我正在尝试安装openvpn并取得一些进展。
我还没有到达testing隧道的地步 – 我首先要确保通过防火墙正确设置端口。
如果我telnet 1194端口到iptables上的服务器，并运行tcpdump，我得到：
22:39:28.933049 IP xxx.56236 > ip.openvpn: S 4157464468:4157464468(0) win 8192 <mss 1460,nop,nop,sackOK> 22:39:28.934723 IP ip.openvpn > xxx.56236: R 0:0(0) ack 4157464469 win 0 但是如果我重新打开iptables，它似乎只得到数据包，但不发送回复：
22:39:28.933049 IP xxx.56236 > ip.openvpn: S 4157464468:4157464468(0) win 8192 <mss 1460,nop,nop,sackOK>
任何想法为什么？ 我的iptables看起来像这样：
[root@westc01-01-01 sysconfig]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination RH-Firewall-1-INPUT all -- anywhere anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination RH-Firewall-1-INPUT all -- anywhere anywhere ACCEPT all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain RH-Firewall-1-INPUT (2 references) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp multiport ports http ACCEPT tcp -- anywhere anywhere tcp multiport ports https ACCEPT tcp -- anywhere anywhere tcp multiport ports submission ACCEPT tcp -- anywhere anywhere tcp multiport ports imap ACCEPT tcp -- anywhere anywhere tcp multiport ports imaps ACCEPT tcp -- anywhere anywhere tcp multiport ports smtps ACCEPT tcp -- anywhere anywhere tcp multiport ports smtp ACCEPT tcp -- anywhere anywhere tcp multiport ports ms-wbt-server ACCEPT tcp -- anywhere anywhere tcp multiport ports 8884 ACCEPT udp -- anywhere anywhere udp multiport ports domain ACCEPT tcp -- anywhere westc01-01-01.local tcp multiport ports ndmp ACCEPT gre -- anywhere anywhere ACCEPT tcp -- anywhere anywhere tcp dpt:pptp ACCEPT all -- anywhere anywhere ACCEPT icmp -- anywhere anywhere icmp any ACCEPT esp -- anywhere anywhere ACCEPT ah -- anywhere anywhere ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns ACCEPT udp -- anywhere anywhere udp dpt:ipp ACCEPT tcp -- anywhere anywhere tcp dpt:ipp ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh REJECT all -- anywhere anywhere reject-with icmp-host-prohibited ACCEPT udp -- anywhere anywhere state NEW,RELATED,ESTABLISHED udp dpt:openvpn
为什么不切换这些规则的顺序？
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited ACCEPT udp -- anywhere anywhere state NEW,RELATED,ESTABLISHED udp dpt:openvpn