Cannot retrieve http sites when using OpenVPN, but https sites work just fine. Why?

Question

I am using a VPN provider that uses OpenVPN. I don´t wont any other traffic leave my computer so I have set up my iptables like this:

iptables -P INPUT DROP 
iptables -P FORWARD DROP 
iptables -P OUTPUT DROP 

### Inbound rules
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT

### Outbound rules
iptables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 1194 -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

I am just permitting OpenVPN traffic and DNS lookup (for the OpenVPN connection). The connection goes just fine.

The probem occurs when I try to visit http sites. The connection times out. But https works! If I do iptables -P OUTPUT ACCEPT everything works just perfect!

I have checked with Wireshark when using both iptables -P OUTPUT DROP and iptables -P OUTPUT ACCEPT but I cannot see anything that differs, except that when using DROP, http sites cannot be fetched.

What can be the issue?

Answer 1

You might want to double-test other elements of your rules - it looks to me that they don't accept either HTTP or HTTPS traffic - I wonder if while fiddling with the rules you added (and possibly subsequently removed) HTTPS traffic - leaving the "ESTABLISHED" connection in-tact and giving you a false reading. You can test this theory by using iptables -vnL and watching how the counters for the rules change when you do various requests.

I expect you need to add

> iptables -A OUTPUT -o tun+ -p tcp --dport 80 -j ACCEPT 
> iptables -A OUTPUT -o tun+ -p tcp --dport 80 -j ACCEPT

Or, if you want a more generic solution that allows all your traffic down the tunnel to work

> iptables -A output -o tun+ -j ACCEPT