Route all traffic while using TAP

cstout

Client config:

client
dev tap0
proto udp
remote *ipaddress* 1194
persist-key
persist-tun
ca ca.crt
cert cert.crt
key cert.key
remote-cert-tls server
comp-lzo
verb 3

Server config:

port 1194
proto udp
dev tap0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
remote-cert-tls client
server-bridge 10.0.2.8 255.255.255.0 10.0.2.100 10.0.2.110
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3

Hello everyone, I followed this excellent guide at http://www.emaculation.com/doku.php/bridged_openvpn_server_setup and was able to successfully connect tunneling layer 2 traffic. This is huge for me since I will no longer need to remote control computers in order to manage applications and devices that rely on mDNS and Bonjour communication.

With the bulk of this setup already working, I'd like to take it a step further but I've hit a wall. I've searched all over this forum and Google and have spent the larger part of this day trying to figure out what needs to be modified in the client and/or server config files in order to send all traffic (including web) over this VPN connection. Every user that's posted something similar to this has resulted in my VPN connection working for local but breaking all internet communication when I try their recommended solutions.

My setup is an exact replica of the recommended setup outlined at the emaculation link above: Debian on VirtualBox. I'm connecting from Tunnelblick on OS X 10.11.4 (El Capitan). I'm exhausted and out of ideas...I hope I provided enough info to go off of. I didn't want to list out all the different configs I've tried since there were too many failed attempts to list here.

Traffic

cstout wroteI followed this excellent guide at

I suggest you read the official OpenVPN HOWTO:
HOWTO: For OpenVPN Community Edition

cstout wrotewhat needs to be modified in the client and/or server config files in order to send all traffic (including web) over this VPN connection <..> I'm exhausted and out of ideas..

Once again:
HOWTO: Routing all client traffic (including web-traffic) through the VPN

cstout

@Traffic after hours of scouring this forum I knew you would be the first to reply...

Please give me an ounce of your patience and offer help instead of pointing me to a document I read who knows how many times. Your response was totally unhelpful to me and anybody else who may be stuck where I am. If you know the solution to my problem, help a guy out and post it. If you've answered it a thousand times, share the link...I couldn't find it. I'm no expert. Never claimed to be. I'm here asking for help. I'm missing something that may be outlined in that help doc but I don't know what.

Traffic

cstout wrote@Traffic after hours of scouring this forum I knew you would be the first to reply...

Well .. you will be familiar with this then:

Please see the Forum rules (top of this page)

cstout wrotePlease give me an ounce of your patience and offer help instead of pointing me to a document I read who knows how many times

You may have read it .. but you did not follow it ..

cstout wroteIf you know the solution to my problem, help a guy out and post it.

Your server config is clearly missing this:

push "redirect-gateway def1

:lol: :cry:

cstout

Not looking for a flame war here. Just trying to provide all the info necessary to ask for help on a forum.

In my OP I wrote, "I didn't want to list out all the different configs I've tried since there were too many failed attempts to list here."

That line

push "redirect-gateway def1"

is in just about every post out there, including, yes, the HOWTO doc you linked (and I read).

When I add that line to the server config all Internet traffic dies. I cannot ping anything outside my LAN. Here's the log from Tunnelblick after modifying the server config with the redirect-gateway line.

2016-04-18 18:14:41 *Tunnelblick: Established communication with OpenVPN
2016-04-18 18:14:41 OpenVPN 2.3.10 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Mar 19 2016
2016-04-18 18:14:41 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.09
2016-04-18 18:14:41 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
2016-04-18 18:14:41 Need hold release from management interface, waiting...
2016-04-18 18:14:41 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2016-04-18 18:14:41 MANAGEMENT: CMD 'pid'
2016-04-18 18:14:41 MANAGEMENT: CMD 'state on'
2016-04-18 18:14:41 MANAGEMENT: CMD 'state'
2016-04-18 18:14:41 MANAGEMENT: CMD 'bytecount 1'
2016-04-18 18:14:41 MANAGEMENT: CMD 'hold release'
2016-04-18 18:14:41 Socket Buffers: R=[196724->196724] S=[9216->9216]
2016-04-18 18:14:41 MANAGEMENT: >STATE:1461024881,RESOLVE,,,
2016-04-18 18:14:41 *Tunnelblick: openvpnstart starting OpenVPN
2016-04-18 18:14:42 UDPv4 link local (bound): [undef]
2016-04-18 18:14:42 UDPv4 link remote: [AF_INET]*.*.*.*:1194
2016-04-18 18:14:42 MANAGEMENT: >STATE:1461024882,WAIT,,,
2016-04-18 18:14:42 MANAGEMENT: >STATE:1461024882,AUTH,,,
2016-04-18 18:14:42 TLS: Initial packet from [AF_INET]*.*.*.*:1194, sid=8e085cfc 49cfd652
2016-04-18 18:14:42 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=OpenVPN-CA, name=EasyRSA, emailAddress=me@myhost.mydomain
2016-04-18 18:14:42 Validating certificate key usage
2016-04-18 18:14:42 ++ Certificate has key usage  00a0, expects 00a0
2016-04-18 18:14:42 VERIFY KU OK
2016-04-18 18:14:42 Validating certificate extended key usage
2016-04-18 18:14:42 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2016-04-18 18:14:42 VERIFY EKU OK
2016-04-18 18:14:42 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=server, name=EasyRSA, emailAddress=me@myhost.mydomain
2016-04-18 18:14:43 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2016-04-18 18:14:43 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2016-04-18 18:14:43 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2016-04-18 18:14:43 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2016-04-18 18:14:43 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
2016-04-18 18:14:43 [server] Peer Connection Initiated with [AF_INET]*.*.*.*:1194
2016-04-18 18:14:44 MANAGEMENT: >STATE:1461024884,GET_CONFIG,,,
2016-04-18 18:14:45 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2016-04-18 18:14:45 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route-gateway 10.0.2.8,ping 10,ping-restart 120,ifconfig 10.0.2.100 255.255.255.0'
2016-04-18 18:14:45 OPTIONS IMPORT: timers and/or timeouts modified
2016-04-18 18:14:45 OPTIONS IMPORT: --ifconfig/up options modified
2016-04-18 18:14:45 OPTIONS IMPORT: route options modified
2016-04-18 18:14:45 OPTIONS IMPORT: route-related options modified
2016-04-18 18:14:45 TUN/TAP device /dev/tap0 opened
2016-04-18 18:14:45 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
2016-04-18 18:14:45 MANAGEMENT: >STATE:1461024885,ASSIGN_IP,,10.0.2.100,
2016-04-18 18:14:45 /sbin/ifconfig tap0 delete
                                        ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2016-04-18 18:14:45 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2016-04-18 18:14:45 /sbin/ifconfig tap0 10.0.2.100 netmask 255.255.255.0 mtu 1500 up
2016-04-18 18:14:45 /sbin/route add -net *.*.*.* 10.0.1.1 255.255.255.255
                                        add net *.*.*.*: gateway 10.0.1.1
2016-04-18 18:14:45 /sbin/route add -net 0.0.0.0 10.0.2.8 128.0.0.0
2016-04-18 18:14:45 *Tunnelblick: No 'connected.sh' script to execute
                                        add net 0.0.0.0: gateway 10.0.2.8
2016-04-18 18:14:45 /sbin/route add -net 128.0.0.0 10.0.2.8 128.0.0.0
                                        add net 128.0.0.0: gateway 10.0.2.8
2016-04-18 18:14:45 Initialization Sequence Completed
2016-04-18 18:14:45 MANAGEMENT: >STATE:1461024885,CONNECTED,SUCCESS,10.0.2.100,*.*.*.*
2016-04-18 18:15:26 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's name after connecting.

Traffic

cstout wroteThat line

push "redirect-gateway def1"

is in just about every post out there, including, yes, the HOWTO doc you linked (and I read).

That is because that is the correct way to do redirect your client data ..

cstout wroteWhen I add that line to the server config all Internet traffic dies

Because you have done something else wrong .. probably something to do with this:

cstout wroteDebian on VirtualBox

I can only presume you are runng a virtual server on your real MAC machine .. :geek: