Por que não mudar a ordem dessas regras?
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
ACCEPT udp -- anywhere anywhere state NEW,RELATED,ESTABLISHED udp dpt:openvpn
Estou tentando configurar o openvpn e estou fazendo um bom progresso.
Ainda não estou no ponto em que estou testando o túnel. Em primeiro lugar, estou certificando-me de que as portas estejam todas configuradas corretamente por meio do firewall.
Se eu fizer o telnet da porta 1194 para o servidor com o iptables ligado e executar o tcpdump, obtenho:
22:39:28.933049 IP xxx.56236 > ip.openvpn: S 4157464468:4157464468(0) win 8192 <mss 1460,nop,nop,sackOK>
22:39:28.934723 IP ip.openvpn > xxx.56236: R 0:0(0) ack 4157464469 win 0
Mas se eu ativar o iptables de volta, ele só parece pegar o pacote, mas não envia uma resposta:
22:39:28.933049 IP xxx.56236 > ip.openvpn: S 4157464468:4157464468(0) win 8192 <mss 1460,nop,nop,sackOK>
Alguma idéia por quê? Meus iptables são assim:
[root@westc01-01-01 sysconfig]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp multiport ports http
ACCEPT tcp -- anywhere anywhere tcp multiport ports https
ACCEPT tcp -- anywhere anywhere tcp multiport ports submission
ACCEPT tcp -- anywhere anywhere tcp multiport ports imap
ACCEPT tcp -- anywhere anywhere tcp multiport ports imaps
ACCEPT tcp -- anywhere anywhere tcp multiport ports smtps
ACCEPT tcp -- anywhere anywhere tcp multiport ports smtp
ACCEPT tcp -- anywhere anywhere tcp multiport ports ms-wbt-server
ACCEPT tcp -- anywhere anywhere tcp multiport ports 8884
ACCEPT udp -- anywhere anywhere udp multiport ports domain
ACCEPT tcp -- anywhere westc01-01-01.local tcp multiport ports ndmp
ACCEPT gre -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:pptp
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT esp -- anywhere anywhere
ACCEPT ah -- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
ACCEPT udp -- anywhere anywhere state NEW,RELATED,ESTABLISHED udp dpt:openvpn