Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 7 replies
  • Answers 1 answer
  • Subscribers 40 subscribers
  • Views 4506 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN no Internet access

NismoC32

I have set up a SSL VPN connection in SOHPOS Firewall v20 Build 222.
I can access local services and machines no problems there, but I cant get internet access.

When I ping external sources no packages comes through, however domain names are resolved:

ping www.kde.org:
PING tyran.kde.org (85.10.198.55) 56(84) bytes of data.
^C
--- tyran.kde.org ping statistics ---
42 packets transmitted, 0 received, 100% packet loss, time 41959ms

This is my settings:

The SSL VPN Global settings

Mostly kept as is but added Override hostname (Same as DDNS) witch resolves to my IP
The IPv4 DNS Servers are both in my network one of them is the DNS on the Firewall

My user login settings:

Using tunnel as default gateway on or off makes no difference.
The LAN Network contains local ip range 192.168.10.0/24
I tried adding #Port2 just to have tried every possibilities I could think off. It is now removed since it had no effect.

Automatic generated Firewall rule:

Only change her is I tried adding ##ALL_SSLVPN_RW to source network.
No VPN firewall Security features is enabled.

SSL VPN Authentication method:

Default kept here.

Clients:

I’m using OpenVPN Client 3.4.2 on my mobile devices and NetworkManager (KDE5) on my Laptop

Some changes had to be maid to the .ovpn file downloaded to get it to import in NetworkManager
The following line needed to be commented out:

route remote_host 255.255.255.255 net_gateway

The default LAN to WAN Firewall rule is left at default except
Block QUIC protocol ha been activated and all Malware and Conetnt scanning is activated.
So Source, Destination and Services is set to Any

I have tried different setting all over without any changes. I’m out of ideas on how to get this to work.
The traffic has to be blocked somewhere, I just cant see what.



This thread was automatically locked due to age.
Parents
  • 0

    Please check via tcpdump on the XGS if the internet traffic packets are reaching the XGS. If they are not, then please check on the client which route they are taking. Also, for any dropped packets on the XGS, you can use drppkt command (by doing ssh to the XGS device and logging in to the shell) on the XGS shell to see if packets are being dropped.

Reply
  • 0

    Please check via tcpdump on the XGS if the internet traffic packets are reaching the XGS. If they are not, then please check on the client which route they are taking. Also, for any dropped packets on the XGS, you can use drppkt command (by doing ssh to the XGS device and logging in to the shell) on the XGS shell to see if packets are being dropped.

Children
  • 0 in reply to Nikhil Bhandari

    This is the result using "tcpdump -ni any host 10.81.128.2 and port 443" the host ip is given by my Phone OpenVPN client.

    13:26:31.488771 tun1, IN: IP 10.81.128.2.39360 > 2.18.173.122.443: Flags [S], seq 370937932, win 65535, options [mss 1358,sackOK,TS val 298788200 ecr 0,nop,wscale 9], length 0
13:26:31.488814 Port2, OUT: IP 10.81.128.2.39366 > 2.18.173.122.443: Flags [S], seq 3836457531, win 65535, options [mss 1358,sackOK,TS val 298788200 ecr 0,nop,wscale 9], length 0
13:26:31.488836 Port2, OUT: IP 10.81.128.2.39360 > 2.18.173.122.443: Flags [S], seq 370937932, win 65535, options [mss 1358,sackOK,TS val 298788200 ecr 0,nop,wscale 9], length 0
13:26:31.488870 Port2, OUT: IP 10.81.128.2.39362 > 2.18.173.122.443: Flags [S], seq 878262122, win 65535, options [mss 1358,sackOK,TS val 298788200 ecr 0,nop,wscale 9], length 0
13:26:31.488872 Port2, OUT: IP 10.81.128.2.39364 > 2.18.173.122.443: Flags [S], seq 85460282, win 65535, options [mss 1358,sackOK,TS val 298788200 ecr 0,nop,wscale 9], length 0
13:26:31.839669 tun1, IN: IP 10.81.128.2.39374 > 2.18.173.122.443: Flags [S], seq 2999097084, win 65535, options [mss 1358,sackOK,TS val 298788552 ecr 0,nop,wscale 9], length 0
13:26:31.839744 Port2, OUT: IP 10.81.128.2.39374 > 2.18.173.122.443: Flags [S], seq 2999097084, win 65535, options [mss 1358,sackOK,TS val 298788552 ecr 0,nop,wscale 9], length 0
13:26:31.951726 tun1, IN: IP 10.81.128.2.37248 > 143.204.42.139.443: Flags [S], seq 582205117, win 65535, options [mss 1358,sackOK,TS val 3475936391 ecr 0,nop,wscale 9], length 0
13:26:31.951811 Port2, OUT: IP 10.81.128.2.37248 > 143.204.42.139.443: Flags [S], seq 582205117, win 65535, options [mss 1358,sackOK,TS val 3475936391 ecr 0,nop,wscale 9], length 0
13:26:32.230503 tun1, IN: IP 10.81.128.2.37250 > 143.204.42.139.443: Flags [S], seq 2887704772, win 65535, options [mss 1358,sackOK,TS val 3475936647 ecr 0,nop,wscale 9], length 0
13:26:32.230599 Port2, OUT: IP 10.81.128.2.37250 > 143.204.42.139.443: Flags [S], seq 2887704772, win 65535, options [mss 1358,sackOK,TS val 3475936647 ecr 0,nop,wscale 9], length 0

    and it looks like the packages reaches the firewall.

    drppkt does not report anything dropped.

Unfiltered HTML