I have two servers, both set up (bar names) identically. Both are on VPS, one uses the host dhcp setting for interfaces and dns, the other uses its own dns server and network interface settings.

I have duplicated iptables.up.rules on both server so I am reasonably confident that is not the issue. From my client Mac I can connect to both VPN servers. One works perfectly, the other does not as it stops all internet traffic with the occasional message (on whatsmyip for example) cannot resolve host.

I think my OpenVPN setup is fine and it is an underlying network issue causing the problem but I am not experienced enough to find or even understand it! So I am posting the problematic details to see if anyone can offer some guidance.

TO be clear, I did not generate these iptables. They were generated by firewalld or the server or both will some intervention by me, i.e., masquerading and I am not a firewall expert! I am happy to simplify them if it can be done but the most important item is to understand why it works on one server but not the other.

Ta.

1:*filter 2:INPUT_ZONES_SOURCE - [0:0] 3:FWDO_public - [0:0] 4:FORWARD ACCEPT [0:0] 5:INPUT_ZONES - [0:0] 6:OUTPUT_direct - [0:0] 7:FORWARD_IN_ZONES - [0:0] 8:FWDI_public - [0:0] 9:FORWARD_OUT_ZONES - [0:0] 10:INPUT_direct - [0:0] 11:FORWARD_IN_ZONES_SOURCE - [0:0] 12:INPUT ACCEPT [0:0] 13:FWDO_public_log - [0:0] 14:IN_public - [0:0] 15:FWDI_public_allow - [0:0] 16:FWDI_public_deny - [0:0] 17:FORWARD_OUT_ZONES_SOURCE - [0:0] 18:OUTPUT ACCEPT [0:0] 19:FWDO_public_deny - [0:0] 20:FWDO_public_allow - [0:0] 21:IN_public_log - [0:0] 22:IN_public_allow - [0:0] 23:FORWARD_direct - [0:0] 24:FWDI_public_log - [0:0] 25:IN_public_deny - [0:0] 26-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 27-A INPUT -i lo -j ACCEPT 28-A INPUT -j INPUT_direct 29-A INPUT -j INPUT_ZONES_SOURCE 30-A INPUT -j INPUT_ZONES 31-A INPUT -m conntrack --ctstate INVALID -j DROP 32-A INPUT -j REJECT --reject-with icmp-host-prohibited 33-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 34-A FORWARD -i lo -j ACCEPT 35-A FORWARD -j FORWARD_direct 36-A FORWARD -j FORWARD_IN_ZONES_SOURCE 37-A FORWARD -j FORWARD_IN_ZONES 38-A FORWARD -j FORWARD_OUT_ZONES_SOURCE 39-A FORWARD -j FORWARD_OUT_ZONES 40-A FORWARD -m conntrack --ctstate INVALID -j DROP 41-A FORWARD -j REJECT --reject-with icmp-host-prohibited 42-A OUTPUT -j OUTPUT_direct 43-A INPUT_direct -p tcp -m multiport -m set -j REJECT --reject-with icmp-port-unreachable --dports 22 --match-set f2b-sshd src 44-A INPUT_direct -p tcp -m multiport -m set -j REJECT --reject-with icmp-port-unreachable --dports 10000 --match-set f2b-webmin-auth src 45-A INPUT_ZONES -i eth0 -g IN_public 46-A INPUT_ZONES -g IN_public 47-A FORWARD_IN_ZONES -i eth0 -g FWDI_public 48-A FORWARD_IN_ZONES -g FWDI_public 49-A FORWARD_OUT_ZONES -o eth0 -g FWDO_public 50-A FORWARD_OUT_ZONES -g FWDO_public 51-A IN_public -j IN_public_log 52-A IN_public -j IN_public_deny 53-A IN_public -j IN_public_allow 54-A IN_public -p icmp -j ACCEPT 55-A IN_public_allow -p tcp -m tcp -m conntrack --dport 22 --ctstate NEW,UNTRACKED -j ACCEPT 56-A IN_public_allow -p tcp -m tcp -m conntrack --dport 25 --ctstate NEW,UNTRACKED -j ACCEPT 57-A IN_public_allow -p tcp -m tcp -m conntrack --dport 465 --ctstate NEW,UNTRACKED -j ACCEPT 58-A IN_public_allow -p tcp -m tcp -m conntrack --dport 21 --ctstate NEW,UNTRACKED -j ACCEPT 59-A IN_public_allow -p tcp -m tcp -m conntrack --dport 110 --ctstate NEW,UNTRACKED -j ACCEPT 60-A IN_public_allow -p tcp -m tcp -m conntrack --dport 995 --ctstate NEW,UNTRACKED -j ACCEPT 61-A IN_public_allow -p tcp -m tcp -m conntrack --dport 143 --ctstate NEW,UNTRACKED -j ACCEPT 62-A IN_public_allow -p tcp -m tcp -m conntrack --dport 993 --ctstate NEW,UNTRACKED -j ACCEPT 63-A IN_public_allow -p tcp -m tcp -m conntrack --dport 80 --ctstate NEW,UNTRACKED -j ACCEPT 64-A IN_public_allow -p tcp -m tcp -m conntrack --dport 443 --ctstate NEW,UNTRACKED -j ACCEPT 65-A IN_public_allow -p udp -m udp -m conntrack --dport 1194 --ctstate NEW,UNTRACKED -j ACCEPT 66-A IN_public_allow -p tcp -m tcp -m conntrack --dport 587 --ctstate NEW,UNTRACKED -j ACCEPT 67-A IN_public_allow -p tcp -m tcp -m conntrack --dport 53 --ctstate NEW,UNTRACKED -j ACCEPT 68-A IN_public_allow -p tcp -m tcp -m conntrack --dport 20 --ctstate NEW,UNTRACKED -j ACCEPT 69-A IN_public_allow -p tcp -m tcp -m conntrack --dport 2222 --ctstate NEW,UNTRACKED -j ACCEPT 70-A IN_public_allow -p tcp -m tcp -m conntrack --dport 10000:10100 --ctstate NEW,UNTRACKED -j ACCEPT 71-A IN_public_allow -p tcp -m tcp -m conntrack --dport 20000 --ctstate NEW,UNTRACKED -j ACCEPT 72-A IN_public_allow -p udp -m udp -m conntrack --dport 53 --ctstate NEW,UNTRACKED -j ACCEPT 73-A FWDI_public -j FWDI_public_log 74-A FWDI_public -j FWDI_public_deny 75-A FWDI_public -j FWDI_public_allow 76-A FWDI_public -p icmp -j ACCEPT 77-A FWDO_public -j FWDO_public_log 78-A FWDO_public -j FWDO_public_deny 79-A FWDO_public -j FWDO_public_allow 80COMMIT 81*mangle 82:PREROUTING_ZONES_SOURCE - [0:0] 83:PRE_public - [0:0] 84:PRE_public_deny - [0:0] 85:INPUT_direct - [0:0] 86:FORWARD_direct - [0:0] 87:POSTROUTING_direct - [0:0] 88:PREROUTING_ZONES - [0:0] 89:OUTPUT_direct - [0:0] 90:OUTPUT ACCEPT [0:0] 91:PREROUTING_direct - [0:0] 92:POSTROUTING ACCEPT [0:0] 93:PRE_public_log - [0:0] 94:PREROUTING ACCEPT [0:0] 95:FORWARD ACCEPT [0:0] 96:PRE_public_allow - [0:0] 97:INPUT ACCEPT [0:0] 98-A PREROUTING -j PREROUTING_direct 99-A PREROUTING -j PREROUTING_ZONES_SOURCE 100-A PREROUTING -j PREROUTING_ZONES 101-A INPUT -j INPUT_direct 102-A FORWARD -j FORWARD_direct 103-A OUTPUT -j OUTPUT_direct 104-A POSTROUTING -j POSTROUTING_direct 105-A PREROUTING_ZONES -i eth0 -g PRE_public 106-A PREROUTING_ZONES -g PRE_public 107-A PRE_public -j PRE_public_log 108-A PRE_public -j PRE_public_deny 109-A PRE_public -j PRE_public_allow 110COMMIT 111*nat 112:POSTROUTING_direct - [0:0] 113:PREROUTING_direct - [0:0] 114:POST_public_allow - [0:0] 115:PRE_public_allow - [0:0] 116:POSTROUTING_ZONES_SOURCE - [0:0] 117:POSTROUTING ACCEPT [0:0] 118:INPUT ACCEPT [0:0] 119:PREROUTING_ZONES_SOURCE - [0:0] 120:POST_public_log - [0:0] 121:POST_public - [0:0] 122:OUTPUT ACCEPT [0:0] 123:PRE_public_log - [0:0] 124:PRE_public - [0:0] 125:PREROUTING ACCEPT [0:0] 126:PREROUTING_ZONES - [0:0] 127:POSTROUTING_ZONES - [0:0] 128:POST_public_deny - [0:0] 129:OUTPUT_direct - [0:0] 130:PRE_public_deny - [0:0] 131-A PREROUTING -j PREROUTING_direct 132-A PREROUTING -j PREROUTING_ZONES_SOURCE 133-A PREROUTING -j PREROUTING_ZONES 134-A POSTROUTING -j POSTROUTING_direct 135-A POSTROUTING -j POSTROUTING_ZONES_SOURCE 136-A POSTROUTING -j POSTROUTING_ZONES 137-A POSTROUTING -s 10.10.0.0 -o eth0 -j MASQUERADE 138-A OUTPUT -j OUTPUT_direct 139-A PREROUTING_ZONES -i eth0 -g PRE_public 140-A PREROUTING_ZONES -g PRE_public 141-A POSTROUTING_ZONES -o eth0 -g POST_public 142-A POSTROUTING_ZONES -g POST_public 143-A PRE_public -j PRE_public_log 144-A PRE_public -j PRE_public_deny 145-A PRE_public -j PRE_public_allow 146-A POST_public -j POST_public_log 147-A POST_public -j POST_public_deny 148-A POST_public -j POST_public_allow 149COMMIT