Permitting traffic to the OpenVPN server¶
After setting up an OpenVPN server, a firewall rule to permit traffic to the OpenVPN server is required.
Navigate to Firewall > Rules, WAN tab
Click to create a new rule at the top of the list
Set Protocol to UDP
Leave the Source set to any
Set the Destination to WAN Address
Set the Destination port to
1194in this instance
Enter a Description, such as
Allow traffic to OpenVPN Server
Click Apply changes
This rule is depicted in Figure OpenVPN Server WAN Rule.
If the client source addresses are known and do not change, then the source of the rule could be altered to limit traffic from only those clients. This is more secure than leaving the server exposed to the entire Internet, but that is necessary to accommodate clients with dynamic IP addresses, roaming clients, and so on. The risk of leaving the service exposed with most OpenVPN configurations is minimal, especially in cases where TLS Authentication is employed. With certificate based authentication there is less risk of compromise than password- based solutions that are susceptible to brute forcing. This presumes a lack of security holes in OpenVPN itself, which to date has a solid security track record.