Some Internet traffic was not being routed (Tunnelblick)

gymax

Hi all,

Really hope somebody can help me out here.
I'm using TAP mode on OPENVPN. But some internet traffic was not being routed through the VPN tunnel by using Tunnelblick.
I ping 8.8.8.8 and 140.115.50.50. 8.8.8.8 is unreachable and tcpdump shows no pings on tap0 and eth0. I have no idea where the ping packets was send.

ping

bash-3.2$ ping 140.115.50.50
PING 140.115.50.50 (140.115.50.50): 56 data bytes
64 bytes from 140.115.50.50: icmp_seq=0 ttl=53 time=26.463 ms
64 bytes from 140.115.50.50: icmp_seq=1 ttl=53 time=28.022 ms
64 bytes from 140.115.50.50: icmp_seq=2 ttl=53 time=24.705 ms
64 bytes from 140.115.50.50: icmp_seq=3 ttl=53 time=24.512 ms
64 bytes from 140.115.50.50: icmp_seq=4 ttl=53 time=31.063 ms
64 bytes from 140.115.50.50: icmp_seq=5 ttl=53 time=24.620 ms
^C
--- 140.115.50.50 ping statistics ---
6 packets transmitted, 6 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 24.512/26.564/31.063/2.374 ms
bash-3.2$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
ping: sendto: No route to host
Request timeout for icmp_seq 4
ping: sendto: Host is down
Request timeout for icmp_seq 5
^C
--- 8.8.8.8 ping statistics ---
7 packets transmitted, 0 packets received, 100.0% packet loss

tcpdump at the same time.

sh-3.2# tcpdump -i tap0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tap0, link-type EN10MB (Ethernet), capture size 65535 bytes
10:23:03.018116 IP 192.168.1.4 > binary.csie.ncu.edu.tw: ICMP echo request, id 38460, seq 0, length 64
10:23:03.044451 IP binary.csie.ncu.edu.tw > 192.168.1.4: ICMP echo reply, id 38460, seq 0, length 64
10:23:04.018271 IP 192.168.1.4 > binary.csie.ncu.edu.tw: ICMP echo request, id 38460, seq 1, length 64
10:23:04.046170 IP binary.csie.ncu.edu.tw > 192.168.1.4: ICMP echo reply, id 38460, seq 1, length 64
10:23:05.018488 IP 192.168.1.4 > binary.csie.ncu.edu.tw: ICMP echo request, id 38460, seq 2, length 64
10:23:05.043059 IP binary.csie.ncu.edu.tw > 192.168.1.4: ICMP echo reply, id 38460, seq 2, length 64
10:23:06.019642 IP 192.168.1.4 > binary.csie.ncu.edu.tw: ICMP echo request, id 38460, seq 3, length 64
10:23:06.044012 IP binary.csie.ncu.edu.tw > 192.168.1.4: ICMP echo reply, id 38460, seq 3, length 64
10:23:07.019858 IP 192.168.1.4 > binary.csie.ncu.edu.tw: ICMP echo request, id 38460, seq 4, length 64
10:23:07.050787 IP binary.csie.ncu.edu.tw > 192.168.1.4: ICMP echo reply, id 38460, seq 4, length 64
10:23:08.020100 IP 192.168.1.4 > binary.csie.ncu.edu.tw: ICMP echo request, id 38460, seq 5, length 64
10:23:08.044571 IP binary.csie.ncu.edu.tw > 192.168.1.4: ICMP echo reply, id 38460, seq 5, length 64

Followings are config files and routing table.

server info: OpenVPN 2.3.1
server config

dh /tmp/openvpn/dh1024.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/server.crt
key /tmp/openvpn/server.key
dev tap
server-bridge
proto udp
port 12974
keepalive 10 120
verb 5
mute 5
log-append /tmp/openvpn_log
writepid /tmp/openvpnd.pid
mtu-disc yes
topology subnet
script-security 2
cipher AES-128-CBC
auth sha1
tls-server
client-to-client
duplicate-cn
comp-lzo
fast-io
push "route 192.168.1.1 255.255.255.0"
push "route-delay 5"
push "redirect-gateway def1"

client info: Tunnelblick 3.5beta04 (build 4198), OpenVPN 2.3.6
client config

client
dev tap
proto udp
remote 192.168.11.237 12974
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.keycipher AES-128-CBC
comp-lzo
verb 5

route

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
0/1                192.168.1.1        UGSc            0        0    tap0
default            192.168.11.1       UGSc            9        0     en0
default            link#9             UCSI            2        0    tap0
8.8.8.8            link#9             UHRLWIi         0       25    tap0
10.37.129/24       link#8             UC              2        0   vnic1
10.37.129.2        0:1c:42:0:0:9      UHLWIi          1        1     lo0
10.37.129.255      ff:ff:ff:ff:ff:ff  UHLWbI          0       31   vnic1
10.211.55/24       link#7             UC              2        0   vnic0
10.211.55.2        0:1c:42:0:0:8      UHLWIi          1        1     lo0
10.211.55.255      ff:ff:ff:ff:ff:ff  UHLWbI          0       31   vnic0
17.83.253.7        link#9             UHLWIi          1        1    tap0
127                127.0.0.1          UCS             0        0     lo0
127.0.0.1          127.0.0.1          UH              5    24271     lo0
128.0/1            192.168.1.1        UGSc            1        2    tap0
169.254            link#4             UCS             0        0     en0
192.168.1          link#9             UCS             3        0    tap0
192.168.1.1        0:d0:59:11:11:10   UHLWIi         32      105    tap0   1158
192.168.1.2        0:25:b3:5a:af:2f   UHLWIi          0        6    tap0   1197
192.168.1.3        127.0.0.1          UHS             1        0     lo0
192.168.1.255      ff:ff:ff:ff:ff:ff  UHLWbI          0       31    tap0
192.168.11         link#4             UCS             2        0     en0
192.168.11.1       0:ff:e6:90:e2:d    UHLWIi          0        7     en0   1169
192.168.11.232     127.0.0.1          UHS             1        0     lo0
192.168.11.237/32  link#4             UCS             1        0     en0
192.168.11.237     0:d0:59:11:11:11   UHLWIi          1      132     en0   1200
192.168.11.255     ff:ff:ff:ff:ff:ff  UHLWbI          0       31     en0

You can find there is 8.8.8.8 in routing table. If ip shows in routing table it is unreachable via ping. Why the rule was added?
Should I post the client log here?

Thanks.

Traffic

Please post client & server log files and ifconfig .. also how do you configure your bridge ?

gymax

Hi,

There is DHCP server runs on server side.

openvpn log server

Wed Jan  1 00:00:12 2003 us=904230 Current Parameter Settings:
Wed Jan  1 00:00:12 2003 us=904352   config = '/tmp/server.conf'
Wed Jan  1 00:00:12 2003 us=904391   mode = 1
Wed Jan  1 00:00:12 2003 us=904425   persist_config = DISABLED
Wed Jan  1 00:00:12 2003 us=904460   persist_mode = 1
Wed Jan  1 00:00:12 2003 us=904491 NOTE: --mute triggered...
Wed Jan  1 00:00:12 2003 us=904558 225 variation(s) on previous 5 message(s) suppressed by --mute
Wed Jan  1 00:00:12 2003 us=904599 OpenVPN 2.3.1 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [IPv6] built on Jan 21 2015
Wed Jan  1 00:00:12 2003 us=904802 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Wed Jan  1 00:00:12 2003 us=905082 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed Jan  1 00:00:12 2003 us=924211 Diffie-Hellman initialized with 1024 bit key
Wed Jan  1 00:00:12 2003 us=927611 WARNING: file '/tmp/openvpn/server.key' is group or others accessible
Wed Jan  1 00:00:12 2003 us=929174 TLS-Auth MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Jan  1 00:00:12 2003 us=929310 Socket Buffers: R=[135168->131072] S=[135168->131072]
Wed Jan  1 00:00:12 2003 us=930486 TUN/TAP device tap0 opened
Wed Jan  1 00:00:12 2003 us=930614 TUN/TAP TX queue length set to 100
Wed Jan  1 00:00:12 2003 us=930828 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Jan  1 00:00:12 2003 us=930965 UDPv4 link local (bound): [undef]
Wed Jan  1 00:00:12 2003 us=931014 UDPv4 link remote: [undef]
Wed Jan  1 00:00:12 2003 us=931081 MULTI: multi_init called, r=256 v=256
Wed Jan  1 00:00:12 2003 us=931317 Initialization Sequence Completed
Thu Feb  5 02:37:49 2015 us=381366 MULTI: multi_create_instance called
Thu Feb  5 02:37:49 2015 us=381537 192.168.11.232:63643 Re-using SSL/TLS context
Thu Feb  5 02:37:49 2015 us=381624 192.168.11.232:63643 LZO compression initialized
Thu Feb  5 02:37:49 2015 us=463026 192.168.11.232:63643 Control Channel MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Feb  5 02:37:49 2015 us=463111 192.168.11.232:63643 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Thu Feb  5 02:37:49 2015 us=463225 192.168.11.232:63643 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Feb  5 02:37:49 2015 us=463258 192.168.11.232:63643 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Feb  5 02:37:49 2015 us=522950 192.168.11.232:63643 Local Options hash (VER=V4): '26e19fc0'
Thu Feb  5 02:37:49 2015 us=523072 192.168.11.232:63643 Expected Remote Options hash (VER=V4): 'b498be7c'
RThu Feb  5 02:37:49 2015 us=551009 192.168.11.232:63643 TLS: Initial packet from [AF_INET]192.168.11.232:63643, sid=a1883b56 fd2bb816
WRRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRThu Feb  5 02:37:49 2015 us=880115 192.168.11.232:63643 VERIFY OK: depth=1, C=TW, ST=TW, L=Taipei, O=netgear, OU=netgear, CN=netgear, emailAddress=mail@netgear.com
Thu Feb  5 02:37:49 2015 us=881232 192.168.11.232:63643 VERIFY OK: depth=0, C=TW, ST=TW, O=netgear, OU=netgear, CN=netgear_user, emailAddress=mail@netgear.com
WRWRWRWRWRWRWRThu Feb  5 02:37:49 2015 us=945931 192.168.11.232:63643 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Thu Feb  5 02:37:49 2015 us=945994 192.168.11.232:63643 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb  5 02:37:49 2015 us=946030 192.168.11.232:63643 NOTE: --mute triggered...
WWWRRRThu Feb  5 02:37:49 2015 us=948224 192.168.11.232:63643 3 variation(s) on previous 5 message(s) suppressed by --mute
Thu Feb  5 02:37:49 2015 us=948267 192.168.11.232:63643 [netgear_user] Peer Connection Initiated with [AF_INET]192.168.11.232:63643
Thu Feb  5 02:37:49 2015 us=948470 netgear_user/192.168.11.232:63643 MULTI: no dynamic or static remote --ifconfig address is available for netgear_user/192.168.11.232:63643
WRThu Feb  5 02:37:52 2015 us=131243 netgear_user/192.168.11.232:63643 PUSH: Received control message: 'PUSH_REQUEST'
Thu Feb  5 02:37:52 2015 us=131301 netgear_user/192.168.11.232:63643 send_push_reply(): safe_cap=940
Thu Feb  5 02:37:52 2015 us=131772 netgear_user/192.168.11.232:63643 SENT CONTROL [netgear_user]: 'PUSH_REPLY,route 192.168.1.1 255.255.255.0,route-delay 5,redirect-gateway def1,route-gateway dhcp,ping 10,ping-restart 120' (status=1)
WWWRWRRThu Feb  5 02:37:54 2015 us=257117 netgear_user/192.168.11.232:63643 MULTI: Learn: 9a:97:b1:fe:07:a8 -> netgear_user/192.168.11.232:63643
wWrWWWRwrWRwRwRwRwRwRwRwRwWrWRwRwRwWRwRwRwrWRwrWRwWRwRwRwRwRwRwrWrWrWRwrWRwRwRwRwRwRwRwRw

ifconfig server

br0       Link encap:Ethernet  HWaddr 00:D0:59:11:11:10  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::2d0:59ff:fe11:1110/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2497 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1955 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:375266 (366.4 KiB)  TX bytes:765491 (747.5 KiB)

eth0      Link encap:Ethernet  HWaddr 00:D0:59:11:11:11  
          inet addr:192.168.11.237  Bcast:192.168.11.255  Mask:255.255.255.0
          inet6 addr: fe80::2d0:59ff:fe11:1111/64 Scope:Link
          UP BROADCAST RUNNING PROMISC ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:1101 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1101 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:233754 (228.2 KiB)  TX bytes:167962 (164.0 KiB)
          Interrupt:181 Base address:0x6000 

eth1      Link encap:Ethernet  HWaddr 00:D0:59:11:11:0F  
          inet6 addr: fe80::2d0:59ff:fe11:110f/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1368 errors:0 dropped:2 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:296716 (289.7 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING MULTICAST  MTU:16436  Metric:1
          RX packets:35089 errors:0 dropped:0 overruns:0 frame:0
          TX packets:35089 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:8748723 (8.3 MiB)  TX bytes:8748723 (8.3 MiB)

tap0      Link encap:Ethernet  HWaddr 56:0A:5F:78:16:54  
          inet6 addr: fe80::540a:5fff:fe78:1654/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:213 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1214 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:22600 (22.0 KiB)  TX bytes:246686 (240.9 KiB)

vlan1     Link encap:Ethernet  HWaddr 00:D0:59:11:11:10  
          inet6 addr: fe80::2d0:59ff:fe11:1110/64 Scope:Link
          UP BROADCAST RUNNING PROMISC ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:2323 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1892 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:367860 (359.2 KiB)  TX bytes:769170 (751.1 KiB)

openvpn log client

2015-01-30 10:44:43 *Tunnelblick: OS X 10.7.5; Tunnelblick 3.5beta04 (build 4198); prior version 3.4beta36 (build 3945)
2015-01-30 10:44:43 *Tunnelblick: Attempting connection with R8000; Set nameserver = 1; monitoring connection
2015-01-30 10:44:43 *Tunnelblick: openvpnstart start R8000.tblk 1339 1 0 3 0 17266 -ptADGNWradsgnw 2.3.6
2015-01-30 10:44:44 *Tunnelblick: openvpnstart log:
     Tunnelblick: Loading tap-20111101.kext
     Tunnelblick: 
     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
     
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.6/openvpn
          --daemon
          --log
          /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-SR8000.tblk-SContents-SResources-Sconfig.ovpn.1_0_3_0_17266.1339.openvpn.log
          --cd
          /Library/Application Support/Tunnelblick/Shared/R8000.tblk/Contents/Resources
          --config
          /Library/Application Support/Tunnelblick/Shared/R8000.tblk/Contents/Resources/config.ovpn
          --cd
          /Library/Application Support/Tunnelblick/Shared/R8000.tblk/Contents/Resources
          --management
          127.0.0.1
          1339
          --management-query-passwords
          --management-hold
          --redirect-gateway
          def1
          --script-security
          2
          --up
          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -a -d -f -m -w -ptADGNWradsgnw
          --down
          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -a -d -f -m -w -ptADGNWradsgnw
          --route-pre-down
          /Applications/Tunnelblick.app/Contents/Resources/client.route-pre-down.tunnelblick.sh -a -d -f -m -w -ptADGNWradsgnw

2015-01-30 10:44:43 *Tunnelblick: openvpnstart starting OpenVPN
2015-01-30 10:44:44 *Tunnelblick: Established communication with OpenVPN
2015-01-30 10:44:44 us=18560 Current Parameter Settings:
2015-01-30 10:44:44 us=18857   config = '/Library/Application Support/Tunnelblick/Shared/R8000.tblk/Contents/Resources/config.ovpn'
2015-01-30 10:44:44 us=18875   mode = 0
2015-01-30 10:44:44 us=18890   show_ciphers = DISABLED
2015-01-30 10:44:44 us=18906   show_digests = DISABLED
2015-01-30 10:44:44 us=18920   show_engines = DISABLED
2015-01-30 10:44:44 us=18935   genkey = DISABLED
2015-01-30 10:44:44 us=18949   key_pass_file = '[UNDEF]'
2015-01-30 10:44:44 us=18964   show_tls_ciphers = DISABLED
2015-01-30 10:44:44 us=18978 Connection profiles [default]:
2015-01-30 10:44:44 us=18993   proto = udp
2015-01-30 10:44:44 us=19007   local = '[UNDEF]'
2015-01-30 10:44:44 us=19022   local_port = 0
2015-01-30 10:44:44 us=19036   remote = '192.168.11.237'
2015-01-30 10:44:44 us=19051   remote_port = 12974
2015-01-30 10:44:44 us=19065   remote_float = DISABLED
2015-01-30 10:44:44 us=19079   bind_defined = DISABLED
2015-01-30 10:44:44 us=19093   bind_local = DISABLED
2015-01-30 10:44:44 us=19108   connect_retry_seconds = 5
2015-01-30 10:44:44 us=19123   connect_timeout = 10
2015-01-30 10:44:44 us=19137   connect_retry_max = 0
2015-01-30 10:44:44 us=19151   socks_proxy_server = '[UNDEF]'
2015-01-30 10:44:44 us=19165   socks_proxy_port = 0
2015-01-30 10:44:44 us=19179   socks_proxy_retry = DISABLED
2015-01-30 10:44:44 us=19194   tun_mtu = 1500
2015-01-30 10:44:44 us=19208   tun_mtu_defined = ENABLED
2015-01-30 10:44:44 us=19223   link_mtu = 1500
2015-01-30 10:44:44 us=19237   link_mtu_defined = DISABLED
2015-01-30 10:44:44 us=19251   tun_mtu_extra = 32
2015-01-30 10:44:44 us=19265   tun_mtu_extra_defined = ENABLED
2015-01-30 10:44:44 us=19280   mtu_discover_type = -1
2015-01-30 10:44:44 us=19294   fragment = 0
2015-01-30 10:44:44 us=19308   mssfix = 1450
2015-01-30 10:44:44 us=19322   explicit_exit_notification = 0
2015-01-30 10:44:44 us=19337 Connection profiles END
2015-01-30 10:44:44 us=19351   remote_random = DISABLED
2015-01-30 10:44:44 us=19366   ipchange = '[UNDEF]'
2015-01-30 10:44:44 us=19380   dev = 'tap'
2015-01-30 10:44:44 us=19393   dev_type = '[UNDEF]'
2015-01-30 10:44:44 us=19412   dev_node = '[UNDEF]'
2015-01-30 10:44:44 us=19427   lladdr = '[UNDEF]'
2015-01-30 10:44:44 us=19442   topology = 1
2015-01-30 10:44:44 us=19456   tun_ipv6 = DISABLED
2015-01-30 10:44:44 us=19471   ifconfig_local = '[UNDEF]'
2015-01-30 10:44:44 us=19485   ifconfig_remote_netmask = '[UNDEF]'
2015-01-30 10:44:44 us=19499   ifconfig_noexec = DISABLED
2015-01-30 10:44:44 us=19513   ifconfig_nowarn = DISABLED
2015-01-30 10:44:44 us=19527   ifconfig_ipv6_local = '[UNDEF]'
2015-01-30 10:44:44 us=19542   ifconfig_ipv6_netbits = 0
2015-01-30 10:44:44 us=19556   ifconfig_ipv6_remote = '[UNDEF]'
2015-01-30 10:44:44 us=19571   shaper = 0
2015-01-30 10:44:44 us=19585   mtu_test = 0
2015-01-30 10:44:44 us=19599   mlock = DISABLED
2015-01-30 10:44:44 us=19613   keepalive_ping = 0
2015-01-30 10:44:44 us=19627   keepalive_timeout = 0
2015-01-30 10:44:44 us=19641   inactivity_timeout = 0
2015-01-30 10:44:44 us=19656   ping_send_timeout = 0
2015-01-30 10:44:44 us=19670   ping_rec_timeout = 0
2015-01-30 10:44:44 us=19685   ping_rec_timeout_action = 0
2015-01-30 10:44:44 us=19699   ping_timer_remote = DISABLED
2015-01-30 10:44:44 us=19713   remap_sigusr1 = 0
2015-01-30 10:44:44 us=19727   persist_tun = ENABLED
2015-01-30 10:44:44 us=19742   persist_local_ip = DISABLED
2015-01-30 10:44:44 us=19756   persist_remote_ip = DISABLED
2015-01-30 10:44:44 us=19770   persist_key = ENABLED
2015-01-30 10:44:44 us=19784   passtos = DISABLED
2015-01-30 10:44:44 us=19799   resolve_retry_seconds = 1000000000
2015-01-30 10:44:44 us=19813   username = '[UNDEF]'
2015-01-30 10:44:44 us=19827   groupname = '[UNDEF]'
2015-01-30 10:44:44 us=19859   chroot_dir = '[UNDEF]'
2015-01-30 10:44:44 us=19874   cd_dir = '/Library/Application Support/Tunnelblick/Shared/R8000.tblk/Contents/Resources'
2015-01-30 10:44:44 us=19889   writepid = '[UNDEF]'
2015-01-30 10:44:44 us=19904   up_script = '/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -a -d -f -m -w -ptADGNWradsgnw'
2015-01-30 10:44:44 us=19919   down_script = '/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -a -d -f -m -w -ptADGNWradsgnw'
2015-01-30 10:44:44 us=19933   down_pre = DISABLED
2015-01-30 10:44:44 us=19948   up_restart = DISABLED
2015-01-30 10:44:44 us=19962   up_delay = DISABLED
2015-01-30 10:44:44 us=19976   daemon = ENABLED
2015-01-30 10:44:44 us=19990   inetd = 0
2015-01-30 10:44:44 us=20004   log = ENABLED
2015-01-30 10:44:44 us=20019   suppress_timestamps = DISABLED
2015-01-30 10:44:44 us=20033   nice = 0
2015-01-30 10:44:44 us=20048   verbosity = 5
2015-01-30 10:44:44 us=20062   mute = 0
2015-01-30 10:44:44 us=20076   status_file = '[UNDEF]'
2015-01-30 10:44:44 us=20090   status_file_version = 1
2015-01-30 10:44:44 us=20104   status_file_update_freq = 60
2015-01-30 10:44:44 us=20119   occ = ENABLED
2015-01-30 10:44:44 us=20133   rcvbuf = 65536
2015-01-30 10:44:44 us=20148   sndbuf = 65536
2015-01-30 10:44:44 us=20162   sockflags = 0
2015-01-30 10:44:44 us=20176   fast_io = DISABLED
2015-01-30 10:44:44 us=20190   lzo = 7
2015-01-30 10:44:44 us=20204   route_script = '[UNDEF]'
2015-01-30 10:44:44 us=20218   route_default_gateway = '[UNDEF]'
2015-01-30 10:44:44 us=20240   route_default_metric = 0
2015-01-30 10:44:44 us=20255   route_noexec = DISABLED
2015-01-30 10:44:44 us=20270   route_delay = 0
2015-01-30 10:44:44 us=20284   route_delay_window = 30
2015-01-30 10:44:44 us=20298   route_delay_defined = DISABLED
2015-01-30 10:44:44 us=20313   route_nopull = DISABLED
2015-01-30 10:44:44 us=20332   route_gateway_via_dhcp = DISABLED
2015-01-30 10:44:44 us=20348   max_routes = 100
2015-01-30 10:44:44 us=20363   allow_pull_fqdn = DISABLED
2015-01-30 10:44:44 us=20382   [redirect_default_gateway local=0]
2015-01-30 10:44:44 us=20398   management_addr = '127.0.0.1'
2015-01-30 10:44:44 us=20412   management_port = 1339
2015-01-30 10:44:44 us=20427   management_user_pass = '[UNDEF]'
2015-01-30 10:44:44 us=20442   management_log_history_cache = 250
2015-01-30 10:44:44 us=20458   management_echo_buffer_size = 100
2015-01-30 10:44:44 us=20473   management_write_peer_info_file = '[UNDEF]'
2015-01-30 10:44:44 us=20488   management_client_user = '[UNDEF]'
2015-01-30 10:44:44 us=20503   management_client_group = '[UNDEF]'
2015-01-30 10:44:44 us=20518   management_flags = 6
2015-01-30 10:44:44 us=20532   shared_secret_file = '[UNDEF]'
2015-01-30 10:44:44 us=20548   key_direction = 0
2015-01-30 10:44:44 us=20562   ciphername_defined = ENABLED
2015-01-30 10:44:44 us=20577   ciphername = 'AES-128-CBC'
2015-01-30 10:44:44 us=20592   authname_defined = ENABLED
2015-01-30 10:44:44 us=20606   authname = 'SHA1'
2015-01-30 10:44:44 us=20621   prng_hash = 'SHA1'
2015-01-30 10:44:44 us=20636   prng_nonce_secret_len = 16
2015-01-30 10:44:44 us=20652   keysize = 0
2015-01-30 10:44:44 us=20667   engine = DISABLED
2015-01-30 10:44:44 us=20681   replay = ENABLED
2015-01-30 10:44:44 us=20696   mute_replay_warnings = DISABLED
2015-01-30 10:44:44 us=20711   replay_window = 64
2015-01-30 10:44:44 us=20725   replay_time = 15
2015-01-30 10:44:44 us=20740   packet_id_file = '[UNDEF]'
2015-01-30 10:44:44 us=20755   use_iv = ENABLED
2015-01-30 10:44:44 us=20770   test_crypto = DISABLED
2015-01-30 10:44:44 us=20786   tls_server = DISABLED
2015-01-30 10:44:44 us=20800   tls_client = ENABLED
2015-01-30 10:44:44 us=20815   key_method = 2
2015-01-30 10:44:44 us=20846   ca_file = 'ca.crt'
2015-01-30 10:44:44 us=20862   ca_path = '[UNDEF]'
2015-01-30 10:44:44 us=20877   dh_file = '[UNDEF]'
2015-01-30 10:44:44 us=20892   cert_file = 'client.crt'
2015-01-30 10:44:44 us=20907   priv_key_file = 'client.key'
2015-01-30 10:44:44 us=20922   pkcs12_file = '[UNDEF]'
2015-01-30 10:44:44 us=20937   cipher_list = '[UNDEF]'
2015-01-30 10:44:44 us=20952   tls_verify = '[UNDEF]'
2015-01-30 10:44:44 us=20967   tls_export_cert = '[UNDEF]'
2015-01-30 10:44:44 us=21019   verify_x509_type = 0
2015-01-30 10:44:44 us=21037   verify_x509_name = '[UNDEF]'
2015-01-30 10:44:44 us=21052   crl_file = '[UNDEF]'
2015-01-30 10:44:44 us=21067   ns_cert_type = 0
2015-01-30 10:44:44 us=21082   remote_cert_ku[i] = 0
2015-01-30 10:44:44 us=21097   remote_cert_ku[i] = 0
2015-01-30 10:44:44 us=21112   remote_cert_ku[i] = 0
2015-01-30 10:44:44 us=21140   remote_cert_ku[i] = 0
2015-01-30 10:44:44 us=21157   remote_cert_ku[i] = 0
2015-01-30 10:44:44 us=21172   remote_cert_ku[i] = 0
2015-01-30 10:44:44 us=21187   remote_cert_ku[i] = 0
2015-01-30 10:44:44 us=21201   remote_cert_ku[i] = 0
2015-01-30 10:44:44 us=21216   remote_cert_ku[i] = 0
2015-01-30 10:44:44 us=21231   remote_cert_ku[i] = 0
2015-01-30 10:44:44 us=21258   remote_cert_ku[i] = 0
2015-01-30 10:44:44 us=21275   remote_cert_ku[i] = 0
2015-01-30 10:44:44 us=21290   remote_cert_ku[i] = 0
2015-01-30 10:44:44 us=21305   remote_cert_ku[i] = 0
2015-01-30 10:44:44 us=21319   remote_cert_ku[i] = 0
2015-01-30 10:44:44 us=21334   remote_cert_ku[i] = 0
2015-01-30 10:44:44 us=21349   remote_cert_eku = '[UNDEF]'
2015-01-30 10:44:44 us=21369   ssl_flags = 0
2015-01-30 10:44:44 us=21384   tls_timeout = 2
2015-01-30 10:44:44 us=21399   renegotiate_bytes = 0
2015-01-30 10:44:44 us=21414   renegotiate_packets = 0
2015-01-30 10:44:44 us=21428   renegotiate_seconds = 3600
2015-01-30 10:44:44 us=21443   handshake_window = 60
2015-01-30 10:44:44 us=21458   transition_window = 3600
2015-01-30 10:44:44 us=21473   single_session = DISABLED
2015-01-30 10:44:44 us=21488   push_peer_info = DISABLED
2015-01-30 10:44:44 us=21504   tls_exit = DISABLED
2015-01-30 10:44:44 us=21518   tls_auth_file = '[UNDEF]'
2015-01-30 10:44:44 us=21533   pkcs11_protected_authentication = DISABLED
2015-01-30 10:44:44 us=21548   pkcs11_protected_authentication = DISABLED
2015-01-30 10:44:44 us=21563   pkcs11_protected_authentication = DISABLED
2015-01-30 10:44:44 us=21578   pkcs11_protected_authentication = DISABLED
2015-01-30 10:44:44 us=21593   pkcs11_protected_authentication = DISABLED
2015-01-30 10:44:44 us=21609   pkcs11_protected_authentication = DISABLED
2015-01-30 10:44:44 us=21624   pkcs11_protected_authentication = DISABLED
2015-01-30 10:44:44 us=21638   pkcs11_protected_authentication = DISABLED
2015-01-30 10:44:44 us=21653   pkcs11_protected_authentication = DISABLED
2015-01-30 10:44:44 us=21668   pkcs11_protected_authentication = DISABLED
2015-01-30 10:44:44 us=21683   pkcs11_protected_authentication = DISABLED
2015-01-30 10:44:44 us=21699   pkcs11_protected_authentication = DISABLED
2015-01-30 10:44:44 us=21714   pkcs11_protected_authentication = DISABLED
2015-01-30 10:44:44 us=21729   pkcs11_protected_authentication = DISABLED
2015-01-30 10:44:44 us=21744   pkcs11_protected_authentication = DISABLED
2015-01-30 10:44:44 us=21758   pkcs11_protected_authentication = DISABLED
2015-01-30 10:44:44 us=21779   pkcs11_private_mode = 00000000
2015-01-30 10:44:44 us=21795   pkcs11_private_mode = 00000000
2015-01-30 10:44:44 us=21810   pkcs11_private_mode = 00000000
2015-01-30 10:44:44 us=21826   pkcs11_private_mode = 00000000
2015-01-30 10:44:44 us=21841   pkcs11_private_mode = 00000000
2015-01-30 10:44:44 us=21856   pkcs11_private_mode = 00000000
2015-01-30 10:44:44 us=21871   pkcs11_private_mode = 00000000
2015-01-30 10:44:44 us=21904   pkcs11_private_mode = 00000000
2015-01-30 10:44:44 us=21920   pkcs11_private_mode = 00000000
2015-01-30 10:44:44 us=21936   pkcs11_private_mode = 00000000
2015-01-30 10:44:44 us=21951   pkcs11_private_mode = 00000000
2015-01-30 10:44:44 us=21966   pkcs11_private_mode = 00000000
2015-01-30 10:44:44 us=21981   pkcs11_private_mode = 00000000
2015-01-30 10:44:44 us=21996   pkcs11_private_mode = 00000000
2015-01-30 10:44:44 us=22011   pkcs11_private_mode = 00000000
2015-01-30 10:44:44 us=22026   pkcs11_private_mode = 00000000
2015-01-30 10:44:44 us=22041   pkcs11_cert_private = DISABLED
2015-01-30 10:44:44 us=22056   pkcs11_cert_private = DISABLED
2015-01-30 10:44:44 us=22071   pkcs11_cert_private = DISABLED
2015-01-30 10:44:44 us=22085   pkcs11_cert_private = DISABLED
2015-01-30 10:44:44 us=22099   pkcs11_cert_private = DISABLED
2015-01-30 10:44:44 us=22114   pkcs11_cert_private = DISABLED
2015-01-30 10:44:44 us=22132   pkcs11_cert_private = DISABLED
2015-01-30 10:44:44 us=22147   pkcs11_cert_private = DISABLED
2015-01-30 10:44:44 us=22162   pkcs11_cert_private = DISABLED
2015-01-30 10:44:44 us=22177   pkcs11_cert_private = DISABLED
2015-01-30 10:44:44 us=22192   pkcs11_cert_private = DISABLED
2015-01-30 10:44:44 us=22207   pkcs11_cert_private = DISABLED
2015-01-30 10:44:44 us=22222   pkcs11_cert_private = DISABLED
2015-01-30 10:44:44 us=22237   pkcs11_cert_private = DISABLED
2015-01-30 10:44:44 us=22251   pkcs11_cert_private = DISABLED
2015-01-30 10:44:44 us=22267   pkcs11_cert_private = DISABLED
2015-01-30 10:44:44 us=22282   pkcs11_pin_cache_period = -1
2015-01-30 10:44:44 us=22297   pkcs11_id = '[UNDEF]'
2015-01-30 10:44:44 us=22312   pkcs11_id_management = DISABLED
2015-01-30 10:44:44 us=22346   server_network = 0.0.0.0
2015-01-30 10:44:44 us=22363   server_netmask = 0.0.0.0
2015-01-30 10:44:44 us=22384   server_network_ipv6 = ::
2015-01-30 10:44:44 us=22399   server_netbits_ipv6 = 0
2015-01-30 10:44:44 us=22416   server_bridge_ip = 0.0.0.0
2015-01-30 10:44:44 us=22432   server_bridge_netmask = 0.0.0.0
2015-01-30 10:44:44 us=22448   server_bridge_pool_start = 0.0.0.0
2015-01-30 10:44:44 us=22464   server_bridge_pool_end = 0.0.0.0
2015-01-30 10:44:44 us=22479   ifconfig_pool_defined = DISABLED
2015-01-30 10:44:44 us=22496   ifconfig_pool_start = 0.0.0.0
2015-01-30 10:44:44 us=22512   ifconfig_pool_end = 0.0.0.0
2015-01-30 10:44:44 us=22529   ifconfig_pool_netmask = 0.0.0.0
2015-01-30 10:44:44 us=22543   ifconfig_pool_persist_filename = '[UNDEF]'
2015-01-30 10:44:44 us=22558   ifconfig_pool_persist_refresh_freq = 600
2015-01-30 10:44:44 us=22573   ifconfig_ipv6_pool_defined = DISABLED
2015-01-30 10:44:44 us=22589   ifconfig_ipv6_pool_base = ::
2015-01-30 10:44:44 us=22604   ifconfig_ipv6_pool_netbits = 0
2015-01-30 10:44:44 us=22619   n_bcast_buf = 256
2015-01-30 10:44:44 us=22634   tcp_queue_limit = 64
2015-01-30 10:44:44 us=22649   real_hash_size = 256
2015-01-30 10:44:44 us=22664   virtual_hash_size = 256
2015-01-30 10:44:44 us=22678   client_connect_script = '[UNDEF]'
2015-01-30 10:44:44 us=22693   learn_address_script = '[UNDEF]'
2015-01-30 10:44:44 us=22708   client_disconnect_script = '[UNDEF]'
2015-01-30 10:44:44 us=22723   client_config_dir = '[UNDEF]'
2015-01-30 10:44:44 us=22738   ccd_exclusive = DISABLED
2015-01-30 10:44:44 us=22753   tmp_dir = '/var/folders/q9/5k6_p_0n3b1cq_bj4l6dcfc80000gn/T/'
2015-01-30 10:44:44 us=22768   push_ifconfig_defined = DISABLED
2015-01-30 10:44:44 us=22784   push_ifconfig_local = 0.0.0.0
2015-01-30 10:44:44 us=22800   push_ifconfig_remote_netmask = 0.0.0.0
2015-01-30 10:44:44 us=22815   push_ifconfig_ipv6_defined = DISABLED
2015-01-30 10:44:44 us=22831   push_ifconfig_ipv6_local = ::/0
2015-01-30 10:44:44 us=22847   push_ifconfig_ipv6_remote = ::
2015-01-30 10:44:44 us=22878   enable_c2c = DISABLED
2015-01-30 10:44:44 us=22893   duplicate_cn = DISABLED
2015-01-30 10:44:44 us=22908   cf_max = 0
2015-01-30 10:44:44 us=22922   cf_per = 0
2015-01-30 10:44:44 us=22937   max_clients = 1024
2015-01-30 10:44:44 us=22952   max_routes_per_client = 256
2015-01-30 10:44:44 us=22967   auth_user_pass_verify_script = '[UNDEF]'
2015-01-30 10:44:44 us=22982   auth_user_pass_verify_script_via_file = DISABLED
2015-01-30 10:44:44 us=22997   port_share_host = '[UNDEF]'
2015-01-30 10:44:44 us=23012   port_share_port = 0
2015-01-30 10:44:44 us=23027   client = ENABLED
2015-01-30 10:44:44 us=23041   pull = ENABLED
2015-01-30 10:44:44 us=23056   auth_user_pass_file = '[UNDEF]'
2015-01-30 10:44:44 us=23078 OpenVPN 2.3.6 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Jan  8 2015
2015-01-30 10:44:44 us=23106 library versions: OpenSSL 1.0.1k 8 Jan 2015, LZO 2.08
2015-01-30 10:44:44 us=24180 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1339
2015-01-30 10:44:44 us=25253 Need hold release from management interface, waiting...
2015-01-30 10:44:44 us=184574 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1339
2015-01-30 10:44:44 us=191072 MANAGEMENT: CMD 'pid'
2015-01-30 10:44:44 us=191456 MANAGEMENT: CMD 'state on'
2015-01-30 10:44:44 us=191663 MANAGEMENT: CMD 'state'
2015-01-30 10:44:44 us=191932 MANAGEMENT: CMD 'bytecount 1'
2015-01-30 10:44:44 us=192784 MANAGEMENT: CMD 'hold release'
2015-01-30 10:44:44 us=193362 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2015-01-30 10:44:44 us=193539 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2015-01-30 10:44:44 us=195153 LZO compression initialized
2015-01-30 10:44:44 us=195504 Control Channel MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
2015-01-30 10:44:44 us=195736 Socket Buffers: R=[42080->65536] S=[9216->65536]
2015-01-30 10:44:44 us=198815 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
2015-01-30 10:44:44 us=199716 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
2015-01-30 10:44:44 us=199915 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
2015-01-30 10:44:44 us=200154 Local Options hash (VER=V4): 'b498be7c'
2015-01-30 10:44:44 us=200351 Expected Remote Options hash (VER=V4): '26e19fc0'
2015-01-30 10:44:44 us=200525 UDPv4 link local: [undef]
2015-01-30 10:44:44 us=200675 UDPv4 link remote: [AF_INET]192.168.11.237:12974
2015-01-30 10:44:44 us=209189 MANAGEMENT: >STATE:1422585884,WAIT,,,
                                        RFri Jan 30 10:44:44 2015 us=537323 MANAGEMENT: >STATE:1422585884,AUTH,,,
2015-01-30 10:44:44 us=537627 TLS: Initial packet from [AF_INET]192.168.11.237:12974, sid=41d648e1 7e7e62ae
                                        WWWWRRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRFri Jan 30 10:44:44 2015 us=882149 VERIFY OK: depth=1, C=TW, ST=TW, L=Taipei, O=netgear, OU=netgear, CN=netgear, emailAddress=mail@netgear.com
2015-01-30 10:44:44 us=882660 VERIFY OK: depth=0, C=TW, ST=TW, O=netgear, OU=netgear, CN=netgear, emailAddress=mail@netgear.com
                                        RFri Jan 30 10:44:49 2015 us=283575 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
2015-01-30 10:44:49 us=283831 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2015-01-30 10:44:49 us=284051 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
2015-01-30 10:44:49 us=284206 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
                                        RFri Jan 30 10:44:50 2015 us=319529 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
2015-01-30 10:44:50 us=321228 [netgear] Peer Connection Initiated with [AF_INET]192.168.11.237:12974
                                        RRRRFri Jan 30 10:44:51 2015 us=25175 MANAGEMENT: >STATE:1422585891,GET_CONFIG,,,
                                        RRFri Jan 30 10:44:52 2015 us=621601 SENT CONTROL [netgear]: 'PUSH_REQUEST' (status=1)
                                        WRFri Jan 30 10:44:52 2015 us=652623 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.1 255.255.255.0,route-delay 5,redirect-gateway def1,route-gateway dhcp,ping 10,ping-restart 120'
2015-01-30 10:44:52 us=652938 OPTIONS IMPORT: timers and/or timeouts modified
2015-01-30 10:44:52 us=653077 OPTIONS IMPORT: route options modified
2015-01-30 10:44:52 us=653329 OPTIONS IMPORT: route-related options modified
2015-01-30 10:44:52 us=654088 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
2015-01-30 10:44:52 us=654281 OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.1.1
2015-01-30 10:44:52 us=655038 TUN/TAP device /dev/tap0 opened
2015-01-30 10:44:52 us=655313 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -a -d -f -m -w -ptADGNWradsgnw tap0 1500 1590   init
                                        **********************************************
                                        Start of output from client.up.tunnelblick.sh
                                        Configuring tap DNS via DHCP asynchronously
                                        End of output from client.up.tunnelblick.sh
                                        **********************************************
                                        RFri Jan 30 10:44:56 2015 us=737378 Extracted DHCP router address: 192.168.1.1
                                        Sleeping for 0 seconds to wait for DHCP to finish setup.
                                        Sleeping for 1 seconds to wait for DHCP to finish setup.
                                        Retrieved from DHCP/BOOTP packet: name server(s) [ 192.168.1.1 ], search domain(s) [  ] and SMB server(s) [  ] and using default domain name [ openvpn ]
                                        rWrWNot aggregating ServerAddresses because running on OS X 10.6 or higher
                                        Setting search domains to 'openvpn' because running under OS X 10.6 or higher and the search domains were not set manually and 'Prepend domain name to search domains' was not selected
                                        rFri Jan 30 10:44:59 2015 us=55172 /sbin/route add -cloning -net 192.168.11.237 -netmask 255.255.255.255 -interface en1
                                        add net 192.168.11.237: gateway en1
2015-01-30 10:44:59 us=62908 /sbin/route add -net 0.0.0.0 192.168.1.1 128.0.0.0
2015-01-30 10:44:59 *Tunnelblick: No 'connected.sh' script to execute
                                        add net 0.0.0.0: gateway 192.168.1.1
2015-01-30 10:44:59 us=78856 /sbin/route add -net 128.0.0.0 192.168.1.1 128.0.0.0
                                        add net 128.0.0.0: gateway 192.168.1.1
2015-01-30 10:44:59 us=84378 Initialization Sequence Completed
2015-01-30 10:44:59 us=84721 MANAGEMENT: >STATE:1422585899,CONNECTED,SUCCESS,,192.168.11.237
                                        Saved the DNS and SMB configurations so they can be restored
                                        Changed DNS ServerAddresses setting from '192.168.11.1' to '192.168.1.1'
                                        Changed DNS SearchDomains setting from '' to 'openvpn'
                                        Changed DNS DomainName setting from '' to 'openvpn'
                                        Did not change SMB NetBIOSName setting of ''
                                        Did not change SMB Workgroup setting of ''
                                        Did not change SMB WINSAddresses setting of ''
                                        DNS servers '192.168.1.1' will be used for DNS queries when the VPN is active
                                        RwrWrWRwrThe DNS servers do not include any free public DNS servers known to Tunnelblick. This may cause DNS queries to fail or be intercepted or falsified even if they are directed through the VPN. Specify only known public DNS servers or DNS servers located on the VPN network to avoid such problems.
                                        WRwrWFlushed the DNS cache via dscacheutil
                                        /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil
                                        RwrWrWrWrWrWrWrWrWrWrWrWrWrWrWrWrWrWrWrWrWrWrWrWrWrWrWrWrWrWrWNotified mDNSResponder that the DNS cache was flushed
                                        Setting up to monitor system configuration with process-network-changes
2015-01-30 10:45:04 *Tunnelblick process-network-changes: A system configuration change was ignored

ifconfig client

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
        options=3<RXCSUM,TXCSUM>
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
        inet 127.0.0.1 netmask 0xff000000 
        inet6 ::1 prefixlen 128 
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        options=2b<RXCSUM,TXCSUM,VLAN_HWTAGGING,TSO4>
        ether 00:16:cb:ab:e8:f3 
        media: autoselect
        status: inactive
fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 2030
        lladdr 00:1c:b3:ff:fe:91:59:46 
        media: autoselect <full-duplex>
        status: inactive
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        ether 00:1c:b3:b4:23:ac 
        media: autoselect (<unknown type>)
        status: inactive
vnic0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        options=3<RXCSUM,TXCSUM>
        ether 00:1c:42:00:00:08 
        inet 10.211.55.2 netmask 0xffffff00 broadcast 10.211.55.255
        media: autoselect
        status: active
vnic1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        options=3<RXCSUM,TXCSUM>
        ether 00:1c:42:00:00:09 
        inet 10.37.129.2 netmask 0xffffff00 broadcast 10.37.129.255
        media: autoselect
        status: active
tap0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        ether 9a:97:b1:fe:07:a8 
        inet 192.168.1.3 netmask 0xffffff00 broadcast 192.168.1.255
        open (pid 18249)

maikcat

output of

brctl show

on server please,
Michael.

gymax

Please check. Thanks!

bridge name     bridge id               STP enabled     interfaces
br0             8000.00d059111110       no              vlan1
                                                          tap0

maikcat

why you have 2 interfaces (vlan1 & eth0) use ips from the SAME network range?

Michael.

gymax

Hi Michael,

My server is a router actually.
Vlan1 is lan side and eth0 is wan side. DHCP server bind on br0.
So you consider this is a problem on server side? Why?
What causes some rule added in the routing table some rule on my OSX?
Thank you.

maikcat

i have witnessed a system with 2 interfaces both using ips from the same lan
and noticed this problem,

packets coming from nic1 where answered from nic2.. :?

Michael.

gymax

Hmm... What do you mean "use ips from the SAME network range" in my case?
eth0 has 192.168.11.x. vlan1(br0) has 192.168.1.x.

maikcat

yes you are right,

i read the 11 as 1...

my bad.

Michael.

gymax

ok...
Can't find the same issue in forum.
Really hope someone can help.

Thanks.

maikcat

some corrections to your server config,

1) use dev tap0 instead of dev tap

2) use 32bit mask when you push routes to hosts (f.e push "route 192.168.1.1 255.255.255.255")

did you enable port forward on your openvpn server?
can you post the output of

iptables -L
iptables -L -t nat

on your openvpn server?

Michael.

gymax

1) use dev tap0 instead of dev tap
2) use 32bit mask when you push routes to hosts (f.e push "route 192.168.1.1 255.255.255.255")

Problem persists when adding upon modification.

I found something to workaround. Rule "128.0/1 192.168.1.1 UGSc 1 2 tap0" in client side affects the routing.

default

a. ping 168.95.1.1 -> ok
b. ping 77.77.77.77 -> NG
c. ping 50.50.50.50 -> NG

add routing rule on client
route add 64.0/2 192.168.1.1

a. ping 168.95.1.1 -> ok
b. ping 77.77.77.77 -> ok
c. ping 50.50.50.50 -> NG

add more routing rule on client
route add 32.0/3 192.168.1.1

a. ping 168.95.1.1 -> ok
b. ping 77.77.77.77 -> ok
c. ping 50.50.50.50 -> ok

But these setting won't be saved when I disconnect from server.
Can I add these rules by changing my config file? How?
What's the root cause?
"128.0/1" is added automatically. I can't reach the internet if delete "128.0/1".

Thanks!

maikcat

128 route is added because you used def1 on push redirect-gateway statement...

Michael.

gymax

Hi

But def1 is option of "Routing all client traffic (including web-traffic) through the VPN".
It works on my windows client as a default route. But only routes half traffic (128.0/1) on my OSX client...
Is that a expected behavior if you have the same configuration with mine?

Thanks a million.

Traffic

gymax wroteBut def1 is option of "Routing all client traffic (including web-traffic) through the VPN".

Reading the manual:

--redirect-gateway flags...

Automatically execute routing commands to cause all outgoing IP traffic to be redirected over the VPN. This is a client-side option.

This option performs three steps:

(1) Create a static route for the --remote address which forwards to the pre-existing default gateway. This is done so that (3) will not create a routing loop.

(2) Delete the default gateway route.

(3) Set the new default gateway to be the VPN endpoint address (derived either from --route-gateway or the second parameter to --ifconfig when --dev tun is specified).

When the tunnel is torn down, all of the above steps are reversed so that the original default route is restored.

Option flags:

local -- Add the local flag if both OpenVPN servers are directly connected via a common subnet, such as with wireless. The local flag will cause step 1 above to be omitted.

autolocal -- Try to automatically determine whether to enable local flag above.

def1 -- Use this flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway.

gymax wroteIt works on my windows client as a default route. But only routes half traffic (128.0/1) on my OSX client...

client: netstat -rn ? (vpn: up) 😃

gymax

Hi,

Yes, there are two route added. 0/1 and 128.0/1.
But only 128.0/1 works. Where traffic of 0/1 was routed?

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
0/1                192.168.1.1        UGSc            0        0    tap0
default            192.168.11.1       UGSc            9        0     en0
default            link#9             UCSI            2        0    tap0
8.8.8.8            link#9             UHRLWIi         0       25    tap0
10.37.129/24       link#8             UC              2        0   vnic1
10.37.129.2        0:1c:42:0:0:9      UHLWIi          1        1     lo0
10.37.129.255      ff:ff:ff:ff:ff:ff  UHLWbI          0       31   vnic1
10.211.55/24       link#7             UC              2        0   vnic0
10.211.55.2        0:1c:42:0:0:8      UHLWIi          1        1     lo0
10.211.55.255      ff:ff:ff:ff:ff:ff  UHLWbI          0       31   vnic0
17.83.253.7        link#9             UHLWIi          1        1    tap0
127                127.0.0.1          UCS             0        0     lo0
127.0.0.1          127.0.0.1          UH              5    24271     lo0
128.0/1            192.168.1.1        UGSc            1        2    tap0
169.254            link#4             UCS             0        0     en0
192.168.1          link#9             UCS             3        0    tap0
192.168.1.1        0:d0:59:11:11:10   UHLWIi         32      105    tap0   1158
192.168.1.2        0:25:b3:5a:af:2f   UHLWIi          0        6    tap0   1197
192.168.1.3        127.0.0.1          UHS             1        0     lo0
192.168.1.255      ff:ff:ff:ff:ff:ff  UHLWbI          0       31    tap0
192.168.11         link#4             UCS             2        0     en0
192.168.11.1       0:ff:e6:90:e2:d    UHLWIi          0        7     en0   1169
192.168.11.232     127.0.0.1          UHS             1        0     lo0
192.168.11.237/32  link#4             UCS             1        0     en0
192.168.11.237     0:d0:59:11:11:11   UHLWIi          1      132     en0   1200
192.168.11.255     ff:ff:ff:ff:ff:ff  UHLWbI          0       31     en0

Traffic

gymax wroteYes, there are two route added. 0/1 and 128.0/1.
But only 128.0/1 works. Where traffic of 0/1 was routed?

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
0/1                192.168.1.1        UGSc            0        0    tap0
128.0/1            192.168.1.1        UGSc            1        2    tap0

both routes point to tap0 .. perhaps you have a firewall problem ?

djgreg13

Hello,

I have this same problem only on MacOS, but i was investigated, and i notice this :
With a server with OpenVPN 2.3.2 installed,
If the client is OpenVPN 2.2.1, everything is OK, 8.8.8.8 is pingable and 140.115.50.50 is pingable too

This is the routage table with OpenVPN 2.2.1

Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            10.0.1.1           UGSc            0        0    tap0
default            10.0.1.1           UGScI           8        6    tap0
10.0.1/24          link#15            UCS             1        0    tap0
10.0.1.1/32        link#15            UCS             1        0    tap0
10.0.1.1           42:84:ed:60:ea:b2  UHLWIir        11       32    tap0   1182
10.0.1.91/32       link#15            UCS             0        0    tap0
10.0.1.255         ff:ff:ff:ff:ff:ff  UHLWbI          0        1    tap0
62.210.127.211/32  192.168.1.1        UGSc            1        0     en0
127                127.0.0.1          UCS             0        0     lo0
127.0.0.1          127.0.0.1          UH              5  1778110     lo0
169.254            link#4             UCS             0        0     en0
169.254            link#15            UCSI            0        0    tap0
192.168.1          link#4             UCS             4        0     en0
192.168.1.1/32     link#4             UCS             1        0     en0
192.168.1.1        2c:e4:12:e2:21:dc  UHLWIir         5      139     en0   1182
192.168.1.18/32    link#4             UCS             1        0     en0
192.168.1.18       b8:e8:56:36:3e:60  UHLWI           0        2     lo0
192.168.1.35       b8:27:eb:49:ff:89  UHLWIi          1       83     en0   1174
192.168.1.255      ff:ff:ff:ff:ff:ff  UHLWbI          0        5     en0

But with OpenVPN 2.3.2, 8.8.8.8 is not pingable and 140.115.50.50 is pingable

Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            10.0.1.1           UGSc            0        0    tap0
default            link#15            UCSI            5        0    tap0
10.0.1/24          link#15            UCS             2        0    tap0
10.0.1.1           42:84:ed:60:ea:b2  UHLWIir         1        0    tap0   1200
10.0.1.93/32       link#15            UCS             1        0    tap0
10.0.1.255         ff:ff:ff:ff:ff:ff  UHLWbI          0        1    tap0
17.171.4.14        link#15            UHLWIi          1        1    tap0
62.210.127.211/32  192.168.1.1        UGSc            1        0     en0
127                127.0.0.1          UCS             0        0     lo0
127.0.0.1          127.0.0.1          UH              5  1779014     lo0
169.254            link#4             UCS             0        0     en0
169.254            link#15            UCSI            0        0    tap0
192.168.1          link#4             UCS             2        0     en0
192.168.1.1/32     link#4             UCS             2        0     en0
192.168.1.1        2c:e4:12:e2:21:dc  UHLWIir         4      188     en0   1189
192.168.1.18/32    link#4             UCS             1        0     en0
192.168.1.18       b8:e8:56:36:3e:60  UHLWI           0        2     lo0
192.168.1.255      ff:ff:ff:ff:ff:ff  UHLWbI          0        8     en0
224.0.0.1          1:0:5e:0:0:1       UHmLWI          0        6    tap0
224.0.0.251        1:0:5e:0:0:fb      UHmLWI          0        0    tap0
255.255.255.255    ff:ff:ff:ff:ff:ff  UHLWbI          0        1    tap0

It seems to be a regression with newest version.

I will find a workaround, if i found, i post this here

Traffic

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.