I’m running openVPN server on openSUSE 10.3 box. It works fine when firewall is off. However, I have problems to setup SuSe firewall to work with openVPN. The setup is as follows:
Road warrior openVPN client connects properly to openVPN server on openSUSE 10.3 box. I have problems when trying to ssh from road warrior to openSUSE box (over openVPN channel):
Summary: to get openVPN working with SuSefirewall I had to set following options:
FW_DEV_INT='tun7'(openVPN interface tun7 is marked as internal net)
FW_SERVICES_ACCEPT_EXT="88.212.17.42,udp,2194"(to enable road warrior openVPN client to connect to server)
FW_SERVICES_ACCEPT_INT="172.16.142.10,tcp,22" (to enable ssh from road warrior to server)
I just believed that because FW_PROTECT_FROM_INT=“no” was used no FW_SERVICES_ACCEPT_INT was needed.
FW_PROTECT_FROM_INT="no"
# Do you want to protect the firewall from the internal network?
# Requires: FW_DEV_INT
#
# If you set this to "yes", internal machines may only access
# services on the firewall you explicitly allow. If you set this to
# "no", any internal user can connect (and attack) any service on
# the firewall.
So I don’t really understand what FW_PROTECT_FROM_INT does in this scenario. I have set it now to “yes” since ssh from road warrior was working fine regardless of setting FW_PROTECT_FROM_INT. So can anybody clarify if 172.16.142.10 is an internal machine or not (I just assume it IS INTERNAL MACHINE since it’s connected through tun7) and why even with FW_PROTECT_FROM_INT=“no” I need FW_SERVICES_ACCEPT_INT to let firewall pass ssh requests from road warrior?
Ok, some years ago after the first posting I have the same problem with openSUSE 13.1 with a little different setup.
I have a openSUSE openVPN gateway with IP address 10.92.nn.mm on interface ens34. The internal interface is *ens32 *with IP 192.168.10.5. The openVPN interface is *tun7 *on the network 192.168.11.0. Behind this interface are some internal hosts in the network 192.168.10.0/24. The connection to the openVPN server works fine from the clients but I cannot use any service in the internal network 192.168.10.0/24.
If I want to connect an RDP service via openVPN I will get the following firewall trace (without FW it works fine):
port 1194
proto udp
dev tun7
ca pki/ca.crt
cert pki/vpnserver.dlb.atos.net.crt
key pki/key/vpnserver.dlb.atos.net.key # This file should be kept secret
dh dh.pem
server 192.168.11.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.10.0 255.255.255.0"
keepalive 10 120
comp-lzo
max-clients 10
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append /var/log/openvpn.log
verb 3
server> route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 10.92.nn.mm 0.0.0.0 UG 0 0 0 ens34
10.92.nn.mm * 255.255.255.224 U 0 0 0 ens34
loopback * 255.0.0.0 U 0 0 0 lo
192.168.10.0 * 255.255.255.0 U 0 0 0 ens32
192.168.11.0 192.168.11.2 255.255.255.0 UG 0 0 0 tun7
192.168.11.2 * 255.255.255.255 UH 0 0 0 tun7
I doubt it is very clever to hang a new question at the end of such an old thread. It will of course not show in the list of new threads. I only arrived here by incident.
Better start a new thread. You can of course place a link to this one there when you think that is usefull.
Thanks Henk for the advise but now I have a solution for my problem.
I have added
FW_FORWARD="192.168.11.0/24,192.168.10.0/24"
to the firewall configuration and it works now. It seems to me that it’s not possible to add this by using yast. You have to modify the FW configuration file manually.
FW_SERVICES_ACCEPT_INT was missing. On the other hand, following options were not needed: