OpenVPN not able to connect to public IP interface
by THawk254 from LinuxQuestions.org on (#5644K)
I have 2 sites that used to be linked via OpenVPN. For some reason it stopped working.
General setups:
Server OS: CentOS 7
OpenVPN v2.4.9
EasyRSA v.3.0.7
Edge firewall and VPN server is the same box. Using firewalld. IPTables is not running on either machine.
Firewall settings:
Quote:
While trying to connect to the public interface, client side has been getting:
Quote:
I've done a tcpdump of my public facing interface
Quote:
Nothing shows, which tells me that the packets aren't even hitting the interface.
I have also asked my ISP whether they are actively filtering OpenVPN, to which they have answered in the negative.
Any help / advice would be greatly appreciated.


General setups:
Server OS: CentOS 7
OpenVPN v2.4.9
EasyRSA v.3.0.7
Edge firewall and VPN server is the same box. Using firewalld. IPTables is not running on either machine.
Firewall settings:
Quote:
public (active) target: DROP icmp-block-inversion: yes interfaces: enp2s0 sources: services: openvpn ports: protocols: masquerade: yes forward-ports: source-ports: icmp-blocks: rich rules: |
Quote:
UDP WRITE [86] to [AF_INET](public IP Address):1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #1 ] [ ] pid=0 DATA len=0 UDP WRITE [86] to [AF_INET](public IP Address):1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #2 ] [ ] pid=0 DATA len=0 UDP WRITE [86] to [AF_INET](public IP Address):1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #3 ] [ ] pid=0 DATA len=0 UDP WRITE [86] to [AF_INET](public IP Address):1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #4 ] [ ] pid=0 DATA len=0 UDP WRITE [86] to [AF_INET](public IP Address):1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #5 ] [ ] pid=0 DATA len=0 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) TLS Error: TLS handshake failed |
Quote:
tcpdump -vni enp2s0 port 1194 and udp |
I have also asked my ISP whether they are actively filtering OpenVPN, to which they have answered in the negative.
Any help / advice would be greatly appreciated.