 17284, offset 0, flags [DF], proto UDP (17), length 76) > UDP, length 48 21:37:51.429340 IP (tos 0x0, ttl 55, id 47156, offset 0, flags [DF], proto TCP (6), length 60) > Flags [S], cksum 0xd85f (correct), seq 2422478710, win 29200, options [mss 1357,nop,nop,TS val 1736027970 ecr 0,nop,wscale 6], length 0 21:37:51.429528 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) > Flags [R.], cksum 0xc592 (correct), seq 0, ack 2422478711, win 0, length 0

migrated from serverfault.com Jul 12 at 18:26

This question came from our site for system and network administrators.

  • Please review your INPUT chain as incoming traffic is filtered by that chain. Even if you configured the OUTPUT chain by accident I don't see an explicit configuration for the port your mention. – Joffrey Jul 11 at 21:39
  • It accidently got removed when I quoted the block to code. Adding it now – Christian Kanzie Nilsson Jul 12 at 17:31
  • use tcpdump to see if packages are making their way through. – Tomáš Pospíšek Jul 12 at 20:07
  • I did but from my readout it seems like it comes through and gets a ACK in return – Christian Kanzie Nilsson Jul 12 at 20:41

You may not have that port open on either your router or a firewall on the pc.

This may help if you are using Red Hat: https://superuser.com/questions/794104/how-to-permanently-disable-firewall-in-red-hat-linux

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.