netfilter's configuration to allow openvpn

Question

I've got a debian server at home, that I use to have a VPN access to my home computers.

I've redirected the openvpn port on the port 2000 : in my file "server.conf", I've added this :

#Server 
mode server 
proto udp 
port 2000

With the connexion tracking, I allow all the related and response connexions.

I've set up a rule, allowing everybody on the port 2000 :

iptables -t filter -A INPUT -p tcp --dport 2000 -j ACCEPT

however, it doesn't allow me to connect to my VPN (if I disable the firewall, I can connect without any problem).

So, what haven't I understood? does openvpn need another port?

Answer 1

You need to modify your iptables rule: It should be for UDP, not for TCP. Additionally, your server gets the UDP traffic to port 2000 as your router rewrites the destination port and IP:

    iptables -t filter -A INPUT -p udp --dport 2000 -j ACCEPT