4

If I connect to an openvpn server on port 1194 from Tunnelblick on a Mac (OSX 10.10), how can I ensure that the port used by Transmission (e.g. 66887) will be open for incoming connections?

Current setup:

Connected to a Wifi Hotspot (out of my control, no access to router settings) Connected to OpenVPN server (I have full control over the config)

Transmission 'works' but is slow and the port is showing as closed in the Transmission network preferences. The openvpn VPN connection works normally for all standard http traffic.

Openvpn is running on a remote Ubuntu server. I tried using ufw to open the above port but this had no effect and I suspect that there is a deeper network config required.

openvpn version is OpenVPN 2.3.2 x86_64.

Is it possible to forward port 66887 in this scenario or do I need access to the local LAN router for this to work?

I tried changing the bind address - BindAddressIPv4 - for Transmission via the preferences plist file but either did this incorrectly or it made no difference.

  • Did you found a solution? – Sarge Borsch Dec 29 '15 at 15:49
  • I cant remember exactly but pretty sure the firewall rules in the answer worked for me. Remember to flush the rules and check they are active. 'man iptables' for more info. – codecowboy Dec 29 '15 at 15:53
3

Surprised nobody noticed, but 66887 isn't a valid port number.

https://stackoverflow.com/questions/113224/what-is-the-largest-tcp-ip-network-port-number-allowable-for-ipv4#113228

The port number is an unsigned 16-bit integer, so 65535.

The valid range for ports is 0-65535.
Because you're specifying the invalid port 66887, most operating systems will truncate that to 1351:

[root@f ~]# tcpdump -qnn host 8.8.8.8 & telnet 8.8.8.8 66887
[1] 4054
Trying 8.8.8.8...
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
15:30:56.175482 IP 10.0.0.42.60280 > 8.8.8.8.1351: tcp 0

Or in C:

[root@f ~]# cat > 16.c << EOF
> #include <stdio.h>
> #include <stdint.h>
> int main(void) {
>  uint16_t port=66887;
>  printf("%d\n",port);
>  return 0;
> }
> EOF
[root@f ~]# gcc -o 16 16.c
16.c: In function ‘main’:
16.c:4: warning: large integer implicitly truncated to unsigned type
[root@f ~]# ./16
1351
3

You need to forward the port on your openvpn server.

I don't know ufw commands, but using iptables, the commands would be (with 10.8.0.6 the IP of your machine when connected to the VPN and 66887 the port to forward) :

iptables -t nat -A PREROUTING -p tcp --dport 66887 -j DNAT --to 10.8.0.6:66887
iptables -t nat -A PREROUTING -p udp --dport 66887 -j DNAT --to 10.8.0.6:66887
  • unfortunately this does not work – Sarge Borsch Dec 29 '15 at 15:48
  • What exactly doesn't work? Do the commands not run? Do they run but not forward the port? – user2313067 Dec 31 '15 at 1:15
  • I tried running them, and I also opened the port in ufw. I saw no signs of errors, but all testing indicates that the port is not forwarded. – Sarge Borsch Dec 31 '15 at 7:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.