5

I am trying to open port 1194 for UDP openvpn traffic.

'ufw status' shows it should be open:

$ sudo ufw status
WARN: Duplicate profile 'Apache', using last found
WARN: Duplicate profile 'Apache Secure', using last found
WARN: Duplicate profile 'Apache Full', using last found
Status: active

To                         Action      From
--                         ------      ----
...
1194/udp                   ALLOW       Anywhere
1194/udp (v6)              ALLOW       Anywhere (v6)

According to iptables, it is open:

$ sudo iptables -L | less
...
Chain ufw-user-input (1 references)
...
ACCEPT     udp  --  anywhere             anywhere             udp dpt:openvpn

OpenVPN is listening on that port (if I am interpreting this correctly):

$ sudo netstat -vaun
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
...
udp        0      0 0.0.0.0:1194            0.0.0.0:*

But the port 1194 is closed - I can't connect my client, and online UDP port scanners say it is closed.

I have just tried running nmap, and see this:

$ sudo nmap -sU localhost -p 1194

Starting Nmap 6.40 ( http://nmap.org ) at 2016-11-13 17:58 GMT
Nmap scan report for localhost (127.0.0.1)
Host is up.
PORT     STATE         SERVICE
1194/udp open|filtered openvpn

I guess "filtered" is the problem (or maybe not, as it is UDP?), but am not sure how to fix it. Does anyone have any ideas?

Update: Apologies to the user who kindly placed a bounty on this question, and all those who have offered advice, but embarrassingly this is now working after a physical reboot of both server and client. I can't even say for sure which one fixed it - but since I believe I restarted all affected services on the server after making changes, I actually wonder if the Windows OpenVPN client may have needed a restart after the TAP driver installation so to anyone reading this, if you are having problems, try a different client eg OpenVPN Connect on Android. Again, apologies for not trying this sooner!

  • What does sudo ufw show listening say? – AlexP Dec 15 '16 at 17:43
  • 1
    If you are trying to connect from the internet, did you tell your router to forward the port to the host? – AlexP Dec 15 '16 at 18:32
  • Thanks for your reply. The command shows that it is listening in the UDP section: udp: 1194 * (openvpn) [ 4] allow 1194/udp – Chris Dec 17 '16 at 11:24
  • Good thought, but my host is a VPS and not behind a router or firewall so I think the filtering is happening in the server itself – Chris Dec 17 '16 at 11:25
  • As UDP is stateless so, it will not respond to your nmap. You also checked with an online tool, which means you are behind a router. Is the port forwarded on your router to your openvpn server? – Carl Dec 20 '16 at 14:46
2
+50

Open/Filtered is a normal state for OpenVPN, specifically UDP. Here's an output of nmap on my own server (with a working VPN) showing the exact same state on that port:

[+] Nmap scan report for vpn.[redacted].com ([redacted])
Host is up (0.15s latency).

PORT     STATE         SERVICE
1194/udp open|filtered openvpn

As stated in the nmap docs, open|filtered means that NMAP can not determine for whatever reason, but it doesn't think the port is explicitly closed. If this is the case, the best way to actually check would be to just try to use the port, and see if it works or not. So, in this case, connect to the OpenVPN host and see what happens.

1

Here nmap shows result Filtered which means that a firewall, filter, or other network obstacle is blocking the port so that Nmap cannot tell whether it is open or closed. In this case openvpn is using that port, that's why nmap is showing filtered. Use nc command.

Example:  nc -u 192.168.0.12 1194 
  • telnet only connects via tcp, not udp as the OP is asking about – user4556274 Dec 20 '16 at 12:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.