Explorer

Solved

OpenVpn / VIP issue

13 replies
7415 views

Hello

i need support, i have an OpenVPN server on my network, and its listening on default port 1194 so I created a VIP from the public to the inside but VPN is not working I have tried multiple ways but no luck, so i ran debug on the srcddrs and I see TCP rst message .

edit OVPN
set comment "OVPN"
set extip 1.1.1.1
set mappedip "2.2.2.2"
set extintf "wan2"
set color 12

FW policy :-
set srcintf "wan2"
set dstintf "lan1"
set srcaddr "all"
set dstaddr "OVPN"
set action accept
set schedule "always"
set service "ALL"
set logtraffic all

wan2 is my secondary circuit, so I created a route policy for the return traffic

edit
set input-device "lan1"
set srcaddr "2.2.2.2"
set dstaddr "all"
set output-device "wan2"

set gateway 1.1.1.2

Thanks

FortiGate

gflemingAnswer

Staff

You probably don't need to configure any SNAT for this. By default the DNAT VIP will SNAT the return traffic.

Also, you have a policy route that sends traffic from OVPN out WAN2. Your FIrewall policy allowing this traffic will SNAT it to the WAN2 IP address.

If you have multiple IP addresses on the WAN2 interface and you want to use these for SNAT (and same for the DNAT VIP you already created) then if you want traffic that is initiated from the OVPN to use SNAT you can enable "nat-source-vip" from the CLI on your DNAT VIP. See here for more details: https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/510402/static-virtual-ips

gfleming

Staff

Is OPVN using TCP or UDP? I thought it used UDP by default—strange to see a TCP reset.

Can you try using portforwarding on your VIP for 1194 and make sure you specify properly TCP or UDP?

MatrixAuthor

Explorer

I agree with you by default Openvpn is using UDP 1194 , so when i just specified UDP on the VIP rule from the debug i got this

msg="iprope_in_check() check failed on policy 0, drop"

but when i specify TCP , FW is allowing the connection i got tcp rst

gfleming

Staff

Can you post the entirety of that flow debug? Showing source and dest IP and everything please.

MatrixAuthor

Explorer

Hi Graham sorry for my late response
after long troubleshooting, i asked the customer how is he testing and they are testing by telnet then the public ip : port number from windows cmd -_- that is why i am seeing TCP instead of UDP , So after they start testing using their tool I was able to see the connection but only in one direction from the GUI policy usage there is only sent packets but no received from OpenServer.

id=20085 trace_id=952 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=17, x.x.x.x:52633->1.1.1.1:1194) from wan2. "
id=20085 trace_id=952 func=init_ip_session_common line=5898 msg="allocate a new session-2c8e90d2"
id=20085 trace_id=952 func=fw_pre_route_handler line=181 msg="VIP-2.2.2.2:1194, outdev-wan2"
id=20085 trace_id=952 func=__ip_session_run_tuple line=3484 msg="DNAT 1.1.1.1:1194->2.2.2.2:1194"
id=20085 trace_id=952 func=vf_ip_route_input_common line=2621 msg="find a route: flag=00000000 gw-2.2.2.2 via lan1"
id=20085 trace_id=952 func=fw_forward_handler line=799 msg="Allowed by Policy-14:"
id=20085 trace_id=952 func=ipd_post_route_handler line=490 msg="out port1 vwl_zone_id 0, state2 0x301, quality 0.
"

sniffer
2023-01-31 05:16:55.844842 lan1 out x.x.x.x.52633 -> 2.2.2.2.1194: udp 21

this time I believe its the server issue not replying back

gfleming

Staff

You might not see the reply on your debug flow output if you were using a specific filter to only view the inbound connection. What filtering if any were you using?

Also are you sure OpenVPN is listening properly on UDP port 1194? Can you verify with netstat or other tool on the host?

MatrixAuthor

Explorer

Thanks, Graham VPN is working well now I just allowed UDP 1194 and TCP port 22 i think something was wrong from OVPN side .

One last question what if I want to do Snat on that same mapped IP

Dnat 1.1.1.1 :1194 mapped to 2.2.2.2 :1194

2.2.2.2 natted to 1.1.1.1 >>> public internet

For Snat should I configure another policy using ippool? or is there any feature on the forti for the return traffic using same dnat public ip ?

MatrixAuthor

Explorer

"

filters=[ host 2.2.2.2 ]
2023-01-31 05:57:07.578320 lan1 out x.x.x.x.54791 -> 2.2.2.2.1194: udp 21
2023-01-31 05:57:12.578504 lan1 out arp who-has 2.2.2.2 tell 2.2.2.254
2023-01-31 05:57:12.578633 lan1 in arp reply 2.2.2.2 is-at 7c:4f:34:12:8b:90

Sign up

Login with SSO

Login to the community

Login with SSO