Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a fairly simple OpenVPN setup on an OpenVZ VPS with Ubuntu 11.10. Client is the Viscosity client on Mac OS X 10.8.2, and after some testing, we can rule out the client as being part of the problem. Everything has been working fine except for Apple's iCloud stuff. Web surfing, email, FTP, NNTP, and Skype are all working as expected. It's ONLY the iCloud services that cease to function.

If I connect to the VPN, iCloud stuff stops working. I no longer get anything in Messages, Calendar items don't get updated, and Notifications stop working. If I disconnect, the iCloud stuff all starts working. Connect again, iCloud stops working.

Here's the server.conf:

status openvpn-status.log
log /var/log/openvpn.log
verb 4
port 1194
proto udp 
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh1024.pem
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push “dhcp-option DNS″
keepalive 10 120
cipher BF-CBC
user nobody
group nogroup
tun-mtu  1500
mssfix 1400

I'm using iptables in a script, and it's also fairly simplistic.

iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -A FORWARD -i tun0 -o venet0 -j ACCEPT
iptables -A FORWARD -i venet0 -o tun0 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 1194 -j ACCEPT
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -t nat -A POSTROUTING -s -j SNAT --to-source <server's public ip>
echo 1 > /proc/sys/net/ipv4/ip_forward

I tried forwarding ports as well, with no success.

iptables -A FORWARD -p tcp -d --dport 5222:5230 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 5222:5230 -j DNAT --to-destination

I am also sometimes behind a double-NAT situation that I have no control over.

Client -> work VPN -> my OpenVPN box -> Internet.

Client -> Airport Express -> ISP (which is doing NAT) -> my OpenVPN box -> Internet.

Those two situations are just the fact of life where I am, and I cannot change them. I do have full control over my client and the OpenVPN server.

I am completely out of ideas. I have posted a similar query at the OpenVPN forums, but it hasn't posted yet and seems to be in their moderation queue still. Tried on freenode irc channels, but nobody is awake, so here I am. I have Googled extensively for this, and can find nothing that is related.

Help me get iCloud stuff working again! (I tried serverfault, it was closed as off-topic. I'm trying here and the Unix site as well. Here because it's a more general audience that might know more about OpenVPN based on the number of questions I see asked about it)

EDIT: -I have also tried upgrading to Version: 2.3-beta1-debian0 - issue persists. -Removed all iptables rules except for the ones that flush -left this rule:iptables -t nat -A POSTROUTING -s -j SNAT --to-source (server ip) -added iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

still, nothing works.

I can see traffic in tcpdump on the server if i watch the tunnel: 20:03:48.702835 IP > Flags [F.], seq 2635, ack 1218, win 76, options [nop,nop,TS val 914984811 ecr 745921298], length 0 20:03:48.911244 IP > Flags [R], seq 3621143451, win 0, length 0

But still, no push messages/notifications are ever delivered. :/

EDIT: * Further testing indicates that it might actually be the client after all. * FINAL EDIT: gulp Looks like it was the client.

See this thread:

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.