Connection established, no internet access

reinis

Hi!

I can establish a connection between my OpenVPN server (Ubuntu machine behind router with forwarded port) and my OpenVPN client (Tunnelblick on Mac OS X), but I cannot access the internet (layer 3) on my client. Please note that the Ubuntu machine (12.04.4 LTS GNU/Linux 3.2.27 i686 Crystalbuntu 2.0) has a custom kernel with tun interface, but without iptables. The lack of iptables shouldn't be a problem as the tun interface simply wouldn't be fire-walled, right? PS "net.ipv4.ip_forward=1" is uncommented.

I would appreciate if someone helped me to fix this - I'm ready to provide any info necessary. Please, see both configs and logs below.

Thanks

Server config:

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
comp-lzo
verb 4

Client config:

client
dev tun
proto udp
remote reinis.ddns.net 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /Users/reinis/Desktop/Keys/ca.crt
cert /Users/reinis/Desktop/Keys/client1.crt
key /Users/reinis/Desktop/Keys/client1.key
comp-lzo
verb 4

Server log:

Sun Mar  8 19:00:21 2015 us=416988 OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec  1 2014
Sun Mar  8 19:00:21 2015 us=417311 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sun Mar  8 19:00:21 2015 us=506838 Diffie-Hellman initialized with 1024 bit key
Sun Mar  8 19:00:21 2015 us=553375 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Mar  8 19:00:21 2015 us=553468 Socket Buffers: R=[163840->131072] S=[163840->131072]
Sun Mar  8 19:00:21 2015 us=553773 ROUTE default_gateway=10.20.30.40
Sun Mar  8 19:00:21 2015 us=620111 TUN/TAP device tun0 opened
Sun Mar  8 19:00:21 2015 us=620199 TUN/TAP TX queue length set to 100
Sun Mar  8 19:00:21 2015 us=620261 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Mar  8 19:00:21 2015 us=620358 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Sun Mar  8 19:00:21 2015 us=631228 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Sun Mar  8 19:00:21 2015 us=636112 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Mar  8 19:00:21 2015 us=638040 GID set to nogroup
Sun Mar  8 19:00:21 2015 us=638120 UID set to nobody
Sun Mar  8 19:00:21 2015 us=638167 UDPv4 link local (bound): [undef]
Sun Mar  8 19:00:21 2015 us=638193 UDPv4 link remote: [undef]
Sun Mar  8 19:00:21 2015 us=638228 MULTI: multi_init called, r=256 v=256
Sun Mar  8 19:00:21 2015 us=638328 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Sun Mar  8 19:00:21 2015 us=638561 IFCONFIG POOL LIST
Sun Mar  8 19:00:21 2015 us=638646 Initialization Sequence Completed
Sun Mar  8 19:02:24 2015 us=452858 MULTI: multi_create_instance called
Sun Mar  8 19:02:24 2015 us=453055 212.93.115.179:57859 Re-using SSL/TLS context
Sun Mar  8 19:02:24 2015 us=453142 212.93.115.179:57859 LZO compression initialized
Sun Mar  8 19:02:24 2015 us=453596 212.93.115.179:57859 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Mar  8 19:02:24 2015 us=453654 212.93.115.179:57859 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Mar  8 19:02:24 2015 us=453821 212.93.115.179:57859 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sun Mar  8 19:02:24 2015 us=453862 212.93.115.179:57859 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sun Mar  8 19:02:24 2015 us=453939 212.93.115.179:57859 Local Options hash (VER=V4): '530fdded'
Sun Mar  8 19:02:24 2015 us=454003 212.93.115.179:57859 Expected Remote Options hash (VER=V4): '41690919'
Sun Mar  8 19:02:24 2015 us=454187 212.93.115.179:57859 TLS: Initial packet from [AF_INET]212.93.115.179:57859, sid=b393767a 0912a490
Sun Mar  8 19:02:25 2015 us=573356 212.93.115.179:57859 VERIFY OK: depth=1, /C=LV/ST=LV/L=Riga/O=RBInc/OU=deleted/CN=RB/name=reinis/emailAddress=deleted@gmail.com
Sun Mar  8 19:02:25 2015 us=574205 212.93.115.179:57859 VERIFY OK: depth=0, /C=LV/ST=LV/L=Riga/O=RBInc/OU=deleted/CN=client1/name=reinis/emailAddress=deleted@gmail.com
Sun Mar  8 19:02:25 2015 us=732254 212.93.115.179:57859 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Mar  8 19:02:25 2015 us=732321 212.93.115.179:57859 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Mar  8 19:02:25 2015 us=732550 212.93.115.179:57859 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Mar  8 19:02:25 2015 us=732598 212.93.115.179:57859 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Mar  8 19:02:25 2015 us=791967 212.93.115.179:57859 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Mar  8 19:02:25 2015 us=792056 212.93.115.179:57859 [client1] Peer Connection Initiated with [AF_INET]212.93.115.179:57859
Sun Mar  8 19:02:25 2015 us=792164 client1/212.93.115.179:57859 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=14ca:7eb7:8819:81b7::8819:81b7
Sun Mar  8 19:02:25 2015 us=792337 client1/212.93.115.179:57859 MULTI: Learn: 10.8.0.6 -> client1/212.93.115.179:57859
Sun Mar  8 19:02:25 2015 us=792441 client1/212.93.115.179:57859 MULTI: primary virtual IP for client1/212.93.115.179:57859: 10.8.0.6
Sun Mar  8 19:02:27 2015 us=991465 client1/212.93.115.179:57859 PUSH: Received control message: 'PUSH_REQUEST'
Sun Mar  8 19:02:27 2015 us=991520 client1/212.93.115.179:57859 send_push_reply(): safe_cap=960
Sun Mar  8 19:02:27 2015 us=991658 client1/212.93.115.179:57859 SENT CONTROL [client1]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.$
Sun Mar  8 19:03:32 2015 us=939397 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sun Mar  8 19:03:43 2015 us=354065 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sun Mar  8 19:04:04 2015 us=802599 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sun Mar  8 19:04:15 2015 us=1011 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sun Mar  8 19:04:25 2015 us=160688 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sun Mar  8 19:04:34 2015 us=442709 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sun Mar  8 19:04:55 2015 us=917031 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sun Mar  8 19:06:47 2015 us=200416 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

Client log:

Tunnelblick Log:

2015-03-08 19:02:22 *Tunnelblick: OS X 10.7.5; Tunnelblick 3.4.3 (build 4055.4198)
2015-03-08 19:02:22 *Tunnelblick: Attempting connection with config using shadow copy; Set nameserver = 1; monitoring connection
2015-03-08 19:02:22 *Tunnelblick: openvpnstart start config.tblk 1337 1 0 1 0 16688 -ptADGNWradsgnw 2.3.6
2015-03-08 19:02:22 *Tunnelblick: openvpnstart starting OpenVPN
2015-03-08 19:02:23 *Tunnelblick: openvpnstart log:
     Tunnelblick: 
     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
     
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.6/openvpn
          --daemon
          --log
          /Library/Application Support/Tunnelblick/Logs/-SUsers-Sreinis-SLibrary-SApplication Support-STunnelblick-SConfigurations-Sconfig.tblk-SContents-SResources-Sconfig.ovpn.1_0_1_0_16688.1337.openvpn.log
          --cd
          /Library/Application Support/Tunnelblick/Users/reinis/config.tblk/Contents/Resources
          --config
          /Library/Application Support/Tunnelblick/Users/reinis/config.tblk/Contents/Resources/config.ovpn
          --cd
          /Library/Application Support/Tunnelblick/Users/reinis/config.tblk/Contents/Resources
          --management
          127.0.0.1
          1337
          --management-query-passwords
          --management-hold
          --script-security
          2
          --up
          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw
          --down
          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw

2015-03-08 19:02:23 *Tunnelblick: Established communication with OpenVPN
2015-03-08 19:02:23 OpenVPN 2.3.6 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Jan  8 2015
2015-03-08 19:02:23 library versions: OpenSSL 1.0.1k 8 Jan 2015, LZO 2.08
2015-03-08 19:02:23 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
2015-03-08 19:02:23 Need hold release from management interface, waiting...
2015-03-08 19:02:23 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2015-03-08 19:02:23 MANAGEMENT: CMD 'pid'
2015-03-08 19:02:23 MANAGEMENT: CMD 'state on'
2015-03-08 19:02:23 MANAGEMENT: CMD 'state'
2015-03-08 19:02:23 MANAGEMENT: CMD 'bytecount 1'
2015-03-08 19:02:23 MANAGEMENT: CMD 'hold release'
2015-03-08 19:02:23 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2015-03-08 19:02:23 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2015-03-08 19:02:23 Socket Buffers: R=[42080->65536] S=[9216->65536]
2015-03-08 19:02:23 MANAGEMENT: >STATE:1425834143,RESOLVE,,,
2015-03-08 19:02:24 UDPv4 link local: [undef]
2015-03-08 19:02:24 UDPv4 link remote: [AF_INET]78.84.102.116:1194
2015-03-08 19:02:24 MANAGEMENT: >STATE:1425834144,WAIT,,,
2015-03-08 19:02:24 MANAGEMENT: >STATE:1425834144,AUTH,,,
2015-03-08 19:02:24 TLS: Initial packet from [AF_INET]78.84.102.116:1194, sid=f7c43f5a 4d8d537c
2015-03-08 19:02:24 VERIFY OK: depth=1, C=LV, ST=LV, L=Riga, O=RBInc, OU=babris, CN=RB, name=reinis, emailAddress=deleted@gmail.com
2015-03-08 19:02:24 VERIFY OK: depth=0, C=LV, ST=LV, L=Riga, O=RBInc, OU=babris, CN=server, name=reinis, emailAddress=deleted@gmail.com
2015-03-08 19:02:25 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2015-03-08 19:02:25 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2015-03-08 19:02:25 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2015-03-08 19:02:25 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2015-03-08 19:02:25 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
2015-03-08 19:02:25 [server] Peer Connection Initiated with [AF_INET]78.84.102.116:1194
2015-03-08 19:02:26 MANAGEMENT: >STATE:1425834146,GET_CONFIG,,,
2015-03-08 19:02:27 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2015-03-08 19:02:27 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
2015-03-08 19:02:27 OPTIONS IMPORT: timers and/or timeouts modified
2015-03-08 19:02:27 OPTIONS IMPORT: --ifconfig/up options modified
2015-03-08 19:02:27 OPTIONS IMPORT: route options modified
2015-03-08 19:02:27 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2015-03-08 19:02:27 Opened utun device utun0
2015-03-08 19:02:27 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
2015-03-08 19:02:27 MANAGEMENT: >STATE:1425834147,ASSIGN_IP,,10.8.0.6,
2015-03-08 19:02:27 /sbin/ifconfig utun0 delete
                                        ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2015-03-08 19:02:27 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2015-03-08 19:02:27 /sbin/ifconfig utun0 10.8.0.6 10.8.0.5 mtu 1500 netmask 255.255.255.255 up
2015-03-08 19:02:27 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw utun0 1500 1542 10.8.0.6 10.8.0.5 init
                                        **********************************************
                                        Start of output from client.up.tunnelblick.sh
                                        Retrieved from OpenVPN: name server(s) [ 8.8.8.8 ], search domain(s) [  ] and SMB server(s) [  ] and using default domain name [ openvpn ]
                                        Not aggregating ServerAddresses because running on OS X 10.6 or higher
                                        Setting search domains to 'openvpn' because running under OS X 10.6 or higher and the search domains were not set manually and 'Prepend domain name to search domains' was not selected
                                        Saved the DNS and SMB configurations so they can be restored
                                        Set ServerAddresses to 8.8.8.8
                                        Set SearchDomains   to openvpn
                                        Set DomainName       to openvpn
                                        Flushed the DNS cache via dscacheutil
                                        Notified mDNSResponder that the DNS cache was flushed
                                        Setting up to monitor system configuration with process-network-changes
                                        End of output from client.up.tunnelblick.sh
                                        **********************************************
2015-03-08 19:02:31 *Tunnelblick: No 'connected.sh' script to execute
2015-03-08 19:02:31 /sbin/route add -net 78.84.102.116 172.20.10.1 255.255.255.255
                                        add net 78.84.102.116: gateway 172.20.10.1
2015-03-08 19:02:31 /sbin/route add -net 0.0.0.0 10.8.0.5 128.0.0.0
                                        add net 0.0.0.0: gateway 10.8.0.5
2015-03-08 19:02:31 /sbin/route add -net 128.0.0.0 10.8.0.5 128.0.0.0
                                        add net 128.0.0.0: gateway 10.8.0.5
2015-03-08 19:02:31 MANAGEMENT: >STATE:1425834151,ADD_ROUTES,,,
2015-03-08 19:02:31 /sbin/route add -net 10.8.0.1 10.8.0.5 255.255.255.255
                                        add net 10.8.0.1: gateway 10.8.0.5
2015-03-08 19:02:31 Initialization Sequence Completed
2015-03-08 19:02:31 MANAGEMENT: >STATE:1425834151,CONNECTED,SUCCESS,10.8.0.6,78.84.102.116
2015-03-08 19:03:05 *Tunnelblick process-network-changes: A system configuration change was ignored
2015-03-08 19:03:22 *Tunnelblick: Disconnecting; 'Disconnect' (toggle) menu command invoked
2015-03-08 19:03:22 *Tunnelblick: Disconnecting using 'kill'
2015-03-08 19:03:23 event_wait : Interrupted system call (code=4)
2015-03-08 19:03:23 /sbin/route delete -net 10.8.0.1 10.8.0.5 255.255.255.255
                                        delete net 10.8.0.1: gateway 10.8.0.5
2015-03-08 19:03:23 /sbin/route delete -net 78.84.102.116 172.20.10.1 255.255.255.255
                                        delete net 78.84.102.116: gateway 172.20.10.1
2015-03-08 19:03:23 /sbin/route delete -net 0.0.0.0 10.8.0.5 128.0.0.0
                                        delete net 0.0.0.0: gateway 10.8.0.5
2015-03-08 19:03:23 /sbin/route delete -net 128.0.0.0 10.8.0.5 128.0.0.0
                                        delete net 128.0.0.0: gateway 10.8.0.5
2015-03-08 19:03:23 Closing TUN/TAP interface
2015-03-08 19:03:23 /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw utun0 1500 1542 10.8.0.6 10.8.0.5 init
                                        **********************************************
                                        Start of output from client.down.tunnelblick.sh
                                        Cancelled monitoring of system configuration changes
                                        Restored the DNS and SMB configurations
                                        Flushed the DNS cache via dscacheutil
                                        Notified mDNSResponder that the DNS cache was flushed
                                        End of output from client.down.tunnelblick.sh
                                        **********************************************
2015-03-08 19:03:23 SIGTERM[hard,] received, process exiting
2015-03-08 19:03:23 MANAGEMENT: >STATE:1425834203,EXITING,SIGTERM,,
2015-03-08 19:03:23 *Tunnelblick: No 'post-disconnect.sh' script to execute
2015-03-08 19:03:23 *Tunnelblick: Expected disconnection occurred.

================================================================================

Console Log:

2015-03-08 15:16:39 Tunnelblick[879] Set the new '*-notOKToCheckThatIPAddressDidNotChangeAfterConnection' preference from the 'notOKToCheckThatIPAddressDidNotChangeAfterConnection' preference
2015-03-08 15:16:40 Tunnelblick[879] Set program update feedURL to https://www.tunnelblick.net/appcast-s.rss
2015-03-08 15:16:48 Tunnelblick[879] DEBUG: Updater: systemVersion 10.7.5 satisfies minimumSystemVersion 10.4.0
2015-03-08 15:16:48 Tunnelblick[879] DEBUG: Updater: systemVersion 10.7.5 satisfies minimumSystemVersion 10.4.0
2015-03-08 15:21:30 Tunnelblick[879] Converting/Installing /Users/reinis/Desktop/Sample Tunnelblick VPN Configuration/config.ovpn at line 88: The configuration file refers to a file '/Users/reinis/Desktop/Sample', which does not exist.
2015-03-08 15:22:28 Tunnelblick[879] Converting/Installing /Users/reinis/Desktop/Sample Tunnelblick VPN Configuration/config.ovpn at line 88: Copied ca.crt
2015-03-08 15:22:28 Tunnelblick[879] Changed permissions from 644 to 740 on /private/var/folders/b_/qr3qtdt51rg7ydcymdgw3sc80000gn/T/Tunnelblick-543Isu/config.tblk/Contents/Resources/ca.crt
2015-03-08 15:22:28 Tunnelblick[879] Converting/Installing /Users/reinis/Desktop/Sample Tunnelblick VPN Configuration/config.ovpn at line 89: File '/Users/reinis/Desktop/Keys/client-name.crt' is empty.
2015-03-08 15:22:57 Tunnelblick[879] applicationShouldTerminate: termination for unknown reason, probably Command-Q; delayed until 'shutdownTunnelblick' finishes
2015-03-08 15:22:57 Tunnelblick[879] Finished shutting down Tunnelblick; allowing termination
2015-03-08 16:27:22 Tunnelblick[1242] Set program update feedURL to https://www.tunnelblick.net/appcast-s.rss
2015-03-08 16:27:28 Tunnelblick[1242] applicationShouldTerminate: termination because of Quit; delayed until 'shutdownTunnelblick' finishes
2015-03-08 16:27:28 Tunnelblick[1242] Finished shutting down Tunnelblick; allowing termination
2015-03-08 16:27:33 Tunnelblick[1251] Set program update feedURL to https://www.tunnelblick.net/appcast-s.rss
2015-03-08 16:27:33 Tunnelblick[1251] Converting/Installing /Users/reinis/Desktop/Sample Tunnelblick VPN Configuration/config.ovpn at line 88: Copied ca.crt
2015-03-08 16:27:33 Tunnelblick[1251] Changed permissions from 644 to 740 on /private/var/folders/b_/qr3qtdt51rg7ydcymdgw3sc80000gn/T/Tunnelblick-MoBkhB/config.tblk/Contents/Resources/ca.crt
2015-03-08 16:27:33 Tunnelblick[1251] Converting/Installing /Users/reinis/Desktop/Sample Tunnelblick VPN Configuration/config.ovpn at line 89: Copied client1.crt
2015-03-08 16:27:33 Tunnelblick[1251] Changed permissions from 644 to 740 on /private/var/folders/b_/qr3qtdt51rg7ydcymdgw3sc80000gn/T/Tunnelblick-MoBkhB/config.tblk/Contents/Resources/client1.crt
2015-03-08 16:27:33 Tunnelblick[1251] Converting/Installing /Users/reinis/Desktop/Sample Tunnelblick VPN Configuration/config.ovpn at line 90: Copied client1.key
2015-03-08 16:27:33 Tunnelblick[1251] Changed permissions from 644 to 740 on /private/var/folders/b_/qr3qtdt51rg7ydcymdgw3sc80000gn/T/Tunnelblick-MoBkhB/config.tblk/Contents/Resources/client1.key
2015-03-08 16:27:33 Tunnelblick[1251] Converting/Installing /Users/reinis/Desktop/Sample Tunnelblick VPN Configuration/config.ovpn: Converted OpenVPN configuration
2015-03-08 16:27:39 Tunnelblick[1251] Beginning installation or repair
2015-03-08 16:27:39 authexec[1259] executing /Applications/Tunnelblick.app/Contents/Resources/installer
2015-03-08 16:27:39 Tunnelblick[1251] Installation or repair succeeded; Log:
                                       Tunnelblick installer started 2015-03-08 16:27:39. 3 arguments: 0x0001 /Users/reinis/Library/Application Support/Tunnelblick/Configurations/config.tblk /private/var/folders/b_/qr3qtdt51rg7ydcymdgw3sc80000gn/T/Tunnelblick-MoBkhB/config.tblk
                                       Copied /private/var/folders/b_/qr3qtdt51rg7ydcymdgw3sc80000gn/T/Tunnelblick-MoBkhB/config.tblk to /Users/reinis/Library/Application Support/Tunnelblick/Configurations/config.tblk.temp
                                       Moved /Users/reinis/Library/Application Support/Tunnelblick/Configurations/config.tblk.temp to /Users/reinis/Library/Application Support/Tunnelblick/Configurations/config.tblk
                                       Changed ownership of /Users/reinis/Library/Application Support/Tunnelblick/Configurations/config.tblk and its contents from 501:20 to 501:80
                                       Copied /Users/reinis/Library/Application Support/Tunnelblick/Configurations/config.tblk to /Library/Application Support/Tunnelblick/Users/reinis/config.tblk.temp
                                       Moved /Library/Application Support/Tunnelblick/Users/reinis/config.tblk.temp to /Library/Application Support/Tunnelblick/Users/reinis/config.tblk
                                       Changed ownership of /Library/Application Support/Tunnelblick/Users/reinis/config.tblk and its contents from 501:80 to 0:0
                                       Changed permissions from 740 to 700 on /Library/Application Support/Tunnelblick/Users/reinis/config.tblk/Contents/Resources/ca.crt
                                       Changed permissions from 740 to 700 on /Library/Application Support/Tunnelblick/Users/reinis/config.tblk/Contents/Resources/client1.crt
                                       Changed permissions from 740 to 700 on /Library/Application Support/Tunnelblick/Users/reinis/config.tblk/Contents/Resources/client1.key
                                       Changed permissions from 740 to 700 on /Library/Application Support/Tunnelblick/Users/reinis/config.tblk/Contents/Resources/config.ovpn
                                       Created secure (shadow) copy of config.tblk
2015-03-08 16:27:44 Tunnelblick[1251] DEBUG: Updater: systemVersion 10.7.5 satisfies minimumSystemVersion 10.4.0
2015-03-08 16:27:44 Tunnelblick[1251] DEBUG: Updater: systemVersion 10.7.5 satisfies minimumSystemVersion 10.4.0
2015-03-08 16:38:03 Tunnelblick[1251] applicationShouldTerminate: termination for unknown reason, probably Command-Q; delayed until 'shutdownTunnelblick' finishes
2015-03-08 16:38:03 Tunnelblick[1251] Finished shutting down Tunnelblick; allowing termination
2015-03-08 16:44:45 Tunnelblick[1496] Set program update feedURL to https://www.tunnelblick.net/appcast-s.rss
2015-03-08 16:44:47 Tunnelblick[1496] DEBUG: Updater: systemVersion 10.7.5 satisfies minimumSystemVersion 10.4.0
2015-03-08 16:44:47 Tunnelblick[1496] DEBUG: Updater: systemVersion 10.7.5 satisfies minimumSystemVersion 10.4.0
2015-03-08 17:43:25 Tunnelblick[1496] applicationShouldTerminate: termination because of Quit; delayed until 'shutdownTunnelblick' finishes
2015-03-08 17:43:26 Tunnelblick[1496] Finished shutting down Tunnelblick; allowing termination
2015-03-08 19:02:18 Tunnelblick[794] Set program update feedURL to https://www.tunnelblick.net/appcast-s.rss
2015-03-08 19:02:22 Tunnelblick[794] DEBUG: Updater: systemVersion 10.7.5 satisfies minimumSystemVersion 10.4.0
2015-03-08 19:02:22 Tunnelblick[794] DEBUG: Updater: systemVersion 10.7.5 satisfies minimumSystemVersion 10.4.0

================================================================================

Non-Apple kexts that are loaded:

Index Refs Address    Size       Wired      Name (Version) <Linked Against>
   96    0 0xa5d000   0xa000     0x9000     com.Cycling74.driver.Soundflower (1.6.6) <89 5 4 3>
   97    0 0x98b000   0x7000     0x6000     com.wavtap.driver.WavTap (0.4.0) <89 5 4 3>
  114    3 0x59485000 0x42000    0x41000    org.virtualbox.kext.VBoxDrv (4.3.18) <7 5 4 3 1>
  115    0 0x593fd000 0xa000     0x9000     org.virtualbox.kext.VBoxUSB (4.3.18) <114 48 37 7 5 4 3 1>
  116    0 0x4876c000 0x5000     0x4000     org.virtualbox.kext.VBoxNetFlt (4.3.18) <114 7 5 4 3 1>
  117    0 0x5918e000 0x7000     0x6000     org.virtualbox.kext.VBoxNetAdp (4.3.18) <114 5 4 1>

Extra info:

atv@AppleTV:~$ modprobe tun
atv@AppleTV:~$ sudo modprobe tun
atv@AppleTV:~$ lsmod
Module                  Size  Used by
tun                    11240  2 
nvidia              10908608  0 
mac_hid                 2425  0 
crystalhd              65005  0 
ipv6                  200189  34

maikcat

The lack of iptables shouldn't be a problem as the tun interface simply wouldn't be fire-walled, right?

yes and no..

most examples involve perfoming NAT on server side meaning that you must use iptables (unless if you do have another way to perform NAT) ,

avoiding NAT on openvpn server itself means two things:

1)openvpn servers router need to know about the vpn subnet (a static route usually does the job)
2)openvpn servers router must NAT the vpn subnet.

Michael.

reinis

Thanks a lot for the quick reply.

maikcat wrote Most examples involve perfoming NAT on server side meaning that you must use iptables (unless if you do have another way to perform NAT)

I do not have the necessary skills to rebuild a kernel and include iptables. Thus, I will avoid NAT on openvpn server itself. Instead, I will use my Linksys router as NAT.

maikcat wrote Avoiding NAT on openvpn server itself means two things:
1)openvpn servers router need to know about the vpn subnet (a static route usually does the job)
2)openvpn servers router must NAT the vpn subnet.
Michael.

I've attached a screenshot of my Linksys router's "Advanced routing" panel below. Could you please assist me on the fields I I need to fill given my OpenVPN server config file.

PS My server and client configs are correct, right? Thanks

maikcat

the static route stuff is easy simply add

route name: whatever you want
dest lan ip: your openvpn tun based network (10.8.0.0)
subnet mask: 255.255.255.0
gateway: your openvpn servers lan ip

The NAT is more complicated...
simply test it out , if it perfoms many-to-one NAT will work out of the box if not it wont.

Michael.

reinis

I entered your mentioned values in the Linksys router's "Advanced routing" panel and now everything works perfectly! I am able to surf the web from client's PC with my server's external IP address.

On a side note - should I worry about security threats given my setup? Is it significantly less secure than having NAT on the server itself?

Thanks!

maikcat

I entered your mentioned values in the Linksys router's "Advanced routing" panel and now everything works perfectly!

nice! 🙂

should I worry about security threats given my setup? Is it significantly less secure than having NAT on the server itself?

security threats..? you can harden your openvpn setup a little further if this is what you mean,

by the non use of NAT on server itself ? no

Michael.