OpenConnect (443) vs firewalld

[Gottfried Haider]

Hello all,

I was wondering if someone can point me in the right direction with this one:

When I start up the openconnect server (ocserv) on my server
automatically, I can't seem to connect from the client ("Failed to
connect to host", "Failed to open HTTPS connection"). It does work,
though, when I either start or restart ocserv when the server has
already been running, or when I disable firewalld from loading.

This is on a pretty normal Fedora 20 server (ocserv 0.8.4), which uses
the standalone ocserv.service (i.e. not socket-activated). Firewalld
has a permanent rule to open port 445.

The systemd serialization looks good to me: firewalld.service
completes before the network.target that ocserv.service depends on.

Any ideas?

Thanks
Gottfried

PS: Please CC me for replies.

[Jiri Popelka]

On 01/05/2015 08:48 AM, Gottfried Haider wrote:
> Firewalld has a permanent rule to open port 445.

$Subject mentions 443, shouldn't they be the same ?
No ideas other than that.

--
Jiri

[Gottfried Haider]

Sorry, I mistyped, it's (all) 443.

It looks l like its not a firewalld issue though, as it turns out the
service is only listening on IPv6 when it's started on boot.. so
perhaps it's the service itself, or when systemd signals that the
network is up that's the issue.

Thanks

[Nikos Mavrogiannopoulos]

On Mon, 2015-01-05 at 08:48 +0100, Gottfried Haider wrote:
> Hello all,
>
> I was wondering if someone can point me in the right direction with this one:
>
> When I start up the openconnect server (ocserv) on my server
> automatically, I can't seem to connect from the client ("Failed to
> connect to host", "Failed to open HTTPS connection"). It does work,
> though, when I either start or restart ocserv when the server has
> already been running, or when I disable firewalld from loading.
>
> This is on a pretty normal Fedora 20 server (ocserv 0.8.4), which uses
> the standalone ocserv.service (i.e. not socket-activated). Firewalld
> has a permanent rule to open port 445.
>
> The systemd serialization looks good to me: firewalld.service
> completes before the network.target that ocserv.service depends on.

That looks related to
https://bugzilla.redhat.com/show_bug.cgi?id=1178760
Could you try updating ocserv in your system?