need help to start openvpn

circacien

Hello.

When I try :
root@ubuntu-serveur:/usr/share/doc/openvpn/examples/sample-config-files# ./openvpn-startup.sh

I get
Bad argument `10.8.0.1/24'
Try `iptables -h' or 'iptables --help' for more information.

I assume the issue come from the firewall.sh file where it is:
# Change this subnet to correspond to your private
# ethernet subnet. Home will use HOME_NET/24 and
# Office will use OFFICE_NET/24.
PRIVATE=10.8.0.1/24

But I don't know how to configure it.
if I run ifconfig I get this:
br0 Link encap:Ethernet HWaddr 00:13:d4:20:6b:e3
inet adr:192.168.1.142 Bcast:192.168.1.255 Masque:255.255.255.0
adr inet6: fe80::213:d4ff:fe20:6be3/64 Scope:Lien
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
Packets reçus:434 erreurs:0 :0 overruns:0 frame:0
TX packets:206 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:0
Octets reçus:39768 (39.7 KB) Octets transmis:28478 (28.4 KB)

eth0 Link encap:Ethernet HWaddr 00:13:d4:20:6b:e3
adr inet6: fe80::213:d4ff:fe20:6be3/64 Scope:Lien
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
Packets reçus:34849550 erreurs:0 :0 overruns:0 frame:0
TX packets:17583175 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:1000
Octets reçus:43533570358 (43.5 GB) Octets transmis:4919218119 (4.9 GB)
Interruption:17

lo Link encap:Boucle locale
inet adr:127.0.0.1 Masque:255.0.0.0
adr inet6: ::1/128 Scope:Hôte
UP LOOPBACK RUNNING MTU:16436 Metric:1
Packets reçus:6866 erreurs:0 :0 overruns:0 frame:0
TX packets:6866 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:0
Octets reçus:463324 (463.3 KB) Octets transmis:463324 (463.3 KB)

tap0 Link encap:Ethernet HWaddr ce:97:ee:0b:24:da
UP BROADCAST PROMISC MULTICAST MTU:1500 Metric:1
Packets reçus:0 erreurs:0 :0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:100
Octets reçus:0 (0.0 B) Octets transmis:0 (0.0 B)

virbr0 Link encap:Ethernet HWaddr 36:c8:f1:74:e5:68
inet adr:192.168.122.1 Bcast:192.168.122.255 Masque:255.255.255.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
Packets reçus:0 erreurs:0 :0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:0
Octets reçus:0 (0.0 B) Octets transmis:0 (0.0 B)

should I see ip adress on eth0 and tap0 interface?

Could someone help me with this please?

maikcat

assuming you try to setup bridge mode then no , both tap & eth should not have ip address...

posting your configs should helped a lot...

Michael.

circacien

Hi!

I copy/paste openvpn-startup.sh, server.conf, firewall.sh et ifconfig. Their path are writen in bold.

/usr/share/doc/openvpn/examples/sample-config-files/openvpn-startup.sh :

#!/bin/sh

# A sample OpenVPN startup script
# for Linux.

# openvpn config file directory
dir=/etc/openvpn

# load the firewall
$dir/firewall.sh

# load TUN/TAP kernel module
modprobe tun

# enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# Invoke openvpn for each VPN tunnel
# in daemon mode. Alternatively,
# you could remove "--daemon" from
# the command line and add "daemon"
# to the config file.
#
# Each tunnel should run on a separate
# UDP port. Use the "port" option
# to control this. Like all of
# OpenVPN's options, you can
# specify "--port 8000" on the command
# line or "port 8000" in the config
# file.

openvpn --cd $dir --daemon --config vpn1.conf
openvpn --cd $dir --daemon --config vpn2.conf
openvpn --cd $dir --daemon --config vpn2.conf

/etc/openvpn/server.conf :

port 1194
proto tcp
dev tap0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key  # This file should be kept secret
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 10.8.0.0 255.255.255.0 10.8.0.50 10.8.0.100
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

/etc/openvpn/firewall.sh :

#!/bin/sh

# A Sample OpenVPN-aware firewall.

# eth0 is connected to the internet.
# eth1 is connected to a private subnet.

# Change this subnet to correspond to your private
# ethernet subnet. Home will use HOME_NET/24 and
# Office will use OFFICE_NET/24.
PRIVATE=10.8.0.0/24

# Loopback address
LOOP=127.0.0.1

# Delete old iptables rules
# and temporarily block all traffic.
iptables -P OUTPUT DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -F

# Set default policies
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP

# Prevent external packets from using loopback addr
iptables -A INPUT -i eth0 -s $LOOP -j DROP
iptables -A FORWARD -i eth0 -s $LOOP -j DROP
iptables -A INPUT -i eth0 -d $LOOP -j DROP
iptables -A FORWARD -i eth0 -d $LOOP -j DROP

# Anything coming from the Internet should have a real Internet address
iptables -A FORWARD -i eth0 -s 192.168.0.0/16 -j DROP
iptables -A FORWARD -i eth0 -s 172.16.0.0/12 -j DROP
iptables -A FORWARD -i eth0 -s 10.0.0.0/8 -j DROP
iptables -A INPUT -i eth0 -s 192.168.0.0/16 -j DROP
iptables -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP
iptables -A INPUT -i eth0 -s 10.0.0.0/8 -j DROP

# Block outgoing NetBios (if you have windows machines running
# on the private subnet). This will not affect any NetBios
# traffic that flows over the VPN tunnel, but it will stop
# local windows machines from broadcasting themselves to
# the internet.
iptables -A FORWARD -p tcp --sport 137:139 -o eth0 -j DROP
iptables -A FORWARD -p udp --sport 137:139 -o eth0 -j DROP
iptables -A OUTPUT -p tcp --sport 137:139 -o eth0 -j DROP
iptables -A OUTPUT -p udp --sport 137:139 -o eth0 -j DROP

# Check source address validity on packets going out to internet
iptables -A FORWARD -s ! $PRIVATE -i eth1 -j DROP

# Allow local loopback
iptables -A INPUT -s $LOOP -j ACCEPT
iptables -A INPUT -d $LOOP -j ACCEPT

# Allow incoming pings (can be disabled)
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Allow services such as www and ssh (can be disabled)
iptables -A INPUT -p tcp --dport http -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j ACCEPT

# Allow incoming OpenVPN packets
# Duplicate the line below for each
# OpenVPN tunnel, changing --dport n
# to match the OpenVPN UDP port.
#
# In OpenVPN, the port number is
# controlled by the --port n option.
# If you put this option in the config
# file, you can remove the leading '--'
#
# If you taking the stateful firewall
# approach (see the OpenVPN HOWTO),
# then comment out the line below.

iptables -A INPUT -p udp --dport 1194 -j ACCEPT

# Allow packets from TUN/TAP devices.
# When OpenVPN is run in a secure mode,
# it will authenticate packets prior
# to their arriving on a tun or tap
# interface. Therefore, it is not
# necessary to add any filters here,
# unless you want to restrict the
# type of packets which can flow over
# the tunnel.

iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A INPUT -i tap+ -j ACCEPT
iptables -A FORWARD -i tap+ -j ACCEPT

# Allow packets from private subnets
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -j ACCEPT

# Keep state of connections from local machine and private subnets
iptables -A OUTPUT -m state --state NEW -o eth0 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state NEW -o eth0 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Masquerade local subnet
iptables -t nat -A POSTROUTING -s $PRIVATE -o eth0 -j MASQUERADE

#Mes propres ajouts
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT

ifconfig:

br0 Link encap:Ethernet HWaddr 00:13:d4:20:6b:e3
inet adr:192.168.1.142 Bcast:192.168.1.255 Masque:255.255.255.0
adr inet6: fe80::213:d4ff:fe20:6be3/64 Scope:Lien
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
Packets reçus:768841 erreurs:0 :0 overruns:0 frame:0
TX packets:366238 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:0
Octets reçus:795923010 (795.9 MB) Octets transmis:120863050 (120.8 MB)

eth0 Link encap:Ethernet HWaddr 00:13:d4:20:6b:e3
adr inet6: fe80::213:d4ff:fe20:6be3/64 Scope:Lien
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
Packets reçus:35659590 erreurs:0 :0 overruns:0 frame:0
TX packets:17949207 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:1000
Octets reçus:44354554502 (44.3 GB) Octets transmis:5040052691 (5.0 GB)
Interruption:17

lo Link encap:Boucle locale
inet adr:127.0.0.1 Masque:255.0.0.0
adr inet6: ::1/128 Scope:Hôte
UP LOOPBACK RUNNING MTU:16436 Metric:1
Packets reçus:7640 erreurs:0 :0 overruns:0 frame:0
TX packets:7640 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:0
Octets reçus:516586 (516.5 KB) Octets transmis:516586 (516.5 KB)

tap0 Link encap:Ethernet HWaddr ce:97:ee:0b:24:da
adr inet6: fe80::cc97:eeff:fe0b:24da/64 Scope:Lien
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
Packets reçus:0 erreurs:0 :0 overruns:0 frame:0
TX packets:57390 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:100
Octets reçus:0 (0.0 B) Octets transmis:8857415 (8.8 MB)

virbr0 Link encap:Ethernet HWaddr 36:c8:f1:74:e5:68
inet adr:192.168.122.1 Bcast:192.168.122.255 Masque:255.255.255.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
Packets reçus:0 erreurs:0 :0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:0
Octets reçus:0 (0.0 B) Octets transmis:0 (0.0 B)

maikcat

hi there,

there is a liiiitle mix up on your config....

using bridging mode means that you give "bridge" your lan interface with your vpn one,
meaning that your vpn clients will recieve an ip address from your lan network....

meaning that this:

server-bridge 10.8.0.0 255.255.255.0 10.8.0.50 10.8.0.100

is totally wrong...
it should be like

server-bridge 192.168.1.142 255.255.255.0 192.168.1.50 192.168.1.100

also for testing please try to use as little rules as possible on your firewall...

Michael.

circacien

Hello

I fixed server-bridge rule to my lan network:

server-bridge 192.168.1.142 255.255.255.0 192.168.1.175 192.168.1.250

In the firewall.sh, I tried :

PRIVATE=192.168.1.142/24

and

PRIVATE=10.8.0.0/24

And both didn't work

In the openvpn-startup. file, I commented the firewall.sh line :

# load the firewall
#$dir/firewall.sh

And it worked! So I think the problem comme from my firewall. But now, does opnenvpn work with no firewall or the firewall is not configuered correctly?

More...

I still seem to not work
In a terminal I did :

#openvpn server.conf

and I got:

Wed Aug 14 19:50:19 2013 OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013
Wed Aug 14 19:50:19 2013 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Wed Aug 14 19:50:19 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Aug 14 19:50:19 2013 Diffie-Hellman initialized with 1024 bit key
Wed Aug 14 19:50:19 2013 TLS-Auth MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Aug 14 19:50:19 2013 Socket Buffers: R=[87380->131072] S=[16384->131072]
Wed Aug 14 19:50:19 2013 TCP/UDP: Socket bind failed on local address [undef]: Address already in use
Wed Aug 14 19:50:19 2013 Exiting

thank for the help

mwandelaar

circacien wrote

Wed Aug 14 19:50:19 2013 TCP/UDP: Socket bind failed on local address [undef]: Address already in use

OpenVPN is complaining about the port being in use and therefor cannot start. Is there allready another (openvpn)proces running and using that port?
If so, kill the proces or choose another port for openvpn.

circacien

Now I think the server is correctly configure. Thank!
But I got difficulties to connect the client. I do use tunnelblick mac osX software to connect openVPN. I get this error:

2013-08-18 22:32:29 *Tunnelblick: OS X 10.8.4; Tunnelblick 3.3.0 (build 3518)
2013-08-18 22:32:29 *Tunnelblick: Attempting connection with vpn_earadritz using shadow copy; Set nameserver = 1; monitoring connection
2013-08-18 22:32:29 *Tunnelblick: openvpnstart start vpn_earadritz.tblk 1337 1 0 1 0 370 -atADGNWradsgnw -
2013-08-18 22:32:30 *Tunnelblick:

Could not start OpenVPN (openvpnstart returned with status #236)

Contents of the openvpnstart log:
*Tunnelblick: openvpnstart log:
OpenVPN returned with status 1, errno = 13:
Permission denied

Command used to start OpenVPN (one argument per displayed line):

/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.2/openvpn
--cd
/Library/Application Support/Tunnelblick/Users/earadritz/vpn_earadritz.tblk/Contents/Resources
--daemon
--management
127.0.0.1
1337
--config
/Library/Application Support/Tunnelblick/Users/earadritz/vpn_earadritz.tblk/Contents/Resources/config.ovpn
--log
/Library/Application Support/Tunnelblick/Logs/-SUsers-Searadritz-SLibrary-SApplication Support-STunnelblick-SConfigurations-Svpn_earadritz.tblk-SContents-SResources-Sconfig.ovpn.1_0_1_0_370.1337.openvpn.log
--management-query-passwords
--management-hold
--script-security
2
--up
/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -a -f -atADGNWradsgnw
--down
/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -a -f -atADGNWradsgnw
--up-restart
--route-pre-down
/Applications/Tunnelblick.app/Contents/Resources/client.route-pre-down.tunnelblick.sh -m -w -d -a -f -atADGNWradsgnw

Contents of the OpenVPN log:

More details may be in the Console Log's "All Messages"

Any Idea?

circacien

Any Idea how to configure tunnelblick?

mwandelaar

I'm not familiair with Tunnelblick, but i noticed one thing:

*Tunnelblick: openvpnstart log:
OpenVPN returned with status 1, errno = 13:
Permission denied

Does have Tunnelblick have sufficient permissions to run? OpenVPN needs root/administrator rights to startup.
And i found a Quick start Guide on Tunnelblick. Maybe it helps.

circacien

Hi!

Good News! I can connect on local. I tried to connect another place but it didn't work. I don't understant how to tell my openvpn client where to connect to the host. Will I need to open port from my router? I realy need help for this part.

mwandelaar

Will I need to open port from my router?

Yes, you do. As your server is inside your network, your router needs to know these incoming packets should be sent somewhere instead of being dropped.
If that works, you can connect inbound from everywhere.

Please consult the manual of your router how to do that.

circacien

I told my router to follow port 1194 to my ubuntu server internal ip address. Then I my external ip address in my remote argument of my client.conf. But it didn't work. I suppose it don't work like that.

mwandelaar

Thats the right way to do actually. But be sure you are using protocol UDP instead of TCP.
There might be another problem though, because you are inside the same network and some routers don't behave very well when the connection to the external adress, comes from inside.

Maybe you can ask your neighbours to use their internet for a test, or go to your local coffee-/sandwich-/gasshop to test from there. And save the logs, if it doesn't work.

circacien

I tried in a coffe shop and it didn't work. I assume it is iptables that stop me. I tried this... no result:

iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT

Thats the right way to do actually. But be sure you are using protocol UDP instead of TCP.

I try to set up bridging interface so it is TCP right?

Here my logs and I replace my external ip by x.x.x.x:
Tunnelblick Log:

2013-08-21 22:22:11 *Tunnelblick: OS X 10.8.4; Tunnelblick 3.3.0 (build 3518)
2013-08-21 22:22:11 *Tunnelblick: Attempting connection with test using shadow copy; Set nameserver = 1; monitoring connection
2013-08-21 22:22:11 *Tunnelblick: openvpnstart start test.tblk 1337 1 0 1 0 370 -atADGNWradsgnw
2013-08-21 22:22:12 *Tunnelblick: openvpnstart log:
Loading tap.kext

OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):

/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.2.1/openvpn
--cd
/Library/Application Support/Tunnelblick/Users/earadritz/test.tblk/Contents/Resources
--daemon
--management
127.0.0.1
1337
--config
/Library/Application Support/Tunnelblick/Users/earadritz/test.tblk/Contents/Resources/config.ovpn
--log
/Library/Application Support/Tunnelblick/Logs/-SUsers-Searadritz-SLibrary-SApplication Support-STunnelblick-SConfigurations-Stest.tblk-SContents-SResources-Sconfig.ovpn.1_0_1_0_370.1337.openvpn.log
--management-query-passwords
--management-hold
--script-security
2
--up
/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -a -f -atADGNWradsgnw
--down
/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -a -f -atADGNWradsgnw
--up-restart

2013-08-21 22:22:11 *Tunnelblick: openvpnstart starting OpenVPN:
* /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.2.1/openvpn --cd /Library/Application Support/Tunnelblick/Users/earadritz/test.tblk/Contents/Resources --daemon --management 127.0.0.1 1337 --config /Library/Application Support/Tunnelblick/Users/earadritz/test.tblk/Contents/Resources/config.ovpn --log /Library/Application Support/Tunnelblick/Logs/-SUsers-Searadritz-SLibrary-SApplication Support-STunnelblick-SConfigurations-Stest.tblk-SContents-SResources-Sconfig.ovpn.1_0_1_0_370.1337.openvpn.log --management-query-passwords --management-hold --script-security 2 --up /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -a -f -atADGNWradsgnw --down /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -a -f -atADGNWradsgnw --up-restart
2013-08-21 22:22:12 *Tunnelblick: Established communication with OpenVPN
2013-08-21 22:22:12 OpenVPN 2.2.1 i386-apple-darwin10.8.0 [SSL] [LZO2] [PKCS11] [eurephia] built on Jul 22 2013
2013-08-21 22:22:12 MANAGEMENT: TCP Socket listening on 127.0.0.1:1337
2013-08-21 22:22:12 Need hold release from management interface, waiting...
2013-08-21 22:22:12 MANAGEMENT: Client connected from 127.0.0.1:1337
2013-08-21 22:22:12 MANAGEMENT: CMD 'pid'
2013-08-21 22:22:12 MANAGEMENT: CMD 'state on'
2013-08-21 22:22:12 MANAGEMENT: CMD 'state'
2013-08-21 22:22:12 MANAGEMENT: CMD 'bytecount 1'
2013-08-21 22:22:12 MANAGEMENT: CMD 'hold release'
2013-08-21 22:22:12 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2013-08-21 22:22:12 LZO compression initialized
2013-08-21 22:22:12 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
2013-08-21 22:22:12 Socket Buffers: R=[131072->65536] S=[131072->65536]
2013-08-21 22:22:12 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
2013-08-21 22:22:12 Local Options hash (VER=V4): '31fdf004'
2013-08-21 22:22:12 Expected Remote Options hash (VER=V4): '3e6d1056'
2013-08-21 22:22:12 Attempting to establish TCP connection with x.x.x.x:1194 [nonblock]
2013-08-21 22:22:12 MANAGEMENT: >STATE:1377138132,TCP_CONNECT,,,
2013-08-21 22:22:13 TCP: connect to x.x.x.x:1194 failed, will try again in 5 seconds: Connection refused

Console log

Console Log:

2013-08-21 19:06:55 Tunnelblick[82383] DEBUG: willGoToSleepHandler: Setting up connections to restore when computer wakes up
2013-08-21 19:06:55 Tunnelblick[82383] DEBUG: willGoToSleepHandler: OK to go to sleep
2013-08-21 21:58:22 Tunnelblick[82383] DEBUG: currentIPInfo(Name): IP address info was fetched in 697 milliseconds
2013-08-21 21:58:22 Tunnelblick[82383] DEBUG: currentIPInfo(Name): [x.x.x.x, 63559, 205.233.73.116]
2013-08-21 21:58:22 Tunnelblick[82383] openvpnstart status from compareShadowCopy: 251
2013-08-21 21:58:28 Tunnelblick[82383] openvpnstart status from compareShadowCopy: 251
2013-08-21 21:58:28 Tunnelblick[82383] DEBUG: addActiveIPCheckThread: threadID '43315200-527698324107157' added to the active list
2013-08-21 21:58:28 Tunnelblick[82383] DEBUG: checkIPAddressAfterConnectedThread: Delaying 5.000000 seconds before checking connection
2013-08-21 21:58:33 Tunnelblick[82383] DEBUG: currentIPInfo(Name): IP address info was fetched in 160 milliseconds
2013-08-21 21:58:33 Tunnelblick[82383] DEBUG: currentIPInfo(Name): [x.x.x.x, 63559, 205.233.73.116]
2013-08-21 21:58:33 Tunnelblick[82383] DEBUG: isOnCancellingListIPCheckThread: threadID '43315200-527698324107157' is not on the the cancelling list
2013-08-21 21:58:33 Tunnelblick[82383] DEBUG: checkIPAddressAfterConnectedThread: fetched IP address x.x.x.x
2013-08-21 21:58:33 Tunnelblick[82383] DEBUG: haveFinishedIPCheckThread: threadID '43315200-527698324107157' removed from active list
2013-08-21 21:58:52 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: Entered
2013-08-21 21:58:52 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: No active threads for connection 43315200
2013-08-21 21:58:52 Tunnelblick[82383] DEBUG: killAllConnectionsIncludingDaemons: has checked for active daemons
2013-08-21 21:58:52 Tunnelblick[82383] DEBUG: includeDaemons = 0; noUnknownOpenVPNsRunning = 1; noActiveDaemons = 1; noDownRootsActive = 1
2013-08-21 21:58:52 Tunnelblick[82383] DEBUG: killAllConnectionsIncludingDaemons: will use killAll
2013-08-21 21:58:52 Tunnelblick[82383] DEBUG: killAllConnectionsIncludingDaemons: requested killAll
2013-08-21 21:58:52 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: Entered
2013-08-21 21:58:52 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: No active threads for connection 43315200
2013-08-21 21:58:52 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: Entered
2013-08-21 21:58:52 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: No active threads for connection 43315200
2013-08-21 21:58:52 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: Entered
2013-08-21 21:58:52 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: No active threads for connection 43315200
2013-08-21 21:58:53 Tunnelblick[82383] openvpnstart status from compareShadowCopy: 251
2013-08-21 21:58:53 Tunnelblick[82383] DEBUG: killAllConnectionsIncludingDaemons: killAll finished
2013-08-21 21:58:53 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: Entered
2013-08-21 21:58:53 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: No active threads for connection 43315200
2013-08-21 22:00:58 Tunnelblick[82383] Beginning installation or repair
2013-08-21 22:00:58 authexec[22104] executing /Applications/Tunnelblick.app/Contents/Resources/installer
2013-08-21 22:00:59 Tunnelblick[82383] Installation or repair succeeded; Log:
Tunnelblick installer started 2013-08-21 22:00:59. 2 arguments: 0x2001 /Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk
removed /Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk
DEBUG 005: firstPath prefix DID match:
/Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk
/Users/earadritz/Library/Application Support/Tunnelblick/Configurations
removed /Library/Application Support/Tunnelblick/Users/earadritz/test.tblk
2013-08-21 22:00:59 Tunnelblick[82383] Uninstalled configuration file /Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk
2013-08-21 22:01:17 Tunnelblick[82383] Beginning installation or repair
2013-08-21 22:01:17 authexec[22121] executing /Applications/Tunnelblick.app/Contents/Resources/installer
2013-08-21 22:01:17 Tunnelblick[82383] Installation or repair succeeded; Log:
Tunnelblick installer started 2013-08-21 22:01:17. 3 arguments: 0x0001 /Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk /private/var/folders/d6/v1hbr7pd2mv7g11ys731f7xm0000gn/T/TunnelblickTemporaryDotTblk-XZNw1V/test.tblk
Copied /private/var/folders/d6/v1hbr7pd2mv7g11ys731f7xm0000gn/T/TunnelblickTemporaryDotTblk-XZNw1V/test.tblk to /Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk.temp
Copied /Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk.temp to /Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk
Changed ownership of /Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk and its contents to 501:80
Changed permissions from 755 to 750 on /Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk
Changed permissions from 755 to 750 on /Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk/Contents
Changed permissions from 755 to 750 on /Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk/Contents/Resources
Changed permissions from 744 to 640 on /Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk/Contents/Resources/ca.crt
Changed permissions from 744 to 640 on /Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk/Contents/Resources/config.ovpn
Changed permissions from 744 to 640 on /Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk/Contents/Resources/earadritz.crt
Changed permissions from 700 to 640 on /Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk/Contents/Resources/earadritz.key
Copied /Users/earadritz/Library/Application Support/Tunnelblick/Configurations/test.tblk to /Library/Application Support/Tunnelblick/Users/earadritz/test.tblk.temp
Copied /Library/Application Support/Tunnelblick/Users/earadritz/test.tblk.temp to /Library/Application Support/Tunnelblick/Users/earadritz/test.tblk
Changed ownership of /Library/Application Support/Tunnelblick/Users/earadritz/test.tblk and its contents to 0:0
Changed permissions from 640 to 600 on /Library/Application Support/Tunnelblick/Users/earadritz/test.tblk/Contents/Resources/ca.crt
Changed permissions from 640 to 600 on /Library/Application Support/Tunnelblick/Users/earadritz/test.tblk/Contents/Resources/config.ovpn
Changed permissions from 640 to 600 on /Library/Application Support/Tunnelblick/Users/earadritz/test.tblk/Contents/Resources/earadritz.crt
Changed permissions from 640 to 600 on /Library/Application Support/Tunnelblick/Users/earadritz/test.tblk/Contents/Resources/earadritz.key
Created secure (shadow) copy of test.tblk
2013-08-21 22:01:26 Tunnelblick[82383] DEBUG: willGoToSleepHandler: Setting up connections to restore when computer wakes up
2013-08-21 22:01:26 Tunnelblick[82383] DEBUG: willGoToSleepHandler: OK to go to sleep
2013-08-21 22:22:11 Tunnelblick[82383] DEBUG: currentIPInfo(Name): IP address info was fetched in 473 milliseconds
2013-08-21 22:22:11 Tunnelblick[82383] DEBUG: currentIPInfo(Name): [69.159.92.23, 60260, 205.233.73.116]
2013-08-21 22:22:11 Tunnelblick[82383] openvpnstart status from compareShadowCopy: 251
2013-08-21 22:22:49 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: Entered
2013-08-21 22:22:49 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: No active threads for connection 69110272
2013-08-21 22:22:49 Tunnelblick[82383] DEBUG: killAllConnectionsIncludingDaemons: has checked for active daemons
2013-08-21 22:22:49 Tunnelblick[82383] DEBUG: includeDaemons = 0; noUnknownOpenVPNsRunning = 1; noActiveDaemons = 1; noDownRootsActive = 1
2013-08-21 22:22:49 Tunnelblick[82383] DEBUG: killAllConnectionsIncludingDaemons: will use killAll
2013-08-21 22:22:49 Tunnelblick[82383] DEBUG: killAllConnectionsIncludingDaemons: requested killAll
2013-08-21 22:22:49 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: Entered
2013-08-21 22:22:49 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: No active threads for connection 69110272
2013-08-21 22:22:49 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: Entered
2013-08-21 22:22:49 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: No active threads for connection 69110272
2013-08-21 22:22:49 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: Entered
2013-08-21 22:22:49 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: No active threads for connection 69110272
2013-08-21 22:22:50 Tunnelblick[82383] openvpnstart status from compareShadowCopy: 251
2013-08-21 22:22:50 Tunnelblick[82383] DEBUG: killAllConnectionsIncludingDaemons: killAll finished
2013-08-21 22:22:50 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: Entered
2013-08-21 22:22:50 Tunnelblick[82383] DEBUG: cancelAllIPCheckThreadsForConnection: No active threads for connection 69110272

Thk

circacien

I found why i cannot connect from the outsite the server lan. When I use the bridge-start.sh, the server loose external connection. Probably the bridge is not well configure or the firewall block what come from eth0 to br0

circacien

can anyone help me with the bridge? When I execute:

#./bridge-start

I loose my external connection so the web.

ifconfig before the above command:

eth0      Link encap:Ethernet  HWaddr 00:13:d4:20:6b:e3 
          inet adr:192.168.1.150  Bcast:192.168.1.255  Masque:255.255.255.0
          adr inet6: fe80::213:d4ff:fe20:6be3/64 Scope:Lien
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Packets reçus:509 erreurs:0 :0 overruns:0 frame:0
          TX packets:343 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 lg file transmission:1000
          Octets reçus:107422 (107.4 KB) Octets transmis:64708 (64.7 KB)
          Interruption:17
 
ham0      Link encap:Ethernet  HWaddr 7a:79:00:00:00:00 
          adr inet6: fe80::7879:ff:fe00:0/64 Scope:Lien
          UP BROADCAST RUNNING MULTICAST  MTU:1404  Metric:1
          Packets reçus:0 erreurs:0 :0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 lg file transmission:500
          Octets reçus:0 (0.0 B) Octets transmis:468 (468.0 B)
 
lo        Link encap:Boucle locale 
          inet adr:127.0.0.1  Masque:255.0.0.0
          adr inet6: ::1/128 Scope:Hôte
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          Packets reçus:18 erreurs:0 :0 overruns:0 frame:0
          TX packets:18 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 lg file transmission:0
          Octets reçus:1128 (1.1 KB) Octets transmis:1128 (1.1 KB)
 
virbr0    Link encap:Ethernet  HWaddr b2:99:c9:17:db:90 
          inet adr:192.168.122.1  Bcast:192.168.122.255  Masque:255.255.255.0
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          Packets reçus:0 erreurs:0 :0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 lg file transmission:0
          Octets reçus:0 (0.0 B) Octets transmis:0 (0.0 B)

ifconfig after the above commande:

br0       Link encap:Ethernet  HWaddr 00:13:d4:20:6b:e3 
          inet adr:192.168.1.150  Bcast:192.168.1.255  Masque:255.255.255.0
          adr inet6: fe80::213:d4ff:fe20:6be3/64 Scope:Lien
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Packets reçus:21 erreurs:0 :0 overruns:0 frame:0
          TX packets:17 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 lg file transmission:0
          Octets reçus:1494 (1.4 KB) Octets transmis:1778 (1.7 KB)
 
eth0      Link encap:Ethernet  HWaddr 00:13:d4:20:6b:e3 
          adr inet6: fe80::213:d4ff:fe20:6be3/64 Scope:Lien
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          Packets reçus:1444 erreurs:0 :0 overruns:0 frame:0
          TX packets:810 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 lg file transmission:1000
          Octets reçus:197566 (197.5 KB) Octets transmis:129058 (129.0 KB)
          Interruption:17
 
ham0      Link encap:Ethernet  HWaddr 7a:79:00:00:00:00 
          adr inet6: fe80::7879:ff:fe00:0/64 Scope:Lien
          UP BROADCAST RUNNING MULTICAST  MTU:1404  Metric:1
          Packets reçus:0 erreurs:0 :0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 lg file transmission:500
          Octets reçus:0 (0.0 B) Octets transmis:468 (468.0 B)
 
lo        Link encap:Boucle locale 
          inet adr:127.0.0.1  Masque:255.0.0.0
          adr inet6: ::1/128 Scope:Hôte
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          Packets reçus:18 erreurs:0 :0 overruns:0 frame:0
          TX packets:18 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 lg file transmission:0
          Octets reçus:1128 (1.1 KB) Octets transmis:1128 (1.1 KB)
 
tap0      Link encap:Ethernet  HWaddr be:82:06:97:fa:33 
          adr inet6: fe80::bc82:6ff:fe97:fa33/64 Scope:Lien
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          Packets reçus:0 erreurs:0 :0 overruns:0 frame:0
          TX packets:14 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 lg file transmission:100
          Octets reçus:0 (0.0 B) Octets transmis:1020 (1.0 KB)
 
virbr0    Link encap:Ethernet  HWaddr b2:99:c9:17:db:90 
          inet adr:192.168.122.1  Bcast:192.168.122.255  Masque:255.255.255.0
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          Packets reçus:0 erreurs:0 :0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 lg file transmission:0
          Octets reçus:0 (0.0 B) Octets transmis:0 (0.0 B)

Errors I get when :

#./bridge-start

Fri Aug 23 14:09:29 2013 Note: Cannot ioctl TUNSETIFF tap0: Device or resource busy (errno=16)
Fri Aug 23 14:09:29 2013 Cannot ioctl TUNSETPERSIST(1) tap0: File descriptor in bad state (errno=77)

here is my bridge-start script:

#!/bin/sh
 
#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################
 
# Define Bridge Interface
br="br0"
 
# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"
 
# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0"
eth_ip="192.168.1.150"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.1.255"
 
for t in $tap; do
    openvpn --mktun --dev $t
done
 
brctl addbr $br
brctl addif $br $eth
 
for t in $tap; do
    brctl addif $br $t
done
 
for t in $tap; do
    ifconfig $t 0.0.0.0 promisc up
done
 
ifconfig $eth 0.0.0.0  promisc up
ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

What is the $t variable
what is the "t" after "for"
need help

brendan

the errors you are getting when the bridge-start script is run are because the tap0 interface is already part of the bridge. i get these errors, and they are inconsequential. do a "brctl show" to see that both eth0 and tap0 are part of br0.

the t and $t are the individual values of the $tap variable. if more than one tap interface was being used, the line tap="tap0" would read tap="tap0 tap1 tapX", and the variable t would be created on the for line, and used as $t to add the individual tap interfaces to the bridge.

for the sake of an excercise, run "bash -x ./bridge-start" (without the quotes). you will see each line of the script executed. read over the output of the script until you understand all of it.

circacien

thank for showing me bash -x. What I don't understant is why I loose external connection with the bridge on? Is it possible that in ubuntu 12.04 the

/etc/network/interface

include the

dns-nameservers

instead of

/etc/resolv.conf

. So the dns-nameservers in not follow to the bridge?

I read the man of brctl and ifconfig and tried to understant but I don't.

circacien

can anyone can explain me I loose external connection when the bridge on?

brendan

just a hunch, but is eth0 on your device connected to your ISP connection, like a cable modem? it might be because of that. what does your routing table show before and after (netstat -nr)? what does iptables show (sudo iptables -nL)? does your iptables policy allow for br0 to be the interface that your traffic goes out?