I'm trying to setup a openvpn server in china mainland. I can connect to the openvpn server using Tunnelblick but there is no Internet. I'm using CENTOS 7.
Any suggestions will be appreciated.
####Server Configuration#############################################
;local a.b.c.d
port 1194
;proto tcp
proto udp
;dev tap
dev tun
;dev-node MyTap
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
;topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
;server-bridge
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
;learn-address ./script
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 223.5.5.5"
push "dhcp-option DNS 223.6.6.6"
;client-to-client
;duplicate-cn
keepalive 10 120
;tls-auth ta.key 0 # This file is secret
;cipher BF-CBC # Blowfish (default)
;cipher AES-128-CBC # AES
;cipher DES-EDE3-CBC # Triple-DES
comp-lzo
;max-clients 100
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn.log
;log-append openvpn.log
verb 3
;mute 20
####Client Configuration#############################################
client
dev tun
proto udp
remote 139.196.27.41 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
ca /Users/Don/vpn_keys/ca.crt
cert /Users/Don/vpn_keys/client.crt
key /Users/Don/vpn_keys/client.key
####Server Log#############################################
Sat Mar 5 10:16:58 2016 UDPv4 link local (bound): [undef]
Sat Mar 5 10:16:58 2016 UDPv4 link remote: [undef]
Sat Mar 5 10:16:58 2016 MULTI: multi_init called, r=256 v=256
Sat Mar 5 10:16:58 2016 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Sat Mar 5 10:16:58 2016 ifconfig_pool_read(), in='client,10.8.0.4', TODO: IPv6
Sat Mar 5 10:16:58 2016 succeeded -> ifconfig_pool_set()
Sat Mar 5 10:16:58 2016 IFCONFIG POOL LIST
Sat Mar 5 10:16:58 2016 client,10.8.0.4
Sat Mar 5 10:16:58 2016 Initialization Sequence Completed
Sat Mar 5 10:17:06 2016 166.137.217.49:11020 TLS: Initial packet from [AF_INET]166.137.217.49:11020, sid=b2141b1a 550554bc
Sat Mar 5 10:17:19 2016 166.137.217.49:11020 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=server, emailAddress=me@myhost.mydomain
Sat Mar 5 10:17:19 2016 166.137.217.49:11020 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=client, name=server, emailAddress=me@myhost.mydomain
Sat Mar 5 10:17:20 2016 166.137.217.49:11020 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Mar 5 10:17:20 2016 166.137.217.49:11020 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Mar 5 10:17:20 2016 166.137.217.49:11020 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Mar 5 10:17:20 2016 166.137.217.49:11020 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Mar 5 10:17:21 2016 166.137.217.49:11020 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat Mar 5 10:17:21 2016 166.137.217.49:11020 [client] Peer Connection Initiated with [AF_INET]166.137.217.49:11020
Sat Mar 5 10:17:21 2016 client/166.137.217.49:11020 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Sat Mar 5 10:17:21 2016 client/166.137.217.49:11020 MULTI: Learn: 10.8.0.6 -> client/166.137.217.49:11020
Sat Mar 5 10:17:21 2016 client/166.137.217.49:11020 MULTI: primary virtual IP for client/166.137.217.49:11020: 10.8.0.6
Sat Mar 5 10:17:23 2016 client/166.137.217.49:11020 PUSH: Received control message: 'PUSH_REQUEST'
Sat Mar 5 10:17:23 2016 client/166.137.217.49:11020 send_push_reply(): safe_cap=940
Sat Mar 5 10:17:23 2016 client/166.137.217.49:11020 SENT CONTROL [client]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 223.5.5.5,dhcp-option DNS 223.6.6.6,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Sat Mar 5 10:20:40 2016 166.137.217.49:9792 TLS: Initial packet from [AF_INET]166.137.217.49:9792, sid=06e402c1 cf95ed11
Sat Mar 5 10:20:48 2016 166.137.217.49:9792 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=server, emailAddress=me@myhost.mydomain
Sat Mar 5 10:20:48 2016 166.137.217.49:9792 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=client, name=server, emailAddress=me@myhost.mydomain
Sat Mar 5 10:20:52 2016 166.137.217.49:9792 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Mar 5 10:20:52 2016 166.137.217.49:9792 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Mar 5 10:20:52 2016 166.137.217.49:9792 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Mar 5 10:20:52 2016 166.137.217.49:9792 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Mar 5 10:20:53 2016 166.137.217.49:9792 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat Mar 5 10:20:53 2016 166.137.217.49:9792 [client] Peer Connection Initiated with [AF_INET]166.137.217.49:9792
Sat Mar 5 10:20:53 2016 MULTI: new connection by client 'client' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Sat Mar 5 10:20:53 2016 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Sat Mar 5 10:20:53 2016 MULTI: Learn: 10.8.0.6 -> client/166.137.217.49:9792
Sat Mar 5 10:20:53 2016 MULTI: primary virtual IP for client/166.137.217.49:9792: 10.8.0.6
Sat Mar 5 10:20:55 2016 client/166.137.217.49:9792 PUSH: Received control message: 'PUSH_REQUEST'
Sat Mar 5 10:20:55 2016 client/166.137.217.49:9792 send_push_reply(): safe_cap=940
Sat Mar 5 10:20:55 2016 client/166.137.217.49:9792 SENT CONTROL [client]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 223.5.5.5,dhcp-option DNS 223.6.6.6,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Sat Mar 5 10:26:35 2016 client/166.137.217.49:9792 [client] Inactivity timeout (--ping-restart), restarting
Sat Mar 5 10:26:35 2016 client/166.137.217.49:9792 SIGUSR1[soft,ping-restart] received, client-instance restarting
