This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Unable to connect to remote client running openVPN

Team,

I am unable to connect to a remote client via OpenVPN. This connection was working before until my computer crashed and I had to rebuild the computer.

I wiresharked my connection and I am getting Reset Packets when attempting to connect.

I have created an exception in the firewall for this host but I'm not sure if it is properly working. The vendor stated that they are not blocking my traffic.

2013:10:25-11:49:54 I_RATHER_BE_IN_VEGAS httpproxy[5463]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="x.1.1.12" dstip="x.208.111.117" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="15" request="0xcc50010" url="x.x.com/.../index.php" exceptions="av,content,url,mime,fileextension,size" error="" application="http"

I'm not sure if the above shows that the firewall is allowing or disallowing this traffic.

Also, when I telnet to the destination over the ssl vpn port I wireshark the connection and receive full connection with no rst packets. The web filter logs do not show anything when using telnet to connect.

If their is anything else I should be checking please let me know and I will do it and/or provide any logs and additional info needed.

Thx

This thread was automatically locked due to age.

0 BarryG over 11 years ago

Hi,

Take a look at UTM (Formerly ASG) Feature Requests: Hot (1436 ideas)

There's probably a similar request there already, if so you can add votes and comments.
If not, post a new request.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 11 years ago

I only know enough Cisco to be able to replace them [;)], so I'm not familiar with its packet trace feature, Phil. Have you tried the Flow Monitor on the WebAdmin Dashboard?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago

Hi Bob, I haven't worked with the ASA's yet, but Google Image Search shows some screenshots if searching for "ASA packet trace"...

It appears to show the path through all the layers of the ASA, including NAT and routing.

Seems like that could be useful.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 11 years ago

Yeah, Barry, that would make it a lot easier to see where there was a misconfiguration.

Have you looked to see if there's an iptables add-on that can do this?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago in reply to BAlfson

Have you looked to see if there's an iptables add-on that can do this?

Hi Bob,

I've been meaning to try out IPTState, but it does not seem to be installed on the UTM.

From the screenshots, it doesn't look like it gives the kind of info that the Cisco tool does:
IP Tables State

I also see some tools mentioned at
linux - Debugging iptables using live packet views - Unix & Linux Stack Exchange

but the first graphing tools appears to be static based on the ruleset, and the others build traffic graphs based on the logs, but do not show the internal (to the firewall) flow.

The LOG and "TRACE chain" mentioned seems to be the most likely to give similar information (but as log entries), but I'm sure that turning that on would explode the log size/volume.

A little more info on TRACE at http://adminberlin.de/iptables-debugging/
Also, there's a nice diagram linked from there: http://inai.de/images/nf-packet-flow.png

For now, it may be simpler to just use your Rulz #2 as a handy reference, and looking at the current logs.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago

BTW, I tried to find a static binary for IPTState, but only found a MIPS (DDWRT) version.

I have a feeling that there will be too many connections in the conntrack table (I assume that's where iptstate gets its info) for it to be very useful, but I posted it anyways to
Add IPTState to the console

Barry
Cancel
Vote Up 0 Vote Down

Cancel

Unable to connect to remote client running openVPN

Submitted a Tech Support Case lately from the Support Portal?