FW-Rules for openVPN neccessary?

[berny (First Name Last Name)]

The openVPN connection is configured with access into the GREEN network. It is displayed as “CONNECTED” in the IPFire “WebUI”.
The external device (Android with ‘OpenVPN for Android’) shows that the connection is established.
The IPFire-Proxy is set in /var/ipfire/ovpn/scripts/server.conf.local (push dhcp-option PROXY_HTTP 8080) and populated to the VPN-Client. (The log at the external device shows that the option is set on the device.)
The OpenVPN-Client is configured to route all traffic through the tunnel.

But the browser, k9, dav and other apps are not able to reach they targets.

IPFire Filrewall logs does not show any blocked connections. The proxy log does not show any connections.

Any hints to get this running?

[cfusco]

I quote my own howto openvpn guide for mobile devices:

@cfusco

There is no mechanism for OpenVPN connect to communicate to any other App the use of a proxy server. For this you need to input the information in the WiFi or APN configuration file. You can find many tutorials online to accomplish this task. This is not true for iOS, which can be easily configured to relay this information to other apps, as we shall see in the next section.

In other words, in android you have to MANUALLY set the proxy configuration in the wifi and apn settings, and possibly even in some app. This works instead automatically in iOS devices.

[roberto (Roberto Peña)]

Hi @berny.

Can you access to IPFire console when you are connect with OpenVPN?. I explain this.

1. Connect with your Android to OpenVPN connection.
2. Try to connect the IPFire to the Console using Green’s IP.

Me, without doing any rules or anything, I can connect to the IPFire Console (when connected via OpenVPN) and also to Samba and a computer via RDP from my Android phone.

It may be a problem with the equipment you want to access.

Do you have a load balancer in your network?

Try and say us something.

Greetings.

[berny (First Name Last Name)]

No problem. Even if a app does not use the proxy its traffic should be routed through the VPN.

[berny (First Name Last Name)]

How is your IPFire configured? I have choosen to block all traffic by default (FireWall Options / Default Firewall behavior / Blocked at forward and outgoing.

Therefore I ask for needed rules to allow the traffic.

[roberto (Roberto Peña)]

Here you have the “Firewall Options” settings:

And to force everyone to go through the Proxy (I have it “non-transparent”):

Proxy/URL filter not working

Good morning @ndg1987. The proxy in transparent mode does not filter HTTPS requests, only HTTPs. If you distribute the PAC, I understand that you have it in “Non-transparent” mode. The same happens to me. For it to be all filtered, it is necessary to force all requests to go through the proxy. For this I have created the following rules in the Firewall: 1º Create a group with the HTTPS and HTTP services. [imagen] 2º Create the rule that prevents HTTPS and HTTP requests that do not go throu…

BR.

[cfusco]

If you have closed the Forward and outgoing by default, I suppose in source you select the OpenVPN network and in destination the firewall, allow on UDP port 1194 (this should take care of the forward block). Also, source Firewall and destination the OpenVPN network UDP:1194 allowed (outgoing block bypass). Never tried though.

[berny (First Name Last Name)]

I do not understand how the packets are flow trough the FW.
My IPFire is connected to the Internet at red; both main settings (forward and outgoing) are set the 'Blocked"; no masquerading disabled on green.
I have two mobiles (iOS, with ‘OpenVPN’ from OpenVPN Technologies and Android with ‘OpenVPN for Android’ from F-Droid). I configured both apps that all traffic is routed through the tunnel (via cellular network). Both shows ‘connected’ in the IPfire / Services / OpenVPN.
But it seems that there are no connection possible.
At the iPhone the AppStore, or any other Website (checked with Firefox, Firefox Klar and Safari) is not reachable, the same at the Android, the OpenVPN App shows ‘connected’ but nothing is reachable. (I try to reach the IPFire-WebUI at Port 444, too.)

Is there a graphic how the packet are flow trough the IPFire? Are there additional settings neccesary when configuring a OpenVPN?