[LARTC] HTB and Openvpn

[Andreas Klauer]

Peter Huetmannsberger wrote:
> I have changed my setup accordingly now, however there are still packets 
> showing up on the default qdisc when I go through the tunnel, about half 
> the packets don't seem to match. 

If there really only is udp traffic on port 5001, I don't see why your 
rules should match that only partially. If they were wrong, they'd 
either match everything or nothing at all, wouldn't they?

> Did you see anything wrong with the filter rules. Openvpn uses port 5001 
> on both ends, and tcpdump -i eth0 shows udp packets going back and forth 
> on port 5001 and no other traffic, yet the default counter goes up along 
> with the 1:10 qdisc.

I don't know tcpdump - when debugging filter rules, I usually adapt 
these rules to iptables and use iptables log with different prefixes to 
distinct which packets matched which rules (and which didn't match at 
all). If nothing shows up this way, then I too am clueless as to what 
might be wrong. Maybe someone else has a suggestion. :)

I don't have any experience with OpenVPN myself, so I don't know what's 
the best way to match OpenVPN traffic. Using port criteria alone, might 
not be waterproof enough, as long as anyone can use these ports for 
anything. Matching both IP and Port would probably be more reliable.

Andreas