Dotaz: po aktivaci fw nejde pripojit openvpn

[gepard]

Ahoj, resim takovou zahadu. Kdyz mam vypnuty fw iptables (nebo kolega ufv), tak se k openvpn serveru pripojim. Ziskam tun0. Pokud aktivuju fw (iptables nebo ufv), tak pripojeni k openvpn prestane fungovat s logem

Wed Jun 24 15:04:07 2020 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Jun 24 15:04:07 2020 TLS Error: TLS handshake failed

iptables je:

# Generated by iptables-save v1.6.1 on Tue Feb 19 22:31:45 2019
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT
#-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
#-A INPUT -j REJECT --reject-with icmp-port-unreachable
#-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -j ACCEPT
COMMIT
# Completed on Tue Feb 19 22:31:45 2019


Co muze byt blbe? Na iptables to zkousim az ted, tak nevim, jak se to chovalo drive, ale ufv tady byl dva roky a cca. pred 14-ti dny pripojeni k openvpn prestalo fungovat. Nevypada to, ze by se neco zmenilo. Po vypnuti ufv nebo iptables se openvpn pripoji.

Diky za echo.

Odpovědi

[ZAH]

Nějak tam nevidím povolené navázání spojení NEW.

[PetebLazar]

Podle formulace to vypadá, že tazatel hovoří o pravidlech FW na klientu(openvpn), ne na serveru(openvpn)?

[billgates]

Ja som to tiez tak pochopil a nevidim tam chybu. OUTPUT je povoleny cely a INPUT established a related, cize ono by to malo bezat.

[PetebLazar]

Není třeba povolit FORWARD na tun0?

[alkoholik]

Jemu selze uz navazovani spojeni.

[Karlosek]

Já myslím, že jsem musel povolovat INPUT pro 1194 i pro klienta, no za zkoušku nic nedáš

[gepard]

U kolegy na ufv jsme zkouseli povolit 1194 pro input, take nic. Ale do ufv zas az tak moc nevidim. A na iptables jsem to nezkousel. Pro me tam je podstatne, ze povoluju mnou vyzadane spojeni. Jediny rozdil mezi touto openvpn (co ma problemy) a jinyma (co problemy nemaji) je v tom, ze tato openvpn je soucasne server ke kteremu se pripojuju (a jde to jen bez fw) a take klient pripojujici se dale do jine pobocky. A tu jinou pobocku zpristupnuje pred forward.

[Petr]

A co třeba tam nechat -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 a kouknout se, jestli tam něco neblokuje.

[gepard]

Zajimave je, ze na jine openvpn-ky se s fw bez problemu pripojim, dela to jen u jedne, kde musim fw vypnout, abych se pripojil. A to to dva roky bezelo bez problemu. Fakt nevim, co se zmenilo. V pondeli jak tam budu mrknu na ten ...--log-level 7

[alkoholik]

Vidis odchozi spojeni v /proc/net/nf_conntrack?

[GeorgeWH]

Alebo este lepsie pustit rovno tcpdump.

[gepard]

nf_conntrack neexistuje, zkusim ten tcpdump

[alkoholik]

Stary kernel? Co /proc/net/ip_conntrack?

[gepard]

Nemyslim, ze bych mel stary kernel

uname -a

Linux E560 5.4.0-40-generic #44-Ubuntu SMP Tue Jun 23 00:01:04 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

kazdopadne ip_conntrack take neexistuje

[alkoholik]

Pripadne modprobe nf_conntrack.

[gepard]

sudo tcpdump dst 192.168.102.228 or dst 192.168.102.199
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlp1s0, link-type EN10MB (Ethernet), capture size 262144 bytes
12:31:26.974392 IP E560.38697 > 192.168.102.228.openvpn: UDP, length 86
12:31:28.225262 IP E560.38697 > 192.168.102.228.openvpn: UDP, length 86
12:31:32.162464 ARP, Request who-has 192.168.102.228 tell E560, length 28
12:31:32.165613 ARP, Reply E560 is-at e4:a7:a0:1a:1e:54 (oui Unknown), length 28
12:31:33.227837 IP E560.38697 > 192.168.102.228.openvpn: UDP, length 86
12:31:41.401538 IP E560.38697 > 192.168.102.228.openvpn: UDP, length 86
12:31:57.357699 IP E560.38697 > 192.168.102.228.openvpn: UDP, length 86
12:32:01.603897 ARP, Reply E560 is-at e4:a7:a0:1a:1e:54 (oui Unknown), length 28
^C

sudo tcpdump -vv dst 192.168.102.228 or dst 192.168.102.199
tcpdump: listening on wlp1s0, link-type EN10MB (Ethernet), capture size 262144 bytes
12:33:09.891214 IP (tos 0x0, ttl 64, id 21331, offset 0, flags [DF], proto UDP (17), length 114)
    E560.51109 > 192.168.102.228.openvpn: [udp sum ok] UDP, length 86
12:33:11.907760 IP (tos 0x0, ttl 64, id 21805, offset 0, flags [DF], proto UDP (17), length 114)
    E560.51109 > 192.168.102.228.openvpn: [udp sum ok] UDP, length 86
12:33:15.074466 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.102.228 tell E560, length 28
12:33:15.077588 ARP, Ethernet (len 6), IPv4 (len 4), Reply E560 is-at e4:a7:a0:1a:1e:54 (oui Unknown), length 28
12:33:15.941797 IP (tos 0x0, ttl 64, id 22627, offset 0, flags [DF], proto UDP (17), length 114)
    E560.51109 > 192.168.102.228.openvpn: [udp sum ok] UDP, length 86
12:33:23.438562 IP (tos 0x0, ttl 64, id 22954, offset 0, flags [DF], proto UDP (17), length 114)
    E560.51109 > 192.168.102.228.openvpn: [udp sum ok] UDP, length 86
12:33:40.229957 IP (tos 0x0, ttl 64, id 26219, offset 0, flags [DF], proto UDP (17), length 114)
    E560.51109 > 192.168.102.228.openvpn: [udp sum ok] UDP, length 86
12:33:45.282488 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.102.228 tell E560, length 28
^C

[alkoholik]

Nejsou ciste nahodou ostatni pres TCP a tahle pres UDP?

[gepard]

vsechny vpn mam na udp

[Karlosek]

Může ještě blbnout DNS. Nebo pokud je zadaná jen IP, tak propingnout se zapnutým FW, jestli vůbec projde. A koukat na tcpdump jak radí výše.

[gepard]

se zapnutym fw ping prochazi

[gepard]

Dneska jsem narazil na dalsi problem.

po tydnu jsem se k tomu dostal. V konfiguraci se nic nezmenilo, ale tentokrat se nepripojim ani bez fw. Pise to toto:

Options error: --ca fails with '/home/tomas/data/vpn/vpn_11_olomouc/ca.crt': No such file or directory (errno=2)
Options error: --cert fails with '/home/tomas/data/vpn/vpn_11_olomouc/tomas.crt': No such file or directory (errno=2)
Thu Jul  2 09:26:55 2020 WARNING: cannot stat file '/home/tomas/data/vpn/vpn_11_olomouc/tomas.key': No such file or directory (errno=2)
Options error: --key fails with '/home/tomas/data/vpn/vpn_11_olomouc/tomas.key': No such file or directory (errno=2)
Thu Jul  2 09:26:55 2020 WARNING: cannot stat file '/home/tomas/data/vpn/vpn_11_olomouc/ta.key': No such file or directory (errno=2)
Options error: --tls-auth fails with '/home/tomas/data/vpn/vpn_11_olomouc/ta.key': No such file or directory (errno=2)
Options error: Please correct these errors.
Use --help for more information.
Thu Jul  2 09:26:56 2020 OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep  5 2019
Thu Jul  2 09:26:56 2020 library versions: OpenSSL 1.1.1f  31 Mar 2020, LZO 2.10
Options error: --ca fails with '/home/tomas/data/vpn/vpn_11_olomouc/ca.crt': No such file or directory (errno=2)
Options error: --cert fails with '/home/tomas/data/vpn/vpn_11_olomouc/tomas.crt': No such file or directory (errno=2)
Thu Jul  2 09:27:00 2020 WARNING: cannot stat file '/home/tomas/data/vpn/vpn_11_olomouc/tomas.key': No such file or directory (errno=2)
Options error: --key fails with '/home/tomas/data/vpn/vpn_11_olomouc/tomas.key': No such file or directory (errno=2)
Thu Jul  2 09:27:00 2020 WARNING: cannot stat file '/home/tomas/data/vpn/vpn_11_olomouc/ta.key': No such file or directory (errno=2)
Options error: --tls-auth fails with '/home/tomas/data/vpn/vpn_11_olomouc/ta.key': No such file or directory (errno=2)
Options error: Please correct these errors.
Use --help for more information.
Thu Jul  2 09:27:03 2020 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Thu Jul  2 09:27:03 2020 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Thu Jul  2 09:27:03 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.102.228:1194
Thu Jul  2 09:27:03 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Thu Jul  2 09:27:03 2020 UDP link local: (not bound)
Thu Jul  2 09:27:03 2020 UDP link remote: [AF_INET]192.168.102.228:1194
Thu Jul  2 09:27:03 2020 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Thu Jul  2 09:27:05 2020 TCP/UDP: Incoming packet rejected from [AF_INET]192.168.102.199:1194[2], expected peer address: [AF_INET]192.168.102.228:1194 (allow this incoming source address/port by removing --remote or adding --float)
Thu Jul  2 09:27:05 2020 TCP/UDP: Incoming packet rejected from [AF_INET]192.168.102.199:1194[2], expected peer address: [AF_INET]192.168.102.228:1194 (allow this incoming source address/port by removing --remote or adding --float)
Options error: --ca fails with '/home/tomas/data/vpn/vpn_11_olomouc/ca.crt': No such file or directory (errno=2)
Options error: --cert fails with '/home/tomas/data/vpn/vpn_11_olomouc/tomas.crt': No such file or directory (errno=2)
Thu Jul  2 09:27:06 2020 WARNING: cannot stat file '/home/tomas/data/vpn/vpn_11_olomouc/tomas.key': No such file or directory (errno=2)
Options error: --key fails with '/home/tomas/data/vpn/vpn_11_olomouc/tomas.key': No such file or directory (errno=2)
Thu Jul  2 09:27:06 2020 WARNING: cannot stat file '/home/tomas/data/vpn/vpn_11_olomouc/ta.key': No such file or directory (errno=2)
Options error: --tls-auth fails with '/home/tomas/data/vpn/vpn_11_olomouc/ta.key': No such file or directory (errno=2)
Options error: Please correct these errors.
Use --help for more information.

Zarazi me tam radek

Thu Jul  2 09:27:05 2020 TCP/UDP: Incoming packet rejected from [AF_INET]192.168.102.199:1194[2], expected peer address: [AF_INET]192.168.102.228:1194

IP 192.168.102.199 tam nema co delat.

Take me zarazi ten no such file or directory, kdyz soubor existuje a pred tydnem to fungovalo.

RESENI:

Server ma dve ip adresy uz od startu, takze po navazani kontaktu na prvni ip .228 odpovida ta druha .199

Docasne jsem vyresil parametrem --float

I kdyz se to pripojim, hlasi no such file or directory. Nevim, co si o tom mam myslet.

S fw se stale nepripojim, bez fw ano.

[PetebLazar]

Nespouští se to pod uživatelem, který nemá k požadovanému souboru dostatečná práva?

[gepard]

Poustim vpn pod svym uzivatelem jako sudo, jak ja, tak root ma pristup a soubory existuji, overeno, cesta je spravne

[PetebLazar]

A jaký uživatel/skupina je uvedena v /etc/openvpn/server.conf v direktivach user/group?

[PetebLazar]

Beru zpět, zde jde vlastně o klienta?

[PetebLazar]

Client.conf tyto direktivy může mít také. https://github.com/OpenVPN/openvpn/blob/master/sample/sample-config-files/client.conf

[PetebLazar]

Ten downgrade práv je až po "Inicializaci" (spojení?). Takže to tím nejspíš nebude.

[PetebLazar]

Podle chybové hlášky by to taky mohlo jít na vrub aktivního ProtectHome v definici v systemd. https://bbs.archlinux.org/viewtopic.php?id=224741

[gepard]

Diky, prostuduju