So, I have OpenVPN inside of an OpenVZ container. For the most part it worked but then randomly stops and I am unable to get it to route traffic once again. Throughout the process I am definitely able to successfully connect to the OpenVPN server without any issues...it't always that the client can never access the internet once it does connect.
Here is my server configuration:
IPTables:
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -s 10.0.1.0/24 -j ACCEPT
iptables -A FORWARD -s 10.0.2.0/24 -j ACCEPT
iptables -A INPUT -i venet0 -p esp -j ACCEPT
iptables -A INPUT -i venet0 -p udp --dport 500 -j ACCEPT
iptables -A INPUT -i venet0 -p tcp --dport 500 -j ACCEPT
iptables -A INPUT -i venet0 -p udp --dport 4500 -j ACCEPT
iptables -A INPUT -i venet0 -p udp --dport 1701 -j ACCEPT
iptables -A INPUT -i venet0 -p tcp --dport 1723 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o venet0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -o venet0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.0.2.0/24 -o venet0 -j MASQUERADE
iptables -A INPUT -i venet0 -m state --state NEW -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i venet0 -m state --state NEW -p tcp --dport 1194 -j ACCEPT
iptables -A INPUT -i venet0:0 -m state --state NEW -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i venet0:0 -m state --state NEW -p tcp --dport 1194 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -o venet0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i venet0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE
iptables -A FORWARD -i tun+ -o venet0:0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i venet0:0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0:0 -j MASQUERADE
iptables -A OUTPUT -o tun+ -j ACCEPT
OpenVPN Server Configuration:
#protocol stuff
port 1194
proto tcp
dev tun
#IP Stuff
server 10.8.0.0 255.255.255.0
#Key stuff
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
#option
persist-tun
persist-key
keepalive 10 60
##option authen.
comp-lzo
client-to-client
username-as-common-name
client-cert-not-required
auth-user-pass-verify /etc/openvpn/script/loginFlatFile.php via-file
ping-timer-rem
verb 1
mute 10
push "route 10.8.0.0 255.255.255.0"
push "dhcp-option DNS 10.8.0.1"
push "redirect-gateway def1 bypass-dhcp"
##DNS-Server
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
ping-timer-rem
##script connect-disconnect
script-security 3 system
client-connect /etc/openvpn/script/connect.sh
client-disconnect /etc/openvpn/script/disconnect.sh
Connection Log from the server:
Sep 30 01:53:03 2 openvpn[5865]: TCP connection established with [AF_INET]37.14.94.220:54708
Sep 30 01:53:05 2 openvpn[5865]: 37.14.94.220:54708 WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
Sep 30 01:53:05 2 openvpn[5865]: 37.14.94.220:54708 WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
Sep 30 01:53:05 2 openvpn[5865]: 37.14.94.220:54708 [joe] Peer Connection Initiated with [AF_INET]37.14.94.220:54708
Sep 30 01:53:05 2 openvpn[5865]: joe/37.14.94.220:54708 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Sep 30 01:53:07 2 openvpn[5865]: joe/37.14.94.220:54708 send_push_reply(): safe_cap=940
Connection Log from the Client:
*Tunnelblick: OS X 10.12.1; Tunnelblick 3.6.5 (build 4566)
2016-09-30 07:53:02 *Tunnelblick: Attempting connection with usa_1; Set nameserver = 769; monitoring connection
2016-09-30 07:53:02 *Tunnelblick: openvpnstart start usa_1.tblk 1337 769 0 3 0 1065264 -ptADGNWradsgnw 2.3.11
2016-09-30 07:53:02 *Tunnelblick: openvpnstart starting OpenVPN
2016-09-30 07:53:03 *Tunnelblick: openvpnstart log:
OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.11/openvpn
--daemon
--log
/Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-Susa_1.tblk-SContents-SResources-Sconfig.ovpn.769_0_3_0_1065264.1337.openvpn.log
--cd
/Library/Application Support/Tunnelblick/Shared/usa_1.tblk/Contents/Resources
--verb
3
--config
/Library/Application Support/Tunnelblick/Shared/usa_1.tblk/Contents/Resources/config.ovpn
--verb
3
--cd
/Library/Application Support/Tunnelblick/Shared/usa_1.tblk/Contents/Resources
--management
127.0.0.1
1337
--management-query-passwords
--management-hold
--script-security
2
--up
/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
--down
/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
2016-09-30 07:53:03 *Tunnelblick: Established communication with OpenVPN
2016-09-30 07:53:03 *Tunnelblick: Obtained VPN username and password from the Keychain
2016-09-30 07:53:03 OpenVPN 2.3.11 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Jul 18 2016
2016-09-30 07:53:03 library versions: OpenSSL 1.0.2h 3 May 2016, LZO 2.09
2016-09-30 07:53:03 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
2016-09-30 07:53:03 Need hold release from management interface, waiting...
2016-09-30 07:53:03 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2016-09-30 07:53:03 MANAGEMENT: CMD 'pid'
2016-09-30 07:53:03 MANAGEMENT: CMD 'state on'
2016-09-30 07:53:03 MANAGEMENT: CMD 'state'
2016-09-30 07:53:03 MANAGEMENT: CMD 'bytecount 1'
2016-09-30 07:53:03 MANAGEMENT: CMD 'hold release'
2016-09-30 07:53:03 MANAGEMENT: CMD 'username "Auth" "joe"'
2016-09-30 07:53:03 MANAGEMENT: CMD 'password [...]'
2016-09-30 07:53:03 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
2016-09-30 07:53:03 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2016-09-30 07:53:03 Socket Buffers: R=[131072->131072] S=[131072->131072]
2016-09-30 07:53:03 Attempting to establish TCP connection with [AF_INET]45.32.3.20:1194 [nonblock]
2016-09-30 07:53:03 MANAGEMENT: >STATE:1475214783,TCP_CONNECT,,,
2016-09-30 07:53:04 TCP connection established with [AF_INET]45.32.3.20:1194
2016-09-30 07:53:04 TCPv4_CLIENT link local: [undef]
2016-09-30 07:53:04 TCPv4_CLIENT link remote: [AF_INET]45.32.3.20:1194
2016-09-30 07:53:04 MANAGEMENT: >STATE:1475214784,WAIT,,,
2016-09-30 07:53:04 MANAGEMENT: >STATE:1475214784,AUTH,,,
2016-09-30 07:53:04 TLS: Initial packet from [AF_INET]45.32.3.20:1194, sid=f923632b e6659d5e
2016-09-30 07:53:04 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2016-09-30 07:53:05 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
2016-09-30 07:53:05 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=server, name=EasyRSA, emailAddress=me@myhost.mydomain
2016-09-30 07:53:05 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2016-09-30 07:53:05 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2016-09-30 07:53:05 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2016-09-30 07:53:05 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2016-09-30 07:53:05 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
2016-09-30 07:53:05 [server] Peer Connection Initiated with [AF_INET]45.32.3.20:1194
2016-09-30 07:53:06 MANAGEMENT: >STATE:1475214786,GET_CONFIG,,,
2016-09-30 07:53:07 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2016-09-30 07:53:08 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,dhcp-option DNS 10.8.0.1,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5'
2016-09-30 07:53:08 OPTIONS IMPORT: timers and/or timeouts modified
2016-09-30 07:53:08 OPTIONS IMPORT: --ifconfig/up options modified
2016-09-30 07:53:08 OPTIONS IMPORT: route options modified
2016-09-30 07:53:08 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2016-09-30 07:53:08 Opening utun (connect(AF_SYS_CONTROL)): Resource busy
2016-09-30 07:53:08 Opened utun device utun1
2016-09-30 07:53:08 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
2016-09-30 07:53:08 MANAGEMENT: >STATE:1475214788,ASSIGN_IP,,10.8.0.6,
2016-09-30 07:53:08 /sbin/ifconfig utun1 delete
ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2016-09-30 07:53:08 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2016-09-30 07:53:08 /sbin/ifconfig utun1 10.8.0.6 10.8.0.5 mtu 1500 netmask 255.255.255.255 up
2016-09-30 07:53:08 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw utun1 1500 1544 10.8.0.6 10.8.0.5 init
**********************************************
Start of output from client.up.tunnelblick.sh
Disabled IPv6 for 'Work L2TP'
Retrieved from OpenVPN: name server(s) [ 10.8.0.1 8.8.8.8 8.8.4.4 ], search domain(s) [ ] and SMB server(s) [ ] and using default domain name [ openvpn ]
Not aggregating ServerAddresses because running on OS X 10.6 or higher
Setting search domains to 'openvpn' because running under OS X 10.6 or higher and the search domains were not set manually and 'Prepend domain name to search domains' was not selected
Saved the DNS and SMB configurations so they can be restored
Changed DNS ServerAddresses setting from '192.168.9.1' to '10.8.0.1 8.8.8.8 8.8.4.4'
Changed DNS SearchDomains setting from '' to 'openvpn'
Changed DNS DomainName setting from 'localdomain' to 'openvpn'
Did not change SMB NetBIOSName setting of ''
Did not change SMB Workgroup setting of ''
Did not change SMB WINSAddresses setting of ''
DNS servers '10.8.0.1 8.8.8.8 8.8.4.4' will be used for DNS queries when the VPN is active
NOTE: The DNS servers include one or more free public DNS servers known to Tunnelblick and one or more DNS servers not known to Tunnelblick. If used, the DNS servers not known to Tunnelblick may cause DNS queries to fail or be intercepted or falsified even if they are directed through the VPN. Specify only known public DNS servers or DNS servers located on the VPN network to avoid such problems.
Flushed the DNS cache via dscacheutil
/usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil
Notified mDNSResponder that the DNS cache was flushed
Setting up to monitor system configuration with process-network-changes
End of output from client.up.tunnelblick.sh
**********************************************
2016-09-30 07:53:11 /sbin/route add -net 45.32.3.20 192.168.9.1 255.255.255.255
add net 45.32.3.20: gateway 192.168.9.1
2016-09-30 07:53:11 /sbin/route add -net 0.0.0.0 10.8.0.5 128.0.0.0
add net 0.0.0.0: gateway 10.8.0.5
2016-09-30 07:53:11 /sbin/route add -net 128.0.0.0 10.8.0.5 128.0.0.0
add net 128.0.0.0: gateway 10.8.0.5
2016-09-30 07:53:11 MANAGEMENT: >STATE:1475214791,ADD_ROUTES,,,
2016-09-30 07:53:11 /sbin/route add -net 10.8.0.0 10.8.0.5 255.255.255.0
add net 10.8.0.0: gateway 10.8.0.5
2016-09-30 07:53:11 /sbin/route add -net 10.8.0.0 10.8.0.5 255.255.255.0
route: writing to routing socket: File exists
add net 10.8.0.0: gateway 10.8.0.5: File exists
2016-09-30 07:53:11 Initialization Sequence Completed
2016-09-30 07:53:11 MANAGEMENT: >STATE:1475214791,CONNECTED,SUCCESS,10.8.0.6,45.32.3.20
2016-09-30 07:53:12 *Tunnelblick: No 'connected.sh' script to execute
2016-09-30 07:53:16 *Tunnelblick process-network-changes: A system configuration change was ignored
Here is my routing on the Mac before and after connected to the server.
Routing tables
Internet:
Destination Gateway Flags Refs Use Netif Expire
default 192.168.9.1 UGSc 402 0 en0
127 127.0.0.1 UCS 1 0 lo0
127.0.0.1 127.0.0.1 UH 3 44597 lo0
192.168.9 link#6 UCS 9 0 en0
192.168.9.1/32 link#6 UCS 2 0 en0
192.168.9.1 d0:50:99:5c:dd:e7 UHLWIir 406 6035 en0 1043
192.168.9.2 3c:a8:2a:a0:50:dc UHLWIi 1 4260611 en0 2
192.168.9.12 78:24:af:99:fd:af UHLWIi 2 24569 en0 1163
192.168.9.57 74:5e:1c:58:dc:9a UHLWIi 1 42 en0 915
192.168.9.60/32 link#6 UCS 2 0 en0
192.168.9.60 ac:bc:32:87:c6:ed UHLWIi 1 12 lo0
192.168.9.71 b8:44:d9:cf:69:f9 UHLWIi 1 0 en0 608
192.168.9.74 0:90:a9:d5:aa:ba UHLWIi 1 80 en0 501
192.168.9.199 link#6 UHLWIi 1 26849 en0
192.168.9.251 8:74:2:5:bf:46 UHLWIi 1 0 en0 37
192.168.9.255 link#6 UHLWbI 1 2862 en0
224.0.0/4 link#6 UmCS 3 0 en0
224.0.0.251 1:0:5e:0:0:fb UHmLWI 1 0 en0
239.255.255.250 1:0:5e:7f:ff:fa UHmLWI 1 2313 en0
255.255.255.255/32 link#6 UCS 2 0 en0
255.255.255.255 link#6 UHLWbI 1 1581 en0
Internet6:
Destination Gateway Flags Netif Expire
default fe80::%utun0 UGcI utun0
default fe80::%utun2 UGcI utun2
::1 ::1 UHL lo0
fe80::%lo0/64 fe80::1%lo0 UcI lo0
fe80::1%lo0 link#1 UHLI lo0
fe80::%awdl0/64 link#13 UCI awdl0
fe80::fc9c:f6ff:fe45:b908%awdl0 fe:9c:f6:45:b9:8 UHLI lo0
fe80::%utun0/64 fe80::a466:d455:8c91:9232%utun0 UcI utun0
fe80::a466:d455:8c91:9232%utun0 link#14 UHLI lo0
fe80::%utun2/64 fe80::3ccd:b9c5:5893:fcb6%utun2 UcI utun2
fe80::3ccd:b9c5:5893:fcb6%utun2 link#16 UHLI lo0
ff01::%lo0/32 ::1 UmCI lo0
ff01::%awdl0/32 link#13 UmCI awdl0
ff01::%utun0/32 fe80::a466:d455:8c91:9232%utun0 UmCI utun0
ff01::%utun2/32 fe80::3ccd:b9c5:5893:fcb6%utun2 UmCI utun2
ff02::%lo0/32 ::1 UmCI lo0
ff02::%awdl0/32 link#13 UmCI awdl0
ff02::%utun0/32 fe80::a466:d455:8c91:9232%utun0 UmCI utun0
ff02::%utun2/32 fe80::3ccd:b9c5:5893:fcb6%utun2 UmCI utun2
Once the connection is established
Routing tables
Internet:
Destination Gateway Flags Refs Use Netif Expire
0/1 10.8.0.5 UGSc 32 0 utun1
default 192.168.9.1 UGSc 410 0 en0
10.8/24 10.8.0.5 UGSc 2 0 utun1
10.8.0.5 10.8.0.6 UHr 71 1 utun1
45.32.3.20/32 192.168.9.1 UGSc 2 0 en0
127 127.0.0.1 UCS 1 0 lo0
127.0.0.1 127.0.0.1 UH 5 44759 lo0
128.0/1 10.8.0.5 UGSc 36 0 utun1
192.168.9 link#6 UCS 9 0 en0
192.168.9.1/32 link#6 UCS 2 0 en0
192.168.9.1 d0:50:99:5c:dd:e7 UHLWIir 5 6052 en0 1170
192.168.9.2 3c:a8:2a:a0:50:dc UHLWIi 1 4260611 en0 1178
192.168.9.12 78:24:af:99:fd:af UHLWIi 3 24597 en0 1164
192.168.9.57 74:5e:1c:58:dc:9a UHLWIi 2 49 en0 1179
192.168.9.60/32 link#6 UCS 2 0 en0
192.168.9.60 ac:bc:32:87:c6:ed UHLWIi 1 12 lo0
192.168.9.71 b8:44:d9:cf:69:f9 UHLWIi 1 0 en0 559
192.168.9.74 0:90:a9:d5:aa:ba UHLWIi 1 80 en0 1178
192.168.9.199 link#6 UHLWIi 1 26849 en0
192.168.9.251 8:74:2:5:bf:46 UHLWIi 1 0 en0
192.168.9.255 link#6 UHLWbI 1 2865 en0
224.0.0/4 link#6 UmCS 3 0 en0
224.0.0.251 1:0:5e:0:0:fb UHmLWI 1 0 en0
239.255.255.250 1:0:5e:7f:ff:fa UHmLWI 1 2321 en0
255.255.255.255/32 link#6 UCS 2 0 en0
255.255.255.255 link#6 UHLWbI 1 1583 en0
Internet6:
Destination Gateway Flags Netif Expire
default fe80::%utun0 UGcI utun0
default fe80::%utun2 UGcI utun2
::1 ::1 UHL lo0
fe80::%lo0/64 fe80::1%lo0 UcI lo0
fe80::1%lo0 link#1 UHLI lo0
fe80::%awdl0/64 link#13 UCI awdl0
fe80::fc9c:f6ff:fe45:b908%awdl0 fe:9c:f6:45:b9:8 UHLI lo0
fe80::%utun0/64 fe80::a466:d455:8c91:9232%utun0 UcI utun0
fe80::a466:d455:8c91:9232%utun0 link#14 UHLI lo0
fe80::%utun2/64 fe80::3ccd:b9c5:5893:fcb6%utun2 UcI utun2
fe80::3ccd:b9c5:5893:fcb6%utun2 link#16 UHLI lo0
ff01::%lo0/32 ::1 UmCI lo0
ff01::%awdl0/32 link#13 UmCI awdl0
ff01::%utun0/32 fe80::a466:d455:8c91:9232%utun0 UmCI utun0
ff01::%utun2/32 fe80::3ccd:b9c5:5893:fcb6%utun2 UmCI utun2
ff02::%lo0/32 ::1 UmCI lo0
ff02::%awdl0/32 link#13 UmCI awdl0
ff02::%utun0/32 fe80::a466:d455:8c91:9232%utun0 UmCI utun0
ff02::%utun2/32 fe80::3ccd:b9c5:5893:fcb6%utun2 UmCI utun2
Even if i reboot my server and my Mac i still get the same issues. Any sort of help would be welcomed.
