OpenVpn / VIP issue

[Matrix]

FortiGate 

Hello 

i need support, i have an OpenVPN server on my network, and its listening on default port 1194 so I created a VIP from the public to the inside but VPN is not working I have tried multiple ways but no luck, so i ran debug on the srcddrs and I see TCP rst message .

edit OVPN
set comment "OVPN"
set extip 1.1.1.1
set mappedip "2.2.2.2"
set extintf "wan2"
set color 12

FW policy :-
set srcintf "wan2"
set dstintf "lan1"
set srcaddr "all"
set dstaddr "OVPN"
set action accept
set schedule "always"
set service "ALL"
set logtraffic all

wan2 is my secondary circuit, so I created a route policy  for the return traffic 

edit 
set input-device "lan1"
set srcaddr "2.2.2.2"
set dstaddr "all"
set output-device "wan2"

set gateway 1.1.1.2

Thanks 

[gfleming]

Is OPVN using TCP or UDP? I thought it used UDP by default—strange to see a TCP reset.

Can you try using portforwarding on your VIP for 1194 and make sure you specify properly TCP or UDP?

[Matrix]

I agree with you by default Openvpn is using UDP 1194 , so when i just specified UDP on the VIP rule from the debug i got this 

msg="iprope_in_check() check failed on policy 0, drop"

but when i specify TCP , FW is allowing the connection  i got tcp rst

[gfleming]

Can you post the entirety of that flow debug? Showing source and dest IP and everything please.

[Matrix]

x.x.x.x= my host (outside)

1.1.1.1= wan2 ip add ext ip .

2.2.2.2= mapped ip OpenVPN server 
Policy used UDP only 

debug daddrs 1.1.1.1 

dport 1194 

Fortigate# id=20085 trace_id=707 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=6, x.x.x.x:54787->1.1.1.1:1194) from wan2. flag [S], seq 1226657444, ack 0, win 65520"
id=20085 trace_id=707 func=init_ip_session_common line=5898 msg="allocate a new session-2c6e78a1"
id=20085 trace_id=707 func=vf_ip_route_input_common line=2621 msg="find a route: flag=80000000 gw-1.1.1.1 via root"
id=20085 trace_id=707 func=fw_local_in_handler line=435 msg="iprope_in_check() check failed on policy 0, drop"
id=20085 trace_id=708 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=6, x.x.x.x:54787->1.1.1.1:1194) from wan2. flag [S], seq 1226657444, ack 0, win 65520"

another attempt using  tcp vip 

Fortigate # id=20085 trace_id=716 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=6, x.x.x.x:54851->1.1.1.1:1194) from wan2. flag [S], seq 3493853212, ack 0, win 65520"
id=20085 trace_id=716 func=init_ip_session_common line=5898 msg="allocate a new session-2c6f3f82"
id=20085 trace_id=716 func=fw_pre_route_handler line=181 msg="VIP-2.2.2.2:1194, outdev-wan2"
id=20085 trace_id=716 func=__ip_session_run_tuple line=3484 msg="DNAT 1.1.1.1:1194->2.2.2.2:1194"
id=20085 trace_id=716 func=vf_ip_route_input_common line=2621 msg="find a route: flag=00000000 gw-2.2.2.2 via lan1"
id=20085 trace_id=716 func=fw_forward_handler line=799 msg="Allowed by Policy-14:"
id=20085 trace_id=716 func=ipd_post_route_handler line=490 msg="out lan1  vwl_zone_id 0, state2 0x301, quality 0.

[gfleming]

func=fw_forward_handler indicates that the FW has exhausted the FW policy table and is checking local-in policies now. So your policy for OVPN is not being hit by this traffic.

Can you try enabling "port forwarding" on your VIP and specifying UDP and port 1194? 

[Matrix]

Hi Graham 

UDP port-forward is already configured for port 1194 
edit "VIP"
set extip 1.1.1.1
set mappedip "2.2.2.2"
set extintf "wan2"
set portforward enable
set color 12
set protocol udp
set extport 1194
set mappedport 1194

[gfleming]

OK great! So please reference that VIP named "VIP" in your policy instead of "OVPN". Then the FW should handle the UDP DNAT.

[Matrix]

Hi Graham sorry for my late response 
after long troubleshooting, i asked the customer how is he testing and they are testing by telnet then the public ip :  port number from windows cmd -_- that is why i am seeing TCP instead of UDP , So after they start testing using their tool I was able to see the connection but only in one direction from the GUI policy usage there is only sent packets but no received from OpenServer.

id=20085 trace_id=952 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=17, x.x.x.x:52633->1.1.1.1:1194) from wan2. "
id=20085 trace_id=952 func=init_ip_session_common line=5898 msg="allocate a new session-2c8e90d2"
id=20085 trace_id=952 func=fw_pre_route_handler line=181 msg="VIP-2.2.2.2:1194, outdev-wan2"
id=20085 trace_id=952 func=__ip_session_run_tuple line=3484 msg="DNAT 1.1.1.1:1194->2.2.2.2:1194"
id=20085 trace_id=952 func=vf_ip_route_input_common line=2621 msg="find a route: flag=00000000 gw-2.2.2.2 via lan1"
id=20085 trace_id=952 func=fw_forward_handler line=799 msg="Allowed by Policy-14:"
id=20085 trace_id=952 func=ipd_post_route_handler line=490 msg="out port1 vwl_zone_id 0, state2 0x301, quality 0.
"

sniffer 
2023-01-31 05:16:55.844842 lan1 out x.x.x.x.52633 -> 2.2.2.2.1194: udp 21

this time I believe its the server issue not replying back 

[gfleming]

You might not see the reply on your debug flow output if you were using a specific filter to only view the inbound connection. What filtering if any were you using?

Also are you sure OpenVPN is listening properly on UDP port 1194? Can you verify with netstat or other tool on the host?