Wrong settup for interface after connect into VPN under lion

simi

Hello,

I use tunnelblick for use openVPN under my mac. I have troubles with settup for interface. Tunnelblick forum recommended me try OpenVPN version 2.2.1(previosly used default version 2.3-alhpa). But this not help me. So I will try put here my original mail + their answer. Can somebody help me?

-----

Thanks for your report, and for including the complete log and your configuration file. They are critical to solving problems like yours.

The commands you describe as being wrong are not created by Tunnelblick. They are created by OpenVPN.

Please try (as described on Mountain Lion Issues) OpenVPN version 2.2.1. You can set the version of OpenVPN that Tunnelblick uses by clicking the Tunnelblick icon, then clicking "VPN Details…", and then clicking on the "Preferences" panel button at the top of the window.

If that does not fix the problem, you should look for help from OpenVPN experts on the

OpenVPN Users Forum

or

OpenVPN Users Mailing List.

On Fri, Oct 12, 2012 at 4:25 AM, Jan Šimecký <simi@smsbrana.cz> wrote:

Hi,

I have problem after upgrade to montain lion. I use versin 3.3 beta21a and after success connection is badly settuped interface.

Configuration:

        ##############################################
        # Sample client-side OpenVPN 2.0 config file #
        # for connecting to multi-client server.     #
        #                                            #
        # This configuration can be used by multiple #
        # clients, however each client should have   #
        # its own cert and key files.                #
        #                                            #
        # On Windows, you might want to rename this  #
        # file so it has a .ovpn extension           #
        ##############################################

        # Specify that we are a client and that we
        # will be pulling certain config file directives
        # from the server.
        client

        # Use the same setting as you are using on
        # the server.
        # On most systems, the VPN will not function
        # unless you partially or fully disable
        # the firewall for the TUN/TAP interface.
        ;dev tap
        dev tun

        # Windows needs the TAP-Win32 adapter name
        # from the Network Connections panel
        # if you have more than one.  On XP SP2,
        # you may need to disable the firewall
        # for the TAP adapter.
        ;dev-node MyTap

        # Are we connecting to a TCP or
        # UDP server?  Use the same setting as
        # on the server.
        ;proto tcp
        proto udp

        # The hostname/IP and port of the server.
        # You can have multiple remote entries
        # to load balance between the servers.
        remote [CENZORED] 1194
        ;remote my-server-2 1194

        # Choose a random host from the remote
        # list for load-balancing.  Otherwise
        # try hosts in the order specified.
        ;remote-random

        # Keep trying indefinitely to resolve the
        # host name of the OpenVPN server.  Very useful
        # on machines which are not permanently connected
        # to the internet such as laptops.
        resolv-retry infinite

        # Most clients don't need to bind to
        # a specific local port number.
        nobind

        # Downgrade privileges after initialization (non-Windows only)
        ;user nobody
        ;group nobody

        # Try to preserve some state across restarts.
        persist-key
        persist-tun

        # If you are connecting through an
        # HTTP proxy to reach the actual OpenVPN
        # server, put the proxy server/IP and
        # port number here.  See the man page
        # if your proxy server requires
        # authentication.
        ;http-proxy-retry # retry on connection failures
        ;http-proxy [proxy server] [proxy port #]

        # Wireless networks often produce a lot
        # of duplicate packets.  Set this flag
        # to silence duplicate packet warnings.
        ;mute-replay-warnings

        # SSL/TLS parms.
        # See the server config file for more
        # description.  It's best to use
        # a separate .crt/.key file pair
        # for each client.  A single ca
        # file can be used for all clients.
        ca /[CENZORED]ca.crt
        cert /[CENZORED]/client03.crt
        key /[CENZORED]/client03.key

        # Verify server certificate by checking
        # that the certicate has the nsCertType
        # field set to "server".  This is an
        # important precaution to protect against
        # a potential attack discussed here:
        #  http://openvpn.net/howto.html#mitm
        #
        # To use this feature, you will need to generate
        # your server certificates with the nsCertType
        # field set to "server".  The build-key-server
        # script in the easy-rsa folder will do this.
        ;ns-cert-type server

        # If a tls-auth key is used on the server
        # then every client must also have the key.
        ;tls-auth ta.key 1

        # Select a cryptographic cipher.
        # If the cipher option is used on the server
        # then you must also specify it here.
        ;cipher x

        # Enable compression on the VPN link.
        # Don't enable this unless it is also
        # enabled in the server config file.
        comp-lzo

        # Set log file verbosity.
        verb 3

        # Silence repeating messages
        ;mute 20

LOG ( problem with settup /sbin/ifconfig tun0 and /sbin/route add)

        2012-10-12 10:15:43 *Tunnelblick: OS X 10.8.2; Tunnelblick 3.3beta21a (build 3114.1)
        2012-10-12 10:15:43 *Tunnelblick: Attempting connection with Neogenia VPN; Set nameserver = 1; monitoring connection
        2012-10-12 10:15:43 *Tunnelblick: /Applications/Tunnelblick.app/Contents/Resources/openvpnstart start Neogenia\ VPN.tblk 1337 1 0 3 0 49 -atADGNWradsgnw 
        2012-10-12 10:15:43 OpenVPN 2.3-alpha1 i386-apple-darwin10.8.0 [SSL (OpenSSL)] [LZO2] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110522-1 (2.2.0)] built on Sep 12 2012
        2012-10-12 10:15:43 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
        2012-10-12 10:15:43 Need hold release from management interface, waiting...
        2012-10-12 10:15:43 *Tunnelblick: openvpnstart starting OpenVPN:
                            *                    /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3-alpha1/openvpn --cd /Library/Application Support/Tunnelblick/Shared/Neogenia VPN.tblk/Contents/Resources --daemon --management 127.0.0.1 1337 --config /Library/Application Support/Tunnelblick/Shared/Neogenia VPN.tblk/Contents/Resources/config.ovpn --log /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-SNeogenia VPN.tblk-SContents-SResources-Sconfig.ovpn.1_0_3_0_49.1337.openvpn.log --management-query-passwords --management-hold --script-security 2 --up /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -atADGNWradsgnw --down /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -atADGNWradsgnw --up-restart --route-pre-down /Applications/Tunnelblick.app/Contents/Resources/client.route-pre-down.tunnelblick.sh -m -w -d -atADGNWradsgnw
        2012-10-12 10:15:44 *Tunnelblick: openvpnstart message: Loading tun.kext

        2012-10-12 10:15:44 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
        2012-10-12 10:15:44 MANAGEMENT: CMD 'pid'
        2012-10-12 10:15:44 MANAGEMENT: CMD 'state on'
        2012-10-12 10:15:44 MANAGEMENT: CMD 'state'
        2012-10-12 10:15:44 MANAGEMENT: CMD 'bytecount 1'
        2012-10-12 10:15:44 MANAGEMENT: CMD 'hold release'
        2012-10-12 10:15:44 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
        2012-10-12 10:15:44 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
        2012-10-12 10:15:44 WARNING: file '/Users/simi/vpn/client03.key' is group or others accessible
        2012-10-12 10:15:44 Socket Buffers: R=[196724->65536] S=[9216->65536]
        2012-10-12 10:15:44 UDPv4 link local: [undef]
        2012-10-12 10:15:44 UDPv4 link remote: [AF_INET]88.86.119.65:1194
        2012-10-12 10:15:44 MANAGEMENT: >STATE:1350029744,WAIT,,,
        2012-10-12 10:15:44 MANAGEMENT: >STATE:1350029744,AUTH,,,
        2012-10-12 10:15:44 TLS: Initial packet from [AF_INET]88.86.119.65:1194, sid=03e71bd2 741d08a1
        2012-10-12 10:15:44 VERIFY OK: depth=1, C=cz, ST=cz, L=prague, O=neogenia, CN=neogenia CA, emailAddress=me@myhost.mydomain
        2012-10-12 10:15:44 VERIFY OK: depth=0, C=cz, ST=cz, L=prague, O=neogenia, CN=neogenia-1, emailAddress=me@myhost.mydomain
        2012-10-12 10:15:44 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
        2012-10-12 10:15:44 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
        2012-10-12 10:15:44 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
        2012-10-12 10:15:44 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
        2012-10-12 10:15:44 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
        2012-10-12 10:15:44 [neogenia-1] Peer Connection Initiated with [AF_INET]88.86.119.65:1194
        2012-10-12 10:15:45 MANAGEMENT: >STATE:1350029745,GET_CONFIG,,,
        2012-10-12 10:15:46 SENT CONTROL [neogenia-1]: 'PUSH_REQUEST' (status=1)
        2012-10-12 10:15:46 PUSH: Received control message: 'PUSH_REPLY,route 10.0.27.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.0.27.7 10.0.27.0'
        2012-10-12 10:15:46 OPTIONS IMPORT: timers and/or timeouts modified
        2012-10-12 10:15:46 OPTIONS IMPORT: --ifconfig/up options modified
        2012-10-12 10:15:46 OPTIONS IMPORT: route options modified
        2012-10-12 10:15:46 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=en1 HWADDR=c8:bc:c8:f1:64:a1
        2012-10-12 10:15:46 TUN/TAP device /dev/tun0 opened
        2012-10-12 10:15:46 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
        2012-10-12 10:15:46 MANAGEMENT: >STATE:1350029746,ASSIGN_IP,,10.0.27.7,
        2012-10-12 10:15:46 /sbin/ifconfig tun0 delete
                                                ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
        2012-10-12 10:15:46 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
        2012-10-12 10:15:46 /sbin/ifconfig tun0 10.0.27.7 10.0.27.0 mtu 1500 netmask 255.255.255.255 up
        2012-10-12 10:15:46 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -atADGNWradsgnw tun0 1500 1542 10.0.27.7 10.0.27.0 init
        2012-10-12 10:15:48 MANAGEMENT: >STATE:1350029748,ADD_ROUTES,,,
         2012-10-12 10:15:48 /sbin/route add -net 10.0.27.0 10.0.27.0 255.255.255.0
                                                route: writing to routing socket: Can't assign requested address
                                                add net 10.0.27.0: gateway 10.0.27.0: Can't assign requested address
        2012-10-12 10:15:48 Initialization Sequence Completed
        2012-10-12 10:15:48 MANAGEMENT: >STATE:1350029748,CONNECTED,SUCCESS,10.0.27.7,88.86.119.65
        2012-10-12 10:15:48 *Tunnelblick client.up.tunnelblick.sh: No network configuration changes need to be made.
        2012-10-12 10:15:48 *Tunnelblick client.up.tunnelblick.sh: Will NOT monitor for other network configuration changes.
        OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):

             /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3-alpha1/openvpn
             --cd
             /Library/Application Support/Tunnelblick/Shared/Neogenia VPN.tblk/Contents/Resources
             --daemon
             --management
             127.0.0.1
             1337
             --config
             /Library/Application Support/Tunnelblick/Shared/Neogenia VPN.tblk/Contents/Resources/config.ovpn
             --log
             /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-SNeogenia VPN.tblk-SContents-SResources-Sconfig.ovpn.1_0_3_0_49.1337.openvpn.log
             --management-query-passwords
             --management-hold
             --script-security
             2
             --up
             /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -atADGNWradsgnw
             --down
             /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -atADGNWradsgnw
             --up-restart
             --route-pre-down
             /Applications/Tunnelblick.app/Contents/Resources/client.route-pre-down.tunnelblick.sh -m -w -d -atADGNWradsgnw
        2012-10-12 10:15:44 *Tunnelblick: Established communication with OpenVPN
        2012-10-12 10:15:48 *Tunnelblick: Flushed the DNS cache

I must put this command into terminal, after use this command connection work fine (not before) !

        Last login: Fri Oct 12 10:15:46 on ttys007
        Jans-MacBook-Pro:~ simi$ sudo /sbin/ifconfig tun0 10.0.27.7 10.0.27.1 mtu 1500 netmask 255.255.255.255 up
        Password:
        Jans-MacBook-Pro:~ simi$ sudo /sbin/route add -net 10.0.27.0 10.0.27.1 255.255.255.0  add net 10.0.27.0: gateway 10.0.27.1