MX68 and OpenVPN Traffic

[eroy]

I have a network that has a 3rd party Recorder that needs to communicate back to their network monitoring appliance. They use OpenVPN to establish this connection.

I have setup a 1:1 NAT that allows port 1194 to the internal Servers IP address. I also have outbound rules that Allow from Any protocol/source to Any Destination/port.

I can see traffic passing from the internal LAN to the WAN out to the remote IP address of the Monitoring Appliance. However the connection is not being made for some reason.

Here is a screen shot of the LAN packet capture.

pcap on LAN

I had been directed to another post that had similar issue here, but adding the static route made no difference.

I have also disabled threat protection, AMP and IDP and have no URL filtering active.

Is there some setting that I am missing that explicitly allows OpenVPN traffic? 

Thank you for any assistance.

[alemabrahao]

I didn't understand, is this communication via VPN or via public IP?

[eroy]

It is going over the public IP. The Meraki MX should just be passing the traffic through.

[alemabrahao]

If it is via public IP what is the role of OpenVPN? It's a little confusing.

[alemabrahao]

By the way, have you tried to allow any port on your 1:1 NAT? Just for a test.

[eroy]

I tried an any port for their remote IP. I will re-test with an any from any remote IPs just to make sure.

[eroy]

The Recording Server that is on the internal network (192.168.1.100) it needs to communicate to their IIC Network Monitoring Appliance which they state is using OpenVPN.

The reason I mention OpenVPN is that the vendor believes that adaptive portion of the firewall is blocking the traffic and is asking about allowing OpenVPN traffic.

Which I assume I have done by allowing the NAT 1:1 for Port 1194 and also by adding an any protocol/port for their IP address.

[alemabrahao · Accepted solution]

Have you tried this?

If you don't have any rule blocking Inbound and outbound, probably It's not an MX issue.

For me, It does not make sense, but you can try to create a Bonjour forwarding rule.

[eroy]

I'll mark this as the accepted solution as it was not a MX issue. Thank you for your help.

[KeenLogic]

What was the issue then?