Arch Linux

Phalkon

Member

Registered: 2014-10-19

Posts: 117

networkmanager, openvpn and iptables

Hi, I'm getting these strange error messages from network manager when i try to connect to a vpn.

write to TUN/TAP : Input/output error (code=5)

Network manager fails to create a tap0 interface.

I've noticed, that the issue is connected to iptables. If I accept all the packets, the problem disappears.
This is my iptables script:

#!/bin/sh

IPT='sudo iptables'

$IPT -F
$IPT -X

# policies
$IPT -P OUTPUT DROP                                                    # default policy for outgoing packets
$IPT -P INPUT DROP                                                     # default policy for incoming packets
$IPT -P FORWARD DROP                                                   # default policy for forwarded packets

# enable responses
$IPT -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT        
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT         

## ALLOWED OUTPUTS ##
$IPT -A OUTPUT -o lo -j ACCEPT                                         # enable localhost
$IPT -A OUTPUT -p udp --dport 67:68 --sport 67:68 -j ACCEPT            # DHCP requests
$IPT -A OUTPUT -o tap0 -j ACCEPT                                       # enable outputs on OpenVPN interface
$IPT -A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT                  # enable ping to other machines

$IPT -A OUTPUT -p udp -m iprange --dst-range 147.251.0.0-147.251.255.255 -m multiport --dports 53,1194 -j ACCEPT # this is needed to establish VPN connection and DNS requests                           

## ALLOWED INPUTS
$IPT -A INPUT -i lo -j ACCEPT                                          # enable localhost
$IPT -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT                  # enable ping from other machines

## LOGGING
$IPT -A INPUT  -j LOG  -m limit --limit 2/min --log-prefix 'IP INPUT drop: ' --log-level 7
$IPT -A OUTPUT -j LOG  -m limit --limit 2/min --log-prefix 'IP OUTPUT drop: ' --log-level 7
$IPT -A FORWARD -j LOG  -m limit --limit 2/min --log-prefix 'IP FORWARD drop: ' --log-level 7

I'm restricting OUTPUT to prevent packets from leaking outside VPN in case VPN connection drops.
When I accept everything on the OUTPUT, it sometimes works and sometimes i get this error.

write UDP: Operation not permitted (code=1)

Which also means that Network manager failed to make tap0 interface.

The most strange thing about this is, that I'm logging all the packets that are dropped (even tried to get rid of the limit rate) and there are no dropped packets that could cause this behaviour. Also, when I try to connect to VPN using the openvpn command from commandline, I don't get these errors and tap0 is created without any problems.

---

Why Linux? Because it doesn't hide anything from you. It puts you so closely in control of your machine that you can feel its heartbeat.

R00KIE

Forum Fellow

From: Between a computer and a chair

Registered: 2008-09-14

Posts: 4,734

Re: networkmanager, openvpn and iptables

Maybe the same problem as described here https://bbs.archlinux.org/viewtopic.php?id=224056

When posting your firewall configuration please post the output of 'iptables-save' so we can have a full picture of the rules.

---

R00KIE
Tm90aGluZyB0byBzZWUgaGVyZSwgbW92ZSBhbG9uZy4K