Currently running Tunnelblick 3.4beta14 (build 3649) on OS X Mavericks. I am using the Tomato firmware on my home router as an OpenVPN server.
When I'm connected with Tunnelblick to home, I am still seeing local computers (hotel WiFi) in my Finder. Even worse, I am able to connect to them. I do have the option redirect gateway set on my server, and have tried enabling and disabling the same in the Tunnelblick client.
I thought that when I'm connected to my router with Tunnelblick, all local traffic (including computer advertisements) would be hidden as it is outside of the encrypted tunnel. Can someone please help?
Below is the diagnostic info...
*Tunnelblick: OS X 10.9.0; Tunnelblick 3.4beta14 (build 3649); Admin user
"Sanitized" configuration file for /Library/Application Support/Tunnelblick/Shared/Home.tblk:
client
dev tun
proto udp
remote home.xxx.xxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
<ca>
[Security-related line(s) omitted]
</ca>
<cert>
[Security-related line(s) omitted]
</cert>
<key>
[Security-related line(s) omitted]
</key>
ns-cert-type server
cipher AES-128-CBC
comp-lzo
verb 3
================================================================================
Tunnelblick Log:
2013-11-07 20:41:59 *Tunnelblick: OS X 10.9.0; Tunnelblick 3.4beta14 (build 3649)
2013-11-07 20:41:59 *Tunnelblick: Attempting connection with Home; Set nameserver = 1; monitoring connection
2013-11-07 20:41:59 *Tunnelblick: openvpnstart start Home.tblk 1337 1 0 3 0 305 -ptADGNWradsgnw 2.2.1
2013-11-07 20:41:59 *Tunnelblick: openvpnstart starting OpenVPN:
* /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.2.1/openvpn --cd /Library/Application Support/Tunnelblick/Shared/Home.tblk/Contents/Resources --daemon --management 127.0.0.1 1337 --config /Library/Application Support/Tunnelblick/Shared/Home.tblk/Contents/Resources/config.ovpn --log /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-SHome.tblk-SContents-SResources-Sconfig.ovpn.1_0_3_0_305.1337.openvpn.log --management-query-passwords --management-hold --script-security 2 --up /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw --down /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw --up-restart
2013-11-07 20:42:04 *Tunnelblick: openvpnstart log:
Loading tun-signed.kext
OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.2.1/openvpn
--cd
/Library/Application Support/Tunnelblick/Shared/Home.tblk/Contents/Resources
--daemon
--management
127.0.0.1
1337
--config
/Library/Application Support/Tunnelblick/Shared/Home.tblk/Contents/Resources/config.ovpn
--log
/Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-SHome.tblk-SContents-SResources-Sconfig.ovpn.1_0_3_0_305.1337.openvpn.log
--management-query-passwords
--management-hold
--script-security
2
--up
/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw
--down
/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw
--up-restart
2013-11-07 20:42:04 *Tunnelblick: Established communication with OpenVPN
2013-11-07 20:42:04 OpenVPN 2.2.1 i386-apple-darwin10.8.0 [SSL] [LZO2] [PKCS11] [eurephia] built on Oct 25 2013
2013-11-07 20:42:04 MANAGEMENT: TCP Socket listening on 127.0.0.1:1337
2013-11-07 20:42:04 Need hold release from management interface, waiting...
2013-11-07 20:42:04 MANAGEMENT: Client connected from 127.0.0.1:1337
2013-11-07 20:42:04 MANAGEMENT: CMD 'pid'
2013-11-07 20:42:04 MANAGEMENT: CMD 'state on'
2013-11-07 20:42:04 MANAGEMENT: CMD 'state'
2013-11-07 20:42:04 MANAGEMENT: CMD 'bytecount 1'
2013-11-07 20:42:04 MANAGEMENT: CMD 'hold release'
2013-11-07 20:42:04 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2013-11-07 20:42:04 LZO compression initialized
2013-11-07 20:42:04 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
2013-11-07 20:42:04 Socket Buffers: R=[196724->65536] S=[9216->65536]
2013-11-07 20:42:04 MANAGEMENT: >STATE:1383874924,RESOLVE,,,
2013-11-07 20:42:05 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
2013-11-07 20:42:05 Local Options hash (VER=V4): '66096c33'
2013-11-07 20:42:05 Expected Remote Options hash (VER=V4): '691e95c7'
2013-11-07 20:42:05 UDPv4 link local: [undef]
2013-11-07 20:42:05 UDPv4 link remote: xxx.xxx.xxx.xxx:1194
2013-11-07 20:42:05 MANAGEMENT: >STATE:1383874925,WAIT,,,
2013-11-07 20:42:05 MANAGEMENT: >STATE:1383874925,AUTH,,,
2013-11-07 20:42:05 TLS: Initial packet from xxx.xxx.xxx.xxx:1194, sid=163fc570 9439e6c2
2013-11-07 20:42:06 VERIFY OK: depth=1, /C=CA/ST=ON/L=Barrie/O=xxx/OU=home.xxx.xxx/CN=rackserver/name=Shamus/emailAddress=shamus@srask.ca
2013-11-07 20:42:06 VERIFY OK: nsCertType=SERVER
2013-11-07 20:42:06 VERIFY OK: depth=0, /C=CA/ST=ON/L=Barrie/O=xxx/OU=home.xxx.xxx/CN=rackserver/name=Shamus/emailAddress=shamus@srask.ca
2013-11-07 20:42:12 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
2013-11-07 20:42:12 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2013-11-07 20:42:12 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
2013-11-07 20:42:12 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2013-11-07 20:42:12 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
2013-11-07 20:42:12 [rackserver] Peer Connection Initiated with xxx.xxx.xxx.xxx:1194
2013-11-07 20:42:14 MANAGEMENT: >STATE:1383874934,GET_CONFIG,,,
2013-11-07 20:42:15 SENT CONTROL [rackserver]: 'PUSH_REQUEST' (status=1)
2013-11-07 20:42:15 PUSH: Received control message: 'PUSH_REPLY,route 192.168.2.0 255.255.255.0,dhcp-option DOMAIN lan,dhcp-option DNS 192.168.2.1,redirect-gateway def1,route 10.8.0.1,topology net30,ping 15,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5'
2013-11-07 20:42:15 OPTIONS IMPORT: timers and/or timeouts modified
2013-11-07 20:42:15 OPTIONS IMPORT: --ifconfig/up options modified
2013-11-07 20:42:15 OPTIONS IMPORT: route options modified
2013-11-07 20:42:15 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2013-11-07 20:42:15 ROUTE default_gateway=10.10.1.1
2013-11-07 20:42:15 TUN/TAP device /dev/tun0 opened
2013-11-07 20:42:15 MANAGEMENT: >STATE:1383874935,ASSIGN_IP,,10.8.0.6,
2013-11-07 20:42:15 /sbin/ifconfig tun0 delete
ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2013-11-07 20:42:15 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2013-11-07 20:42:15 /sbin/ifconfig tun0 10.8.0.6 10.8.0.5 mtu 1500 netmask 255.255.255.255 up
2013-11-07 20:42:15 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw tun0 1500 1558 10.8.0.6 10.8.0.5 init
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: Retrieved from OpenVPN: name server(s) [ 192.168.2.1 ], domain name [ lan ], search domain(s) [ ], and SMB server(s) [ ]
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: MAN_DNS_CONFIG = No such key
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: MAN_SMB_CONFIG = No such key
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: CUR_DNS_CONFIG = <dictionary> { ServerAddresses : <array> { 10.10.1.1 } }
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: CUR_SMB_CONFIG = No such key
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: DYN_DNS_DN = lan; DYN_DNS_SA = 192.168.2.1; DYN_DNS_SD =
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: DYN_SMB_NN = ; DYN_SMB_WG = ; DYN_SMB_WA =
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: MAN_DNS_DN = ; MAN_DNS_SA = ; MAN_DNS_SD =
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: MAN_SMB_NN = ; MAN_SMB_WG = ; MAN_SMB_WA =
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: CUR_DNS_DN = ; CUR_DNS_SA = 10.10.1.1; CUR_DNS_SD =
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: CUR_SMB_NN = ; CUR_SMB_WG = ; CUR_SMB_WA =
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: ServerAddresses were not aggregated because running on OS X 10.6 or higher
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: Setting search domains to 'lan' because running under OS X 10.6 or higher and the search domains were not set manually and 'Prepend domain name to search domains' was not selected
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: FIN_DNS_DN = lan; FIN_DNS_SA = 192.168.2.1; FIN_DNS_SD = lan
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: FIN_SMB_NN = ; FIN_SMB_WG = ; FIN_SMB_WA =
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: OS X 10.8 or higher, so will modify DNS settings using Setup: in addition to State:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: SKP_DNS = ; SKP_DNS_SA = ; SKP_DNS_SD = ; SKP_DNS_DN =
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: SKP_SETUP_DNS =
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: SKP_SMB = #; SKP_SMB_NN = #; SKP_SMB_WG = #; SKP_SMB_WA = #
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: /etc/resolve = nameserver 10.10.1.1
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: scutil --dns BEFORE CHANGES = DNS configuration resolver #1 nameserver[0] : 10.10.1.1 if_index : 4 (en0) flags : Request A records reach : Reachable,Directly Reachable Address resolver #2 domain : 95702319.members.btmm.icloud.com options : pdns timeout : 5 flags : Request A records order : 150000 resolver #3 domain : local options : mdns timeout : 5 flags : Request A records order : 300000 resolver #4 domain : 254.169.in-addr.arpa options : mdns timeout : 5 flags : Request A records order : 300200 resolver #5 domain : 8.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 300400 resolver #6 domain : 9.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 300600 resolver #7 domain : a.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 300800 resolver #8 domain : b.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 301000 DNS configuration (for scoped queries) resolver #1 nameserver[0] : 10.10.1.1 if_index : 4 (en0) flags : Scoped, Request A records reach : Reachable,Directly Reachable Address
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: Configuration changes:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ADD State: ServerAddresses 192.168.2.1
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ADD State: SearchDomains lan
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ADD State: DomainName lan
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ADD Setup: ServerAddresses 192.168.2.1
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ADD Setup: SearchDomains lan
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ADD Setup: DomainName lan
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ##ADD State: NetBIOSName
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ##ADD State: Workgroup
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ##ADD State: WINSAddresses
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:17 *Tunnelblick client.up.tunnelblick.sh: DEBUG: Pause for configuration changes to be propagated to State:/Network/Global/DNS and .../SMB
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG: Configurations as read back after changes:
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG: State:/.../DNS = <dictionary> { DomainName : lan SearchDomains : <array> { lan } ServerAddresses : <array> { 192.168.2.1 } }
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG: State:/.../SMB = No such key
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG: Setup:/.../DNS = <dictionary> { DomainName : lan SearchDomains : <array> { lan } ServerAddresses : <array> { 192.168.2.1 } }
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG: Setup:/.../SMB = No such key
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG: State:/Network/Global/DNS = <dictionary> { DomainName : lan SearchDomains : <array> { lan } ServerAddresses : <array> { 192.168.2.1 } }
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG: State:/Network/Global/SMB = No such key
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG: Expected by process-network-changes:
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG: State:/Network/OpenVPN/DNS = <dictionary> { DomainName : lan SearchDomains : <array> { lan } ServerAddresses : <array> { 192.168.2.1 } }
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG: State:/Network/OpenVPN/SMB = <dictionary> { TunnelblickNoSuchKey : true }
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG: /etc/resolve = search lan nameserver 192.168.2.1
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG: scutil --dns AFTER CHANGES = DNS configuration resolver #1 search domain[0] : lan nameserver[0] : 192.168.2.1 flags : Request A records reach : Reachable resolver #2 domain : 95702319.members.btmm.icloud.com options : pdns timeout : 5 flags : Request A records order : 150000 resolver #3 domain : local options : mdns timeout : 5 flags : Request A records order : 300000 resolver #4 domain : 254.169.in-addr.arpa options : mdns timeout : 5 flags : Request A records order : 300200 resolver #5 domain : 8.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 300400 resolver #6 domain : 9.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 300600 resolver #7 domain : a.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 300800 resolver #8 domain : b.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 301000 DNS configuration (for scoped queries) resolver #1 search domain[0] : lan nameserver[0] : 192.168.2.1 if_index : 4 (en0) flags : Scoped, Request A records reach : Reachable
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-07 20:42:18 *Tunnelblick client.up.tunnelblick.sh: Saved the DNS and SMB configurations for later use
2013-11-07 20:42:19 *Tunnelblick client.up.tunnelblick.sh: Flushed the DNS Cache
2013-11-07 20:42:19 *Tunnelblick client.up.tunnelblick.sh: Set up to monitor system configuration with process-network-changes
2013-11-07 20:42:19 /sbin/route add -net xxx.xxx.xxx.xxx 10.10.1.1 255.255.255.255
add net xxx.xxx.xxx.xxx: gateway 10.10.1.1
2013-11-07 20:42:19 *Tunnelblick: No 'connected.sh' script to execute
2013-11-07 20:42:25 *Tunnelblick process-network-changes: A system configuration change was ignored
2013-11-07 20:42:19 /sbin/route add -net 0.0.0.0 10.8.0.5 128.0.0.0
add net 0.0.0.0: gateway 10.8.0.5
2013-11-07 20:42:19 /sbin/route add -net 128.0.0.0 10.8.0.5 128.0.0.0
add net 128.0.0.0: gateway 10.8.0.5
2013-11-07 20:42:19 MANAGEMENT: >STATE:1383874939,ADD_ROUTES,,,
2013-11-07 20:42:19 /sbin/route add -net 192.168.2.0 10.8.0.5 255.255.255.0
add net 192.168.2.0: gateway 10.8.0.5
2013-11-07 20:42:19 /sbin/route add -net 10.8.0.1 10.8.0.5 255.255.255.255
add net 10.8.0.1: gateway 10.8.0.5
2013-11-07 20:42:19 Initialization Sequence Completed
2013-11-07 20:42:19 MANAGEMENT: >STATE:1383874939,CONNECTED,SUCCESS,10.8.0.6,xxx.xxx.xxx.xxx
2013-11-07 21:28:28 Replay-window backtrack occurred [1]
2013-11-07 21:42:12 TLS: soft reset sec=0 bytes=154945991/0 pkts=266307/0
2013-11-07 21:42:14 VERIFY OK: depth=1, /C=CA/ST=ON/L=Barrie/O=xxxx/OU=home.xxx.xxx/CN=rackserver/name=Shamus/emailAddress=shamus@srask.ca
2013-11-07 21:42:14 VERIFY OK: nsCertType=SERVER
2013-11-07 21:42:14 VERIFY OK: depth=0, /C=CA/ST=ON/L=Barrie/O=xxx/OU=home.xxx.xxx/CN=rackserver/name=Shamus/emailAddress=shamus@srask.ca
2013-11-07 21:42:17 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
2013-11-07 21:42:17 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2013-11-07 21:42:17 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
2013-11-07 21:42:17 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2013-11-07 21:42:17 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
2013-11-07 21:53:39 Replay-window backtrack occurred [3]
================================================================================
