Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Matrix
New Contributor III

OpenVpn / VIP issue

FortiGate 

Hello 

i need support, i have an OpenVPN server on my network, and its listening on default port 1194 so I created a VIP from the public to the inside but VPN is not working I have tried multiple ways but no luck, so i ran debug on the srcddrs and I see TCP rst message .

 

 

 

edit OVPN
set comment "OVPN"
set extip 1.1.1.1
set mappedip "2.2.2.2"
set extintf "wan2"
set color 12


FW policy :-
set srcintf "wan2"
set dstintf "lan1"
set srcaddr "all"
set dstaddr "OVPN"
set action accept
set schedule "always"
set service "ALL"
set logtraffic all

 

wan2 is my secondary circuit, so I created a route policy  for the return traffic 

edit 
set input-device "lan1"
set srcaddr "2.2.2.2"
set dstaddr "all"
set output-device "wan2"

set gateway 1.1.1.2

Thanks 

1 Solution
gfleming

You probably don't need to configure any SNAT for this. By default the DNAT VIP will SNAT the return traffic.

 

Also, you have a policy route that sends traffic from OVPN out WAN2. Your FIrewall policy allowing this traffic will SNAT it to the WAN2 IP address.

 

If you have multiple IP addresses on the WAN2 interface and you want to use these for SNAT (and same for the DNAT VIP you already created) then if you want traffic that is initiated from the OVPN to use SNAT you can enable "nat-source-vip" from the CLI on your DNAT VIP. See here for more details: https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/510402/static-virtual-ips

 

Cheers,
Graham

View solution in original post

13 REPLIES 13
gfleming
Staff
Staff

Is OPVN using TCP or UDP? I thought it used UDP by default—strange to see a TCP reset.

 

Can you try using portforwarding on your VIP for 1194 and make sure you specify properly TCP or UDP?

Cheers,
Graham
Matrix
New Contributor III

I agree with you by default Openvpn is using UDP 1194 , so when i just specified UDP on the VIP rule from the debug i got this 

msg="iprope_in_check() check failed on policy 0, drop"

but when i specify TCP , FW is allowing the connection  i got tcp rst

gfleming

Can you post the entirety of that flow debug? Showing source and dest IP and everything please.

Cheers,
Graham
Matrix
New Contributor III

x.x.x.x= my host (outside)

1.1.1.1= wan2 ip add ext ip .

2.2.2.2= mapped ip OpenVPN server 
Policy used UDP only 

debug daddrs 1.1.1.1 

dport 1194 

 

Fortigate# id=20085 trace_id=707 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=6, x.x.x.x:54787->1.1.1.1:1194) from wan2. flag [S], seq 1226657444, ack 0, win 65520"
id=20085 trace_id=707 func=init_ip_session_common line=5898 msg="allocate a new session-2c6e78a1"
id=20085 trace_id=707 func=vf_ip_route_input_common line=2621 msg="find a route: flag=80000000 gw-1.1.1.1 via root"
id=20085 trace_id=707 func=fw_local_in_handler line=435 msg="iprope_in_check() check failed on policy 0, drop"
id=20085 trace_id=708 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=6, x.x.x.x:54787->1.1.1.1:1194) from wan2. flag [S], seq 1226657444, ack 0, win 65520"

another attempt using  tcp vip 

Fortigate # id=20085 trace_id=716 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=6, x.x.x.x:54851->1.1.1.1:1194) from wan2. flag [S], seq 3493853212, ack 0, win 65520"
id=20085 trace_id=716 func=init_ip_session_common line=5898 msg="allocate a new session-2c6f3f82"
id=20085 trace_id=716 func=fw_pre_route_handler line=181 msg="VIP-2.2.2.2:1194, outdev-wan2"
id=20085 trace_id=716 func=__ip_session_run_tuple line=3484 msg="DNAT 1.1.1.1:1194->2.2.2.2:1194"
id=20085 trace_id=716 func=vf_ip_route_input_common line=2621 msg="find a route: flag=00000000 gw-2.2.2.2 via lan1"
id=20085 trace_id=716 func=fw_forward_handler line=799 msg="Allowed by Policy-14:"
id=20085 trace_id=716 func=ipd_post_route_handler line=490 msg="out lan1  vwl_zone_id 0, state2 0x301, quality 0.

 

gfleming

func=fw_forward_handler indicates that the FW has exhausted the FW policy table and is checking local-in policies now. So your policy for OVPN is not being hit by this traffic.

 

Can you try enabling "port forwarding" on your VIP and specifying UDP and port 1194? 

 

Cheers,
Graham
Matrix
New Contributor III

Hi Graham 

UDP port-forward is already configured for port 1194 
edit "VIP"
set extip 1.1.1.1
set mappedip "2.2.2.2"
set extintf "wan2"
set portforward enable
set color 12
set protocol udp
set extport 1194
set mappedport 1194

 

 

Forti sessions.JPG

gfleming

OK great! So please reference that VIP named "VIP" in your policy instead of "OVPN". Then the FW should handle the UDP DNAT.

Cheers,
Graham
Matrix
New Contributor III

Hi Graham sorry for my late response 
after long troubleshooting, i asked the customer how is he testing and they are testing by telnet then the public ip :  port number from windows cmd -_- that is why i am seeing TCP instead of UDP , So after they start testing using their tool I was able to see the connection but only in one direction from the GUI policy usage there is only sent packets but no received from OpenServer.


id=20085 trace_id=952 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=17, x.x.x.x:52633->1.1.1.1:1194) from wan2. "
id=20085 trace_id=952 func=init_ip_session_common line=5898 msg="allocate a new session-2c8e90d2"
id=20085 trace_id=952 func=fw_pre_route_handler line=181 msg="VIP-2.2.2.2:1194, outdev-wan2"
id=20085 trace_id=952 func=__ip_session_run_tuple line=3484 msg="DNAT 1.1.1.1:1194->2.2.2.2:1194"
id=20085 trace_id=952 func=vf_ip_route_input_common line=2621 msg="find a route: flag=00000000 gw-2.2.2.2 via lan1"
id=20085 trace_id=952 func=fw_forward_handler line=799 msg="Allowed by Policy-14:"
id=20085 trace_id=952 func=ipd_post_route_handler line=490 msg="out port1 vwl_zone_id 0, state2 0x301, quality 0.
"

sniffer 
2023-01-31 05:16:55.844842 lan1 out x.x.x.x.52633 -> 2.2.2.2.1194: udp 21

this time I believe its the server issue not replying back 

gfleming

You might not see the reply on your debug flow output if you were using a specific filter to only view the inbound connection. What filtering if any were you using?

 

Also are you sure OpenVPN is listening properly on UDP port 1194? Can you verify with netstat or other tool on the host?

 

 

Cheers,
Graham
Labels
Top Kudoed Authors