1

this is been puzzling me for months now, i tried to google this, but results are often irrelevant, like questions about why is something not working for someone and how to deal with firewall problems.

i have the opposite situation, my tunnel works when i think it should not.

this is my setup: i have windows 7 running in virtualbox on ubuntu 14.04. (the nic is virtualbox NAT)

the ubuntu is connected to a Net gear router then to my cable modem then to internet.

i believe i have some firewalls on both windows and ubuntu but i definitely have a firewall on the router that rejects incoming packets, unless the connection was initiated from behind the firewall.

now my question is why can i run a open vpn client in windows 7 and successfully connect to internet over udp ports?

i understand why tcp would work. tcp connections are initiated by the client in windows, therefore openvpn server replies should go thru the firewall.

but udp is stateless. it is fire and forget, my windows 7 client would fire something to openvpn server and forget, then the server would fire something back and forget, to the firewall on the router this should look like a connection being initiated from the outside, and the firewall should block this but it doesnt and my udp tunnel works? amazing stuff.

Improve this question
3
  • home networking / consumer eqiupment belong on Super User. Ubuntu (even VPN/NAT) questions are more likely to get an asnwer from Server Fault or Ask Ubuntu.
    – Craig Constantine
    Dec 21, 2015 at 15:58
  • can i move it there? or you can just close this thread.
    – user2567411
    Dec 23, 2015 at 12:39
  • The reason it works is due to NAT Traversal. I wrote about what it is and how it works in this answer.
    – Eddie
    Dec 23, 2015 at 16:20

1 Answer 1

Reset to default
1

It is because the firewalls have tables which remember what you sent to where so that a hole may be opened for matching return traffic from the same source as your destination. This is true for both TCP and UDP. The table entries will eventually time out. Depending on the firewall, the timeout values may be changed, usually independently, for TCP and UDP.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.