Can't reach internal nodes

marcosvega

Hi i have configured my VPN on Freenas. When I connect with my iphone I can reach only the ip 10.8.0.1 and the ip 192.168.1.20, but I would reach also the DLNA server that has 192.168.1.84 as ip. Why I can't reach it?

Server conf

# Sample OpenVPN 2.0 config file for
# multi-client server.

#replace x.x.x.x with freenas ip
#local 192.168.1.20
port 1194
proto udp
dev tun
ca /mnt/disco2/openvpn/keys/ca.crt
cert /mnt/disco2/openvpn/keys/server.crt
key /mnt/disco2/openvpn/keys/server.key
dh /mnt/disco2/openvpn/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
#change x.x.x.x to match your network ip range
#ie 192.168.0.0 or 10.0.0.0
push "route 192.168.1.0 255.255.255.0"
#replace x.x.x.x with freenas ip
#route 192.168.1.20 255.255.255.0
#route 192.168.1.62 255.255.255.0
keepalive 10 120
comp-lzo
persist-key
persist-tun

marcosvega

debbie10t wroteIn order to reach IPs other than the server you will need to implement the following:
http://openvpn.net/index.php/open-source/documentation/howto.html#scope

As for your FreeNAS, if it is the server, I do not know how you will be able to enable IPForwarding at this stage, it will depend on the host operating system.

I have done it but it doesn't work anymore. There is a way to map a local address( 192.168.1.62 for example) with an ip in the range of 10.8.0.0/24 ?

marcosvega

debbie10t wrotePlease post your current server & client config & logs.

log:

*Tunnelblick: OS X 10.9.0; Tunnelblick 3.4beta14 (build 3649); prior version 3.3.0 (build 3518); Admin user

"Sanitized" configuration file for /Users/marcomoretti/Library/Application Support/Tunnelblick/Configurations/casa.tblk:



================================================================================

Tunnelblick Log:

2013-11-11 14:06:39 *Tunnelblick: openvpnstart starting OpenVPN:
                    *                    /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.2.1/openvpn --cd /Library/Application Support/Tunnelblick/Users/marcomoretti/casa.tblk/Contents/Resources --daemon --management 127.0.0.1 1337 --config /Library/Application Support/Tunnelblick/Users/marcomoretti/casa.tblk/Contents/Resources/config.ovpn --log /Library/Application Support/Tunnelblick/Logs/-SUsers-Smarcomoretti-SLibrary-SApplication Support-STunnelblick-SConfigurations-Scasa.tblk-SContents-SResources-Sconfig.ovpn.1_0_1_0_305.1337.openvpn.log --management-query-passwords --management-hold --script-security 2 --up /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw --down /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw --up-restart
2013-11-11 14:06:40 OpenVPN 2.2.1 i386-apple-darwin10.8.0 [SSL] [LZO2] [PKCS11] [eurephia] built on Oct 25 2013
2013-11-11 14:06:40 MANAGEMENT: TCP Socket listening on 127.0.0.1:1337
2013-11-11 14:06:40 Need hold release from management interface, waiting...
2013-11-11 14:06:41 MANAGEMENT: Client connected from 127.0.0.1:1337
2013-11-11 14:06:41 MANAGEMENT: CMD 'pid'
2013-11-11 14:06:41 MANAGEMENT: CMD 'state on'
2013-11-11 14:06:41 MANAGEMENT: CMD 'state'
2013-11-11 14:06:41 MANAGEMENT: CMD 'bytecount 1'
2013-11-11 14:06:41 MANAGEMENT: CMD 'hold release'
2013-11-11 14:06:41 *Tunnelblick: Established communication with OpenVPN
2013-11-11 14:06:41 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2013-11-11 14:06:41 LZO compression initialized
2013-11-11 14:06:41 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
2013-11-11 14:06:41 Socket Buffers: R=[196724->65536] S=[9216->65536]
2013-11-11 14:06:41 MANAGEMENT: >STATE:1384175201,RESOLVE,,,
2013-11-11 14:06:41 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
2013-11-11 14:06:41 Local Options hash (VER=V4): '41690919'
2013-11-11 14:06:41 Expected Remote Options hash (VER=V4): '530fdded'
2013-11-11 14:06:41 UDPv4 link local: [undef]
2013-11-11 14:06:41 UDPv4 link remote: 151.75.237.126:1194
2013-11-11 14:06:41 MANAGEMENT: >STATE:1384175201,WAIT,,,
2013-11-11 14:06:41 MANAGEMENT: >STATE:1384175201,AUTH,,,
2013-11-11 14:06:41 TLS: Initial packet from 151.75.237.126:1194, sid=231a9dbc a859f1c8
2013-11-11 14:06:41 VERIFY OK: depth=1, /C=EU/ST=Italia/L=Caserta/O=company/OU=section/CN=marco/name=marco/emailAddress=marcosvega@libero.it
2013-11-11 14:06:41 VERIFY OK: nsCertType=SERVER
2013-11-11 14:06:41 VERIFY OK: depth=0, /C=EU/ST=Italia/L=caserta/O=company/OU=section/CN=marco/name=marco/emailAddress=marcosvega@libero.it
2013-11-11 14:06:42 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2013-11-11 14:06:42 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2013-11-11 14:06:42 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2013-11-11 14:06:42 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2013-11-11 14:06:42 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
2013-11-11 14:06:42 [marco] Peer Connection Initiated with 151.75.237.126:1194
2013-11-11 14:06:43 MANAGEMENT: >STATE:1384175203,GET_CONFIG,,,
2013-11-11 14:06:44 SENT CONTROL [marco]: 'PUSH_REQUEST' (status=1)
2013-11-11 14:06:44 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
2013-11-11 14:06:44 OPTIONS IMPORT: timers and/or timeouts modified
2013-11-11 14:06:44 OPTIONS IMPORT: --ifconfig/up options modified
2013-11-11 14:06:44 OPTIONS IMPORT: route options modified
2013-11-11 14:06:44 ROUTE default_gateway=192.168.192.1
2013-11-11 14:06:44 TUN/TAP device /dev/tun0 opened
2013-11-11 14:06:44 MANAGEMENT: >STATE:1384175204,ASSIGN_IP,,10.8.0.6,
2013-11-11 14:06:44 /sbin/ifconfig tun0 delete
                                        ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2013-11-11 14:06:44 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2013-11-11 14:06:44 /sbin/ifconfig tun0 10.8.0.6 10.8.0.5 mtu 1500 netmask 255.255.255.255 up
2013-11-11 14:06:44 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw tun0 1500 1542 10.8.0.6 10.8.0.5 init
2013-11-11 14:06:48 *Tunnelblick client.up.tunnelblick.sh: No network configuration changes need to be made.
2013-11-11 14:06:48 *Tunnelblick client.up.tunnelblick.sh: Will NOT monitor for other network configuration changes.
2013-11-11 14:06:48 MANAGEMENT: >STATE:1384175208,ADD_ROUTES,,,
2013-11-11 14:06:48 /sbin/route add -net 192.168.1.0 10.8.0.5 255.255.255.0
2013-11-11 14:06:48 *Tunnelblick: No 'connected.sh' script to execute
                                        add net 192.168.1.0: gateway 10.8.0.5
2013-11-11 14:06:48 /sbin/route add -net 10.8.0.1 10.8.0.5 255.255.255.255
                                        add net 10.8.0.1: gateway 10.8.0.5
2013-11-11 14:06:48 Initialization Sequence Completed
2013-11-11 14:06:48 MANAGEMENT: >STATE:1384175208,CONNECTED,SUCCESS,10.8.0.6,151.75.237.126
2013-11-11 14:06:54 *Tunnelblick: This computer's apparent public IP address (151.75.248.251) was unchanged after the connection was made

================================================================================

Console Log:

2013-11-11 08:54:42 Tunnelblick[261] OK to go to sleep
2013-11-11 12:44:09 WindowServer[86] CGError post_notification(const CGSNotificationType, void *const, const size_t, const bool, const CGSRealTimeDelta, const int, const CGSConnectionID *const, const pid_t): Timed out 1.000 second wait for reply from "Tunnelblick" for synchronous notification type 102 (kCGSDisplayWillSleep) (CID 0x1146b, PID 261)
2013-11-11 12:45:40 Tunnelblick[261] OK to go to sleep
2013-11-11 13:33:09 Tunnelblick[261] OK to go to sleep

client:

client
dev tun
proto udp
#change remote to your static ip
#or domain name for your freenas server
remote nascasamoretti.zapto.org 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert cert.crt
key chiave.key
ns-cert-type server
comp-lzo
verb 3

server:

                                                                                                                         
port 1194                                                                       
proto udp                                                                       
dev tun                                                                         
ca /mnt/disco2/openvpn/keys/ca.crt                                              
cert /mnt/disco2/openvpn/keys/server.crt                                        
key /mnt/disco2/openvpn/keys/server.key                                         
dh /mnt/disco2/openvpn/keys/dh1024.pem                                          
server 10.8.0.0 255.255.255.0                                                   
ifconfig-pool-persist ipp.txt                                                   
push "route 192.168.1.0 255.255.255.0"                                          
route 192.168.1.20 255.255.255.0 10.8.0.1                                       
keepalive 10 120                                                                
comp-lzo                                                                        
persist-key                                                                     
persist-tun                                                                     
openvpn.conf: unmodified, readonly: line 1

stvs

It appears that we're having similar problems—see this thread. I'm also using Tunnelblick on Mavericks, and OpenVPN connections to the server broke after the upgrade to 10.9. I figured out how to use NAT on pfctl to allow VPN client access to the internet and machines on the LAN, but the server is still inaccessible.

Do you see the same behavior as I describe? Is this an issue with OpenVPN on Mavericks?

stvs

Thanks. I have not added routing to my LAN gateway/router, and honestly do not know how to do so.

But I was under the impression that my server, sitting on a NAT behind my router, would be able to route traffic from the VPN's tun0.

I'm eager to try messing around with router settings if it will fix this issue. What do I do?

jimwild100

Same problem here...

Here is the copy from tunnelblick log. Tunnel block used to work from my home to office and mobile to office, now it doesn't at all. Really annoying as it worked so well before.

Anyone got a solution, is there a different config I can try?

*Tunnelblick: OS X 10.9.0; Tunnelblick 3.4beta14 (build 3649); prior version 3.3.0 (build 3518); Admin user

"Sanitized" configuration file for /Users/jim/Library/Application Support/Tunnelblick/Configurations/LEDA Office.tblk:

### Client configuration file for OpenVPN

# Specify that this is a client
client
proto udp
# Bridge device setting
dev tap0

# Host name and port for the server (default port is 1194)
# note: replace with the correct values your server set up
remote 217.155.193.71 1194

# Client does not need to bind to a specific local port
nobind

# Keep trying to resolve the host name of OpenVPN server.
## The windows GUI seems to dislike the following rule.
##You may need to comment it out.
resolv-retry infinite

# Preserve state across restarts
persist-key
persist-tun

# SSL/TLS parameters - files created previously
ca ca.crt
cert jim.crt
key jim.key

# Since we specified the tls-auth for server, we need it for the client
# note: 0 = server, 1 = client
tls-auth ta.key 1

# Specify same cipher as server
cipher AES-256-CBC

# Use compression
comp-lzo

# Log verbosity (to help if there are problems)
verb 2
auth-user-pass

# If OpenVPN connects to the server properly but your IP address does not change, you are probably missing the "--redirect-
# gateway" option. Add the following line:
--redirect-gateway def1

================================================================================

Tunnelblick Log:

2013-11-17 23:26:48 *Tunnelblick: OS X 10.9.0; Tunnelblick 3.4beta14 (build 3649); prior version 3.3.0 (build 3518)
2013-11-17 23:26:48 *Tunnelblick: Attempting connection with LEDA Office using shadow copy; Set nameserver = 1; monitoring connection
2013-11-17 23:26:48 *Tunnelblick: openvpnstart start LEDA\ Office.tblk 1337 1 0 1 0 370 -ptADGNWradsgnw 2.2.1
2013-11-17 23:26:48 *Tunnelblick: openvpnstart log:
Loading tap-signed.kext

OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):

/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.2.1/openvpn
--cd
/Library/Application Support/Tunnelblick/Users/jim/LEDA Office.tblk/Contents/Resources
--daemon
--management
127.0.0.1
1337
--config
/Library/Application Support/Tunnelblick/Users/jim/LEDA Office.tblk/Contents/Resources/config.ovpn
--log
/Library/Application Support/Tunnelblick/Logs/-SUsers-Sjim-SLibrary-SApplication Support-STunnelblick-SConfigurations-SLEDA Office.tblk-SContents-SResources-Sconfig.ovpn.1_0_1_0_370.1337.openvpn.log
--management-query-passwords
--management-hold
--script-security
2
--up
/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -a -f -ptADGNWradsgnw
--down
/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -a -f -ptADGNWradsgnw
--up-restart

2013-11-17 23:26:48 *Tunnelblick: Established communication with OpenVPN
2013-11-17 23:26:48 *Tunnelblick: Obtained VPN username and password from the Keychain
2013-11-17 23:26:48 OpenVPN 2.2.1 i386-apple-darwin10.8.0 [SSL] [LZO2] [PKCS11] [eurephia] built on Oct 25 2013
2013-11-17 23:26:48 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
2013-11-17 23:26:48 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2013-11-17 23:26:48 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
2013-11-17 23:26:48 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2013-11-17 23:26:48 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2013-11-17 23:26:48 LZO compression initialized
2013-11-17 23:26:48 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]
2013-11-17 23:26:48 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
2013-11-17 23:26:48 Local Options hash (VER=V4): '48527533'
2013-11-17 23:26:48 Expected Remote Options hash (VER=V4): '44bd8b5e'
2013-11-17 23:26:48 UDPv4 link local: [undef]
2013-11-17 23:26:48 UDPv4 link remote: 217.155.193.71:1194
2013-11-17 23:26:48 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2013-11-17 23:26:48 *Tunnelblick: openvpnstart starting OpenVPN:
* /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.2.1/openvpn --cd /Library/Application Support/Tunnelblick/Users/jim/LEDA Office.tblk/Contents/Resources --daemon --management 127.0.0.1 1337 --config /Library/Application Support/Tunnelblick/Users/jim/LEDA Office.tblk/Contents/Resources/config.ovpn --log /Library/Application Support/Tunnelblick/Logs/-SUsers-Sjim-SLibrary-SApplication Support-STunnelblick-SConfigurations-SLEDA Office.tblk-SContents-SResources-Sconfig.ovpn.1_0_1_0_370.1337.openvpn.log --management-query-passwords --management-hold --script-security 2 --up /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -a -f -ptADGNWradsgnw --down /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -a -f -ptADGNWradsgnw --up-restart
2013-11-17 23:26:49 VERIFY OK: depth=1, /C=UK/ST=WY/L=Leeds/O=LEDA/CN=LEDA_CA/emailAddress=leda@leda.coop
2013-11-17 23:26:49 VERIFY OK: depth=0, /C=UK/ST=WY/L=Leeds/O=LEDA/CN=ledaserver/emailAddress=leda@leda.coop
2013-11-17 23:27:07 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
2013-11-17 23:27:07 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2013-11-17 23:27:07 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
2013-11-17 23:27:07 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2013-11-17 23:27:07 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
2013-11-17 23:27:07 [ledaserver] Peer Connection Initiated with 217.155.193.71:1194
2013-11-17 23:27:09 TUN/TAP device /dev/tap0 opened
2013-11-17 23:27:09 /sbin/ifconfig tap0 delete
ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2013-11-17 23:27:09 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2013-11-17 23:27:09 /sbin/ifconfig tap0 172.16.100.151 netmask 255.255.255.0 mtu 1500 up
2013-11-17 23:27:09 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -a -f -ptADGNWradsgnw tap0 1500 1590 172.16.100.151 255.255.255.0 init
add net 217.155.193.71: gateway 192.168.43.1
add net 0.0.0.0: gateway 172.16.100.1
add net 128.0.0.0: gateway 172.16.100.1
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: Configuring tap DNS via OpenVPN
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: Retrieved from OpenVPN: name server(s) [ 172.16.100.1 ], domain name [ office.leda.coop ], search domain(s) [ ], and SMB server(s) [ ]
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: MAN_DNS_CONFIG = No such key
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: MAN_SMB_CONFIG = No such key
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: CUR_DNS_CONFIG = <dictionary> { ServerAddresses : <array> { 192.168.43.1 } }
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: CUR_SMB_CONFIG = No such key
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: DYN_DNS_DN = office.leda.coop; DYN_DNS_SA = 172.16.100.1; DYN_DNS_SD =
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: DYN_SMB_NN = ; DYN_SMB_WG = ; DYN_SMB_WA =
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: MAN_DNS_DN = ; MAN_DNS_SA = ; MAN_DNS_SD =
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: MAN_SMB_NN = ; MAN_SMB_WG = ; MAN_SMB_WA =
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: CUR_DNS_DN = ; CUR_DNS_SA = 192.168.43.1; CUR_DNS_SD =
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: CUR_SMB_NN = ; CUR_SMB_WG = ; CUR_SMB_WA =
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: ServerAddresses were not aggregated because running on OS X 10.6 or higher
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: Setting search domains to 'office.leda.coop' because running under OS X 10.6 or higher and the search domains were not set manually and 'Prepend domain name to search domains' was not selected
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: FIN_DNS_DN = office.leda.coop; FIN_DNS_SA = 172.16.100.1; FIN_DNS_SD = office.leda.coop
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: FIN_SMB_NN = ; FIN_SMB_WG = ; FIN_SMB_WA =
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: OS X 10.8 or higher, so will modify DNS settings using Setup: in addition to State:
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: SKP_DNS = ; SKP_DNS_SA = ; SKP_DNS_SD = ; SKP_DNS_DN =
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: SKP_SETUP_DNS =
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: SKP_SMB = #; SKP_SMB_NN = #; SKP_SMB_WG = #; SKP_SMB_WA = #
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: /etc/resolve = nameserver 192.168.43.1
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: scutil --dns BEFORE CHANGES = DNS configuration resolver #1 nameserver[0] : 192.168.43.1 if_index : 5 (en1) flags : Request A records reach : Reachable,Directly Reachable Address resolver #2 domain : local options : mdns timeout : 5 flags : Request A records order : 300000 resolver #3 domain : 254.169.in-addr.arpa options : mdns timeout : 5 flags : Request A records order : 300200 resolver #4 domain : 8.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 300400 resolver #5 domain : 9.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 300600 resolver #6 domain : a.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 300800 resolver #7 domain : b.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 301000 DNS configuration (for scoped queries) resolver #1 nameserver[0] : 192.168.43.1 if_index : 5 (en1) flags : Scoped, Request A records reach : Reachable,Directly Reachable Address
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: Configuration changes:
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ADD State: ServerAddresses 172.16.100.1
2013-11-17 23:27:11 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ADD State: SearchDomains office.leda.coop
2013-11-17 23:27:12 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ADD State: DomainName office.leda.coop
2013-11-17 23:27:12 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:12 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ADD Setup: ServerAddresses 172.16.100.1
2013-11-17 23:27:12 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ADD Setup: SearchDomains office.leda.coop
2013-11-17 23:27:12 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ADD Setup: DomainName office.leda.coop
2013-11-17 23:27:12 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:12 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ##ADD State: NetBIOSName
2013-11-17 23:27:12 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ##ADD State: Workgroup
2013-11-17 23:27:12 *Tunnelblick client.up.tunnelblick.sh: DEBUG: ##ADD State: WINSAddresses
2013-11-17 23:27:12 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:12 *Tunnelblick client.up.tunnelblick.sh: DEBUG: Pause for configuration changes to be propagated to State:/Network/Global/DNS and .../SMB
2013-11-17 23:27:13 Initialization Sequence Completed
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG: Configurations as read back after changes:
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG: State:/.../DNS = <dictionary> { DomainName : office.leda.coop SearchDomains : <array> { office.leda.coop } ServerAddresses : <array> { 172.16.100.1 } }
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG: State:/.../SMB = No such key
2013-11-17 23:27:13 *Tunnelblick: No 'connected.sh' script to execute
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG: Setup:/.../DNS = <dictionary> { DomainName : office.leda.coop SearchDomains : <array> { office.leda.coop } ServerAddresses : <array> { 172.16.100.1 } }
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG: Setup:/.../SMB = No such key
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG: State:/Network/Global/DNS = <dictionary> { DomainName : office.leda.coop SearchDomains : <array> { office.leda.coop } ServerAddresses : <array> { 172.16.100.1 } }
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG: State:/Network/Global/SMB = No such key
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG: Expected by process-network-changes:
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG: State:/Network/OpenVPN/DNS = <dictionary> { DomainName : office.leda.coop SearchDomains : <array> { office.leda.coop } ServerAddresses : <array> { 172.16.100.1 } }
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG: State:/Network/OpenVPN/SMB = <dictionary> { TunnelblickNoSuchKey : true }
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG: /etc/resolve = search office.leda.coop nameserver 172.16.100.1
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG: scutil --dns AFTER CHANGES = DNS configuration resolver #1 search domain[0] : office.leda.coop nameserver[0] : 172.16.100.1 flags : Request A records reach : Reachable,Directly Reachable Address resolver #2 domain : local options : mdns timeout : 5 flags : Request A records order : 300000 resolver #3 domain : 254.169.in-addr.arpa options : mdns timeout : 5 flags : Request A records order : 300200 resolver #4 domain : 8.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 300400 resolver #5 domain : 9.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 300600 resolver #6 domain : a.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 300800 resolver #7 domain : b.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 301000 DNS configuration (for scoped queries) resolver #1 search domain[0] : office.leda.coop nameserver[0] : 172.16.100.1 if_index : 5 (en1) flags : Scoped, Request A records reach : Reachable
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: DEBUG:
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: Saved the DNS and SMB configurations for later use
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: Flushed the DNS Cache
2013-11-17 23:27:13 *Tunnelblick client.up.tunnelblick.sh: Set up to monitor system configuration with process-network-changes
2013-11-17 23:27:18 *Tunnelblick process-network-changes: A system configuration change was ignored
2013-11-17 23:27:21 *Tunnelblick: This computer's apparent public IP address changed from 92.40.248.213 before connection to 217.155.193.71 after connection
2013-11-17 23:31:00 *Tunnelblick: Disconnecting; 'Disconnect' menu command invoked
2013-11-17 23:31:00 *Tunnelblick: Disconnecting using 'killall'
2013-11-17 23:31:00 event_wait : Interrupted system call (code=4)
2013-11-17 23:31:00 TCP/UDP: Closing socket
delete net 217.155.193.71: gateway 192.168.43.1
delete net 0.0.0.0: gateway 172.16.100.1
delete net 128.0.0.0: gateway 172.16.100.1
2013-11-17 23:31:00 Closing TUN/TAP interface
2013-11-17 23:31:00 /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -a -f -ptADGNWradsgnw tap0 1500 1590 172.16.100.151 255.255.255.0 init
No such key
2013-11-17 23:31:00 *Tunnelblick client.down.tunnelblick.sh: Cancelled monitoring of system configuration changes
2013-11-17 23:31:00 *Tunnelblick client.down.tunnelblick.sh: DEBUG: Removing 'Setup:' DNS key
2013-11-17 23:31:00 *Tunnelblick client.down.tunnelblick.sh: Restored the DNS and SMB configurations
2013-11-17 23:31:00 *Tunnelblick client.down.tunnelblick.sh: DEBUG:
2013-11-17 23:31:00 *Tunnelblick client.down.tunnelblick.sh: DEBUG: /etc/resolve = nameserver 192.168.43.1
2013-11-17 23:31:01 *Tunnelblick client.down.tunnelblick.sh: DEBUG:
2013-11-17 23:31:01 *Tunnelblick client.down.tunnelblick.sh: DEBUG: scutil --dns = DNS configuration resolver #1 nameserver[0] : 192.168.43.1 if_index : 5 (en1) flags : Request A records reach : Reachable,Directly Reachable Address resolver #2 domain : local options : mdns timeout : 5 flags : Request A records order : 300000 resolver #3 domain : 254.169.in-addr.arpa options : mdns timeout : 5 flags : Request A records order : 300200 resolver #4 domain : 8.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 300400 resolver #5 domain : 9.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 300600 resolver #6 domain : a.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 300800 resolver #7 domain : b.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records order : 301000 DNS configuration (for scoped queries) resolver #1 nameserver[0] : 192.168.43.1 if_index : 5 (en1) flags : Scoped, Request A records reach : Reachable,Directly Reachable Address
2013-11-17 23:31:01 *Tunnelblick client.down.tunnelblick.sh: DEBUG:
2013-11-17 23:31:01 *Tunnelblick client.down.tunnelblick.sh: Flushed the DNS Cache
2013-11-17 23:31:01 SIGTERM[hard,] received, process exiting
2013-11-17 23:31:01 *Tunnelblick: No 'post-disconnect.sh' script to execute

================================================================================

Console Log:

2013-11-17 23:26:48 Tunnelblick[1176] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-LEDA Office' account = 'username'
2013-11-17 23:26:48 Tunnelblick[1176] Keychain item retrieved successfully for service = 'Tunnelblick-Auth-LEDA Office' account = 'password'

stvs

Making progress. See this comment. Every server TCP access works if you just hit the OpenVPN server's IP, e.g. 10.8.0.1.

The remaining trick is, presumably, to change with the routing tables so you can just hit the the server's IP on the LAN. It's worth doing if there's a robust, easy solution. Otherwise it may be easier just to hit the OpenVPN server.

I'm curious which detail broke this between 10.8 and 10.9.