Hide Forgot
Created attachment 555223 [details] Output of audit log. Description of problem: SELinux blocks OpenVPN from connecting to custom TCP port. Version-Release number of selected component (if applicable): 3.10.0 How reproducible: Try to connect to an OpenVPN server using a non-default (other than 1194) TCP port by using a VPN connection set up with nm-applet. Steps to Reproduce: 1. Install Fedora 16 2. Set up a VPN via nm-applet. The "server" does not need to actually run an OpenVPN server as this error occurs before the actual connection is established. 3. Configure the VPN to use TCP and a non-default port via the advanced options, e.g., TCP port 1195. 4. Try to connect to the VPN. Actual results: SELinux prohibits OpenVPN from connecting. Output in /var/log/messages is as follows: Jan 14 12:13:37 colin nm-openvpn[11491]: TCP: connect to 192.168.20.1:1195 failed, will try again in 5 seconds: Permission denied Expected results: OpenVPN should be allowed to create an outgoing TCP connection to servers that listen on non-default ports. Additional info:
Created attachment 555224 [details] audit2why output
Created attachment 555225 [details] audit2allow output
Created attachment 555226 [details] Files generated with "audit2allow -b -M openvpn_tcp_custom_port" part 1
Created attachment 555227 [details] Files generated with "audit2allow -b -M openvpn_tcp_custom_port" part 2
Created attachment 555232 [details] openvpn_tcp_custom_port.te
Created attachment 555233 [details] openvpn_tcp_custom_port.pp
I missed that in the initial report: the version number 3.10.0 is the version of the selinux-policy package. I hope this is the correct package for this bug.
We allow openvpn to connect to these ports # sesearch --allow -C -s openvpn_t -c tcp_socket -p name_connect |grep -v DT If you set up your own port, you will need to add a local policy. sealert should tell you all options which you have.