openvpn install but no internet after login, OSX tunnelblick

[deleted]

I have been lookin for solution for days now. (reinstalling, iptables reconfiguring etc)
But i can't seem to make it work. Whatever i tried, and trust me i tried just about everything,
once vpn is connected a ping from to client to 8.8.8.8 ends up dead. (Request timeout for icmp_seq 0)

On my mac ifconfig says:
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
inet 10.8.0.6 --> 10.8.0.5 netmask 0xffffffff

A ping on my mac to 10.8.0.1 returns:
64 bytes from 10.8.0.1: icmp_seq=0 ttl=64 time=13.126 ms

On the server (besides eth0 and lo) ifconfig says:
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:300 errors:0 dropped:0 overruns:0 frame:0
TX packets:48 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:23041 (22.5 KiB) TX bytes:4977 (4.8 KiB)

No internet is the case when i use this (either way, client or server side (debian 7))
redirect-gateway def1

If i dont use redirect-gateway, than i DO have internet, but the IP stays the same.
I am using lastest stable tunnelblick and openvpn releases.

Here i my configs:

client
remote 11.22.33.444 1194
; 11.22.33.444 == server ip adres
dev tun
proto udp
redirect-gateway def1
;dhcp-option DNS 8.8.8.8
nobind
;user nobody
;group nobody
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
comp-lzo
verb 3
redirect-gateway def1
route-delay 3
;auth-nocache
;script-security 2
;mute 20
;route-delay 2

and /etc/openvpn/server.conf

port 1194
proto udp
dev tun

ca ca.crt
cert server.crt
key server.key
dh dh1024.pem

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;push "redirect-gateway def1" # bypass-dhcp"
; 11.22.33.444 == server ip adres
; # 255.255.255.128 == server mask
push "route 11.22.33.444 255.255.255.128"

push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

;client-to-client
keepalive 10 120
;cipher DES-EDE3-CBC
comp-lzo

max-clients 5
;user nobody
;group nogroup

persist-key
persist-tun

log /var/log/openvpn.log
;status openvpn-status.log
verb 3
;mute 20

tunnelblick log:

*Tunnelblick: OS X 10.9.5; Tunnelblick 3.4.3 (build 4055.4198); Admin user

================================================================================

There are no unusual files in vps1.tblk

================================================================================

Configuration preferences:

useDNS = 1
-routeAllTrafficThroughVpn = 0
-runMtuTest = 0
-keychainHasUsernameAndPassword = 0
-lastConnectionSucceeded = 1

================================================================================

Wildcard preferences:


================================================================================

Program preferences:

launchAtNextLogin = 1
notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0
askedUserIfOKToCheckThatIPAddressDidNotChangeAfterConnection = 1
tunnelblickVersionHistory = (
    "3.4.3 (build 4055.4198)"
)
lastLaunchTime = 447511232.808369
connectionWindowDisplayCriteria = showWhenConnecting
maxLogDisplaySize = 102400
lastConnectedDisplayName = vps1
installationUID (not shown)
keyboardShortcutIndex = 1
updateCheckAutomatically = 1
updateSendProfileInfo = 1
NSWindow Frame ConnectingWindow = 645 631 389 187 0 0 1680 1028 
detailsWindowFrameVersion = 4055.4198
detailsWindowFrame = {{9, 149}, {1592, 468}}
detailsWindowLeftFrame = {{0, 0}, {296, 350}}
leftNavSelectedDisplayName = vps1
haveDealtWithSparkle1dot5b6 = 1
haveDealtWithOldTunTapPreferences = 1
haveDealtWithOldLoginItem = 1
SUEnableAutomaticChecks = 1
SUFeedURL = https://www.tunnelblick.net/appcast-s.rss
SUScheduledCheckInterval = 86400
SUSendProfileInfo = 1
SULastCheckTime = 2015-03-08 12:40:32 +0000
SULastProfileSubmissionDate = 2015-03-04 12:54:49 +0000
SUHasLaunchedBefore = 1
WebKitDefaultFontSize = 16
WebKitStandardFont = Times

================================================================================

Tunnelblick Log:

2015-03-08 13:40:50 *Tunnelblick: OS X 10.9.5; Tunnelblick 3.4.3 (build 4055.4198)
2015-03-08 13:40:50 *Tunnelblick: Attempting connection with vps1 using shadow copy; Set nameserver = 1; monitoring connection
2015-03-08 13:40:50 *Tunnelblick: openvpnstart start vps1.tblk 1337 1 0 1 0 16688 -ptADGNWradsgnw 2.3.6
2015-03-08 13:40:51 *Tunnelblick: openvpnstart log:
     Tunnelblick: 
     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
     
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.6/openvpn
          --daemon
          --log
          /Library/Application Support/Tunnelblick/Logs/-SUsers-Smaximo-SLibrary-SApplication Support-STunnelblick-SConfigurations-Svps1.tblk-SContents-SResources-Sconfig.ovpn.1_0_1_0_16688.1337.openvpn.log
          --cd
          /Library/Application Support/Tunnelblick/Users/maximo/vps1.tblk/Contents/Resources
          --config
          /Library/Application Support/Tunnelblick/Users/maximo/vps1.tblk/Contents/Resources/config.ovpn
          --cd
          /Library/Application Support/Tunnelblick/Users/maximo/vps1.tblk/Contents/Resources
          --management
          127.0.0.1
          1337
          --management-query-passwords
          --management-hold
          --script-security
          2
          --up
          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw
          --down
          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw

2015-03-08 13:40:50 *Tunnelblick: openvpnstart starting OpenVPN
2015-03-08 13:40:51 *Tunnelblick: Established communication with OpenVPN
2015-03-08 13:40:51 OpenVPN 2.3.6 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Jan  8 2015
2015-03-08 13:40:51 library versions: OpenSSL 1.0.1k 8 Jan 2015, LZO 2.08
2015-03-08 13:40:51 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
2015-03-08 13:40:51 Need hold release from management interface, waiting...
2015-03-08 13:40:51 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2015-03-08 13:40:51 MANAGEMENT: CMD 'pid'
2015-03-08 13:40:51 MANAGEMENT: CMD 'state on'
2015-03-08 13:40:51 MANAGEMENT: CMD 'state'
2015-03-08 13:40:51 MANAGEMENT: CMD 'bytecount 1'
2015-03-08 13:40:51 MANAGEMENT: CMD 'hold release'
2015-03-08 13:40:51 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2015-03-08 13:40:51 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2015-03-08 13:40:51 Socket Buffers: R=[196724->65536] S=[9216->65536]
2015-03-08 13:40:51 UDPv4 link local: [undef]
2015-03-08 13:40:51 UDPv4 link remote: [AF_INET]11.22.33.444:1194
2015-03-08 13:40:51 MANAGEMENT: >STATE:1425818451,WAIT,,,
2015-03-08 13:40:51 MANAGEMENT: >STATE:1425818451,AUTH,,,
2015-03-08 13:40:51 TLS: Initial packet from [AF_INET]11.22.33.444:1194, sid=e98c8042 18485324
2015-03-08 13:40:51 VERIFY OK: depth=1, C=US, ST=CA, L=NoobTown, O=myserver, OU=changeme, CN=changeme, name=changeme, emailAddress=none@myserver.net
2015-03-08 13:40:51 VERIFY OK: depth=0, C=US, ST=CA, L=NoobTown, O=myserver, OU=changeme, CN=changeme, name=changeme, emailAddress=none@myserver.net
2015-03-08 13:40:51 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2015-03-08 13:40:51 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2015-03-08 13:40:51 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2015-03-08 13:40:51 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2015-03-08 13:40:51 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
2015-03-08 13:40:51 [changeme] Peer Connection Initiated with [AF_INET]11.22.33.444:1194
2015-03-08 13:40:53 MANAGEMENT: >STATE:1425818453,GET_CONFIG,,,
2015-03-08 13:40:54 SENT CONTROL [changeme]: 'PUSH_REQUEST' (status=1)
2015-03-08 13:40:54 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 11.22.33.444 255.255.255.225 net_gateway,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
2015-03-08 13:40:54 OPTIONS IMPORT: timers and/or timeouts modified
2015-03-08 13:40:54 OPTIONS IMPORT: --ifconfig/up options modified
2015-03-08 13:40:54 OPTIONS IMPORT: route options modified
2015-03-08 13:40:54 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2015-03-08 13:40:54 Opened utun device utun0
2015-03-08 13:40:54 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
2015-03-08 13:40:54 MANAGEMENT: >STATE:1425818454,ASSIGN_IP,,10.8.0.6,
2015-03-08 13:40:54 /sbin/ifconfig utun0 delete
                                        ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2015-03-08 13:40:54 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2015-03-08 13:40:54 /sbin/ifconfig utun0 10.8.0.6 10.8.0.5 mtu 1500 netmask 255.255.255.255 up
2015-03-08 13:40:54 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw utun0 1500 1542 10.8.0.6 10.8.0.5 init
                                        **********************************************
                                        Start of output from client.up.tunnelblick.sh
                                        Retrieved from OpenVPN: name server(s) [ 8.8.8.8 8.8.4.4 10.8.0.1 ], search domain(s) [  ] and SMB server(s) [  ] and using default domain name [ openvpn ]
                                        Not aggregating ServerAddresses because running on OS X 10.6 or higher
                                        Setting search domains to 'openvpn' because running under OS X 10.6 or higher and the search domains were not set manually and 'Prepend domain name to search domains' was not selected
                                        Saved the DNS and SMB configurations so they can be restored
                                        Set ServerAddresses to 8.8.8.8 8.8.4.4 10.8.0.1
                                        Set SearchDomains   to openvpn
                                        Set DomainName       to openvpn
                                        Flushed the DNS cache via dscacheutil
                                        Notified mDNSResponder that the DNS cache was flushed
                                        Setting up to monitor system configuration with process-network-changes
                                        End of output from client.up.tunnelblick.sh
                                        **********************************************
2015-03-08 13:41:00 /sbin/route add -net 11.22.33.444 192.168.0.1 255.255.255.255
                                        add net 11.22.33.444: gateway 192.168.0.1
2015-03-08 13:41:00 /sbin/route add -net 0.0.0.0 10.8.0.5 128.0.0.0
                                        add net 0.0.0.0: gateway 10.8.0.5
2015-03-08 13:41:00 /sbin/route add -net 128.0.0.0 10.8.0.5 128.0.0.0
                                        add net 128.0.0.0: gateway 10.8.0.5
2015-03-08 13:41:00 MANAGEMENT: >STATE:1425818460,ADD_ROUTES,,,
2015-03-08 13:41:00 /sbin/route add -net 11.22.33.444 192.168.0.1 255.255.255.225
                                        route: invalid mask: 255.255.255.225
2015-03-08 13:41:00 ERROR: OS X route add command failed: external program exited with error status: 68
2015-03-08 13:41:00 /sbin/route add -net 10.8.0.1 10.8.0.5 255.255.255.255
                                        add net 10.8.0.1: gateway 10.8.0.5
2015-03-08 13:41:00 Initialization Sequence Completed
2015-03-08 13:41:00 MANAGEMENT: >STATE:1425818460,CONNECTED,SUCCESS,10.8.0.6,11.22.33.444
2015-03-08 13:41:01 *Tunnelblick: No 'connected.sh' script to execute
2015-03-08 13:41:33 *Tunnelblick process-network-changes: A system configuration change was ignored
2015-03-08 13:41:36 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's name after connecting.

================================================================================

Traffic

Unfortunately, your logs and confiogs do not match:

mixam00 wroteserver.conf
Quote:

;push "redirect-gateway def1" # bypass-dhcp"

mixam00 wrote2015-03-08 13:40:54 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1

Did you enable IP_Forwarding on the server ?

[deleted]

thanks for you reply.

Traffic wroteUnfortunately, your logs and confiogs do not match:

mixam00 wroteserver.conf
Quote:

;push "redirect-gateway def1" # bypass-dhcp"
mixam00 wrote2015-03-08 13:40:54 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1
Did you enable IP_Forwarding on the server ?

no. ip_forwarding (that is if you mean /etc/sysctl.conf) was commented.
I uncommented it and did a service networking --full-restart
but lost my eth0.

So i am now logged in via my provider ssh terminal.
And ifconfig shows indeed that eth0 is gone.
Commenting back ip_forwarding and a networking restart did bring back my eth0 tho.

What i have in /etc/network/interfaces:

auto lo
iface lo inet loopback

allow-hotplug eth0
iface eth0 inet dhcp
pre-up iptables-restore < /etc/iptables.rules

About your remark about "redirect-gateway def1" i didn't know i had to define them at client And server simultaneously.

[deleted]

i did a system reboot and now eth0 is back.

[deleted]

Traffic wroteUnfortunately, your logs and confiogs do not match:

mixam00 wroteserver.conf
Quote:

;push "redirect-gateway def1" # bypass-dhcp"
mixam00 wrote2015-03-08 13:40:54 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1
Did you enable IP_Forwarding on the server ?

So i did once again:
# sysctl -w net.ipv4.ip_forward=1
set redirect-gateway def1 in server.conf and client.conf
and There Yaa Go.... :lol:
It's even blazing fast :roll:

Why it lost eth0 on a network restart, beats me.
But thanks a million bro, for taking the time!

Traffic

No problem 8-)

Mod: candidate for closure ..