I recently signed a VPS (OpenVZ / Debian 32 bits Minimal), installed OpenVPN-AS (Access Server), and successfully connect to it, however I have a few doubts.

To make it clear, I will explain how I installed OpenVPN-AS and what steps I made.

  • Enabled TUN/TAP and PPP on the SolusVM interface

  • Updated Debian

  • Installed OpenVPN-AS following this guide:


  • Added two users following this guide:


  • Login with the created user, downloaded the "client.ovpn" file and login with it, using the command: sudo openvpn --config client.ovpn

That's pretty much what I did.

Everything works, but there are some catchs. I opened the ports 443 (TCP) and 1194 (UDP), in both, router and client system (which is Ubuntu 12.10), and configured Deluge and Transmission to use the 1194 port. When the VPN is turned off, the tests on both programs shows that the port is open, however when I connect the VPN, the port appears closed on the tests, and here is the catch: Deluge and Transmission connects only trough TCP port, and the 1194 port of the VPN is UDP only.

That's what brings my number one question: What I should do to open the 1194 port on the VPN? It's possible force Deluge or Transmission to use UDP port?

My second question is simpler (I think so). As I said before, I can connect to the VPN using the command "sudo openvpn --config client.ovpn", the downside is that it's necessary keep the terminal open, I'd like to connect trough the graphical interface, typically: click on the network manager on the top bar > go to VPN connections > select the connection > and done. But I dunno how to do this, and that's my second question: How can I export the "client.ovpn" configurations or setup the connection through the graphical interface?

I use Ubuntu for an year and half, and I consider myself an intermediary user, however, I've never played with VPS and OpenVPN-AS before, so I'm a totally noob on the subject. I have googled my doubts, but most tutorials are OpenVPN based, and not OpenVPN-AS, and apparently they are quite different.

I hope that my post it's clear enough, and sorry about my english. Any help would be appreciated, thanks!


Concerning your first question: UDP port 1149 should be open at the server so clients could connect to it. I checked here and the client seems to use a higher port range (>50000) by default to send and receive UDP packets to server port 1149.

However, it appears you have a slight misunstanding about the working of a VPN, so I try to clear it up a little. On startup of the client the routing table should be adjusted so that all (or most or some, that depends on your config) traffic goes through the tun0 interface instead of the eth0 interface. The only packets going directly through eth0 should be UDP packets to the server at port 1149, every other packets, TCP or UDP or ICMP, are routed through tun0 where they are encapsulated by openvpn and then send via the 1149 UDP packets through eth0 to the server.

At the server the encapsulation is reversed and the TCP, UDP or ICMP packets are reassembled and send from there like they originate from a neighbouring network node incoming on a local interface (eth0/tun0/tap0) and are routed accordingly. So your client appears to "own" an interface on the server. Hence the name virtual private network.

So you have to configure transmission or deluge to use any other port than 1149 - because this one is used by VPN - i.e. 16000 (TCP and UDP). Use this port in transmission or deluge and open it in the firewall on the server and possibly route it to the VPN interface, so in this example (assuming server has interface eth0):

Open ports 16000 on the server

iptables -A INPUT -i eth0 -m tcp -p tcp --dport 16000 -j ACCEPT
iptables -A INPUT -i eth0 -m udp -p udp --dport 16000 -j ACCEPT

and apply NAT. These lines redirects all incoming TCP and UDP connections to ports 16000-16010 on the server to the VPN interface with the IP address

iptables -t nat -A PREROUTING -i eth0 -m multiport -p udp --dports 16000:16010 -j DNAT --to-destination
iptables -t nat -A PREROUTING -i eth0 -m multiport -p tcp --dports 16000:16010 -j DNAT --to-destination

Well, there may be other or better ways to handle this, but this should get you started.

| improve this answer | |
  • As I understand it, I have to forward ports through iptables, right? But our VPNs use different setups, my VPN is using port 443 (TCP) and 1194 (UDP) , and venet0 instead of eth0. The commands provided in this page should forward all the traffic, or am I wrong? unixtitan.net/main/2010/09/20/openvpn-in-openvz-no-masquerade – Removed Apr 22 '13 at 5:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.