[Resolved] From WAN: Connection from IOS works but not OSX

six50joe

Been struggling with this for 3 days now, my setup:

Rasbperry PI OpenVPN server -> Airport Extreme (WIFI / Bridge) -> TPLink router (used as outbound firewall) -> Cable modem -> Internet

- Config on my IPhone is identical to the one on my macbook, other than client cert/key.
- IPhone always connects, whether over cellular or locally on the LAN over WIFI.
- Macbook connects, but only if on the LAN (behind the TPLink router). Will not connect from over the internet.
- Same results on macbook using both Tunnelblick and Viscosity. Tunnelblick log shows that my domain name is being resolved to the correct IP addr.
- It appears that the macbook doesn't even reach the openvpn server, based on the openvpn log not updating, or anything else in /var/log for that matter. Other services like VNC sharing work fine.

On router and cable modem, forwarding 1194 UDP and TCP 443 to the server.

Based on the IPhone always connecting and the fact that I'm able to VNC to the pi, I'm assuming that I can rule out any firewall / network configuration issues. Is this a good assumption?

For iptables, this gets run on reboot:

iptables -t filter -F
iptables -t nat -F
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s "10.8.0.0/24" -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s "10.8.0.0/24" -j MASQUERADE

six50joe

I'll post logs if needed, the client config is:

client
dev tun
proto udp
remote <my domain name> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
comp-lzo
verb 6

I don't have the tunnelblick log at the moment, but the failure message contains:
P_CONTROL_HARD_RESET_CLIENT_V2 .... Software caused connection abort (code=53)

TinCanTech

Please see:
HOWTO: Request Help ! {2}

six50joe

Operating System:

$ uname -a
Linux raspberrypi 4.4.34-v7+ #930 SMP Wed Nov 23 15:20:41 GMT 2016 armv7l GNU/Linux

Network setup:

$ ifconfig
eth0      Link encap:Ethernet  HWaddr b8:27:eb:20:a3:49  
          inet6 addr: fe80::ea7e:de23:57ee:af28/64 Scope:Link
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:225 errors:0 dropped:0 overruns:0 frame:0
          TX packets:225 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:18520 (18.0 KiB)  TX bytes:18520 (18.0 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:248 errors:0 dropped:0 overruns:0 frame:0
          TX packets:50 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:20318 (19.8 KiB)  TX bytes:5589 (5.4 KiB)

wlan0     Link encap:Ethernet  HWaddr b8:27:eb:75:f6:1c  
          inet addr:192.168.0.101  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::ba4:1225:6e70:4fed/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:782483 errors:0 dropped:281109 overruns:0 frame:0
          TX packets:477067 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:165049903 (157.4 MiB)  TX bytes:116663590 (111.2 MiB)

port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/servername.crt
key /etc/openvpn/easy-rsa/keys/servername.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log-append /var/log/openvpn.log
verb 6 Server log- initialization only, since attempts do not reach server:

Mon Aug 28 16:38:46 2017 us=44095 OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 27 2017
Mon Aug 28 16:38:46 2017 us=44142 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.08
Mon Aug 28 16:38:46 2017 us=44743 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Mon Aug 28 16:38:46 2017 us=45926 Diffie-Hellman initialized with 1024 bit key
Mon Aug 28 16:38:46 2017 us=47585 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Aug 28 16:38:46 2017 us=47656 Socket Buffers: R=[163840->131072] S=[163840->131072]
Mon Aug 28 16:38:46 2017 us=47957 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=wlan0 HWADDR=b8:27:eb:75:f6:1c
Mon Aug 28 16:38:46 2017 us=49323 TUN/TAP device tun0 opened
Mon Aug 28 16:38:46 2017 us=49465 TUN/TAP TX queue length set to 100
Mon Aug 28 16:38:46 2017 us=49528 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Aug 28 16:38:46 2017 us=49603 /sbin/ip link set dev tun0 up mtu 1500
Mon Aug 28 16:38:46 2017 us=53511 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Mon Aug 28 16:38:46 2017 us=56902 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Mon Aug 28 16:38:46 2017 us=60043 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Aug 28 16:38:46 2017 us=61333 UDPv4 link local (bound): [undef]
Mon Aug 28 16:38:46 2017 us=61526 UDPv4 link remote: [undef]
Mon Aug 28 16:38:46 2017 us=61570 MULTI: multi_init called, r=256 v=256
Mon Aug 28 16:38:46 2017 us=61894 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Mon Aug 28 16:38:46 2017 us=61965 ifconfig_pool_read(), in='client1,10.8.0.4', TODO: IPv6
Mon Aug 28 16:38:46 2017 us=62052 succeeded -> ifconfig_pool_set()
Mon Aug 28 16:38:46 2017 us=62097 ifconfig_pool_read(), in='<device 1>,10.8.0.8', TODO: IPv6
Mon Aug 28 16:38:46 2017 us=62131 succeeded -> ifconfig_pool_set()
Mon Aug 28 16:38:46 2017 us=62165 ifconfig_pool_read(), in='<device 2>,10.8.0.12', TODO: IPv6
Mon Aug 28 16:38:46 2017 us=62198 succeeded -> ifconfig_pool_set()
Mon Aug 28 16:38:46 2017 us=62226 ifconfig_pool_read(), in='<device 3>,10.8.0.16', TODO: IPv6
Mon Aug 28 16:38:46 2017 us=62259 succeeded -> ifconfig_pool_set()
Mon Aug 28 16:38:46 2017 us=62291 ifconfig_pool_read(), in='<device 4>,10.8.0.20', TODO: IPv6
Mon Aug 28 16:38:46 2017 us=62319 succeeded -> ifconfig_pool_set()
Mon Aug 28 16:38:46 2017 us=62349 ifconfig_pool_read(), in='<device 5>', TODO: IPv6
Mon Aug 28 16:38:46 2017 us=62378 succeeded -> ifconfig_pool_set()
Mon Aug 28 16:38:46 2017 us=62415 IFCONFIG POOL LIST
Mon Aug 28 16:38:46 2017 us=62450 client1,10.8.0.4
Mon Aug 28 16:38:46 2017 us=62486 <device 1>,10.8.0.8
Mon Aug 28 16:38:46 2017 us=62520 <device 2>,10.8.0.12
Mon Aug 28 16:38:46 2017 us=62551 <device 3>,10.8.0.16
Mon Aug 28 16:38:46 2017 us=62581 <device 4>,10.8.0.20
Mon Aug 28 16:38:46 2017 us=62611 <device 5>,10.8.0.24
Mon Aug 28 16:38:46 2017 us=62710 Initialization Sequence Completed

CLIENT

OS: Sierra 10.2.2

client
dev tun
proto udp
<my domain> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
comp-lzo
verb 3

<cert / key inlined>
Tunnelblick (macbook client) conneciton log:

There are no unusual files in macbook.tblk

================================================================================

Configuration preferences:

useDNS = 1
-routeAllTrafficThroughVpn = 1
-openvpnVersion = 
-notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0
-loggingLevel = 4
-lastConnectionSucceeded = 0

================================================================================

Wildcard preferences:


================================================================================

Program preferences:

launchAtNextLogin = 1
notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0
askedUserIfOKToCheckThatIPAddressDidNotChangeAfterConnection = 1
tunnelblickVersionHistory = (
    "3.7.2 (build 4850)"
)
lastLaunchTime = 525696062.061326
lastLanguageAtLaunchWasRTL = 0
connectionWindowDisplayCriteria = showWhenConnecting
maxLogDisplaySize = 102400
lastConnectedDisplayName = macbook
keyboardShortcutIndex = 1
updateCheckAutomatically = 1
updateSendProfileInfo = 1
NSWindow Frame ConnectingWindow = 645 647 389 187 0 0 1680 1027 
detailsWindowFrameVersion = 4850
detailsWindowFrame = {{739, 236}, {920, 468}}
detailsWindowLeftFrame = {{0, 0}, {165, 350}}
detailsWindowViewIndex = 0
detailsWindowConfigurationsTabIdentifier = settings
leftNavSelectedDisplayName = macbook
AdvancedWindowTabIdentifier = connectingAndDisconnecting
haveDealtWithSparkle1dot5b6 = 1
haveDealtWithOldTunTapPreferences = 1
haveDealtWithOldLoginItem = 1
SUEnableAutomaticChecks = 1
SUScheduledCheckInterval = 86400
SUSendProfileInfo = 1
SULastCheckTime = 2017-08-29 10:41:32 +0000
SULastProfileSubmissionDate = 2017-08-28 20:39:45 +0000
SUHasLaunchedBefore = 1
WebKitDefaultFontSize = 16
WebKitStandardFont = Times

================================================================================

Tunnelblick Log:

*Tunnelblick: OS X 10.12.2; Tunnelblick 3.7.2 (build 4850)
2017-08-29 09:47:17 *Tunnelblick: Attempting connection with macbook; Set nameserver = 1025; monitoring connection
2017-08-29 09:47:17 *Tunnelblick: openvpnstart start macbook.tblk 1337 1025 0 3 0 1065776 -ptADGNWradsgnw 2.3.17-openssl-1.0.2k
2017-08-29 09:47:17 us=940251 Current Parameter Settings:
2017-08-29 09:47:17 us=940421   config = '/Library/Application Support/Tunnelblick/Shared/macbook.tblk/Contents/Resources/config.ovpn'
2017-08-29 09:47:17 us=940430   mode = 0
2017-08-29 09:47:17 us=940435   show_ciphers = DISABLED
2017-08-29 09:47:17 us=940440   show_digests = DISABLED
2017-08-29 09:47:17 us=940444   show_engines = DISABLED
2017-08-29 09:47:17 us=940449   genkey = DISABLED
2017-08-29 09:47:17 us=940454   key_pass_file = '[UNDEF]'
2017-08-29 09:47:17 us=940458   show_tls_ciphers = DISABLED
2017-08-29 09:47:17 us=940463 Connection profiles [default]:
2017-08-29 09:47:17 us=940470   proto = udp
2017-08-29 09:47:17 us=940475   local = '[UNDEF]'
2017-08-29 09:47:17 us=940479   local_port = 0
2017-08-29 09:47:17 us=940484   remote = '<my domain>'
2017-08-29 09:47:17 us=940489   remote_port = 1194
2017-08-29 09:47:17 us=940493   remote_float = DISABLED
2017-08-29 09:47:17 us=940498   bind_defined = DISABLED
2017-08-29 09:47:17 us=940502   bind_local = DISABLED
2017-08-29 09:47:17 us=940507   connect_retry_seconds = 5
2017-08-29 09:47:17 us=940512   connect_timeout = 10
2017-08-29 09:47:17 us=940516   connect_retry_max = 0
2017-08-29 09:47:17 us=940521   xormethod = 0
2017-08-29 09:47:17 us=940527   xormask = ''
2017-08-29 09:47:17 us=940532   xormasklen = 0
2017-08-29 09:47:17 us=940536   socks_proxy_server = '[UNDEF]'
2017-08-29 09:47:17 us=940541   socks_proxy_port = 0
2017-08-29 09:47:17 us=940545   socks_proxy_retry = DISABLED
2017-08-29 09:47:17 us=940550   tun_mtu = 1500
2017-08-29 09:47:17 us=940554   tun_mtu_defined = ENABLED
2017-08-29 09:47:17 us=940559   link_mtu = 1500
2017-08-29 09:47:17 us=940563   link_mtu_defined = DISABLED
2017-08-29 09:47:17 us=940568   tun_mtu_extra = 0
2017-08-29 09:47:17 us=940572   tun_mtu_extra_defined = DISABLED
2017-08-29 09:47:17 us=940577   mtu_discover_type = -1
2017-08-29 09:47:17 us=940581   fragment = 0
2017-08-29 09:47:17 us=940586   mssfix = 1450
2017-08-29 09:47:17 us=940590   explicit_exit_notification = 0
2017-08-29 09:47:17 us=940595 Connection profiles END
2017-08-29 09:47:17 us=940599   remote_random = DISABLED
2017-08-29 09:47:17 us=940604   ipchange = '[UNDEF]'
2017-08-29 09:47:17 us=940608   dev = 'tun'
2017-08-29 09:47:17 us=940613   dev_type = '[UNDEF]'
2017-08-29 09:47:17 us=940617   dev_node = '[UNDEF]'
2017-08-29 09:47:17 us=940622   lladdr = '[UNDEF]'
2017-08-29 09:47:17 us=940629   topology = 1
2017-08-29 09:47:17 us=940634   tun_ipv6 = DISABLED
2017-08-29 09:47:17 us=940638   ifconfig_local = '[UNDEF]'
2017-08-29 09:47:17 us=940643   ifconfig_remote_netmask = '[UNDEF]'
2017-08-29 09:47:17 us=940647   ifconfig_noexec = DISABLED
2017-08-29 09:47:17 us=940652   ifconfig_nowarn = DISABLED
2017-08-29 09:47:17 us=940656   ifconfig_ipv6_local = '[UNDEF]'
2017-08-29 09:47:17 us=940661   ifconfig_ipv6_netbits = 0
2017-08-29 09:47:17 us=940665   ifconfig_ipv6_remote = '[UNDEF]'
2017-08-29 09:47:17 us=940670   shaper = 0
2017-08-29 09:47:17 us=940674   mtu_test = 0
2017-08-29 09:47:17 us=940679   mlock = DISABLED
2017-08-29 09:47:17 us=940683   keepalive_ping = 0
2017-08-29 09:47:17 us=940688   keepalive_timeout = 0
2017-08-29 09:47:17 us=940692   inactivity_timeout = 0
2017-08-29 09:47:17 us=940696   ping_send_timeout = 0
2017-08-29 09:47:17 us=940701   ping_rec_timeout = 0
2017-08-29 09:47:17 us=940705   ping_rec_timeout_action = 0
2017-08-29 09:47:17 us=940710   ping_timer_remote = DISABLED
2017-08-29 09:47:17 us=940714   remap_sigusr1 = 0
2017-08-29 09:47:17 us=940719   persist_tun = ENABLED
2017-08-29 09:47:17 us=940723   persist_local_ip = DISABLED
2017-08-29 09:47:17 us=940728   persist_remote_ip = DISABLED
2017-08-29 09:47:17 us=940732   persist_key = ENABLED
2017-08-29 09:47:17 us=940743   passtos = DISABLED
2017-08-29 09:47:17 us=940748   resolve_retry_seconds = 1000000000
2017-08-29 09:47:17 us=940752   username = '[UNDEF]'
2017-08-29 09:47:17 us=940757   groupname = '[UNDEF]'
2017-08-29 09:47:17 us=940761   chroot_dir = '[UNDEF]'
2017-08-29 09:47:17 us=940766   cd_dir = '/Library/Application Support/Tunnelblick/Shared/macbook.tblk/Contents/Resources'
2017-08-29 09:47:17 us=940771   writepid = '[UNDEF]'
2017-08-29 09:47:17 us=940776   up_script = '/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw'
2017-08-29 09:47:17 us=940780   down_script = '/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw'
2017-08-29 09:47:17 us=940785   down_pre = DISABLED
2017-08-29 09:47:17 us=940789   up_restart = DISABLED
2017-08-29 09:47:17 us=940794   up_delay = DISABLED
2017-08-29 09:47:17 us=940800   daemon = ENABLED
2017-08-29 09:47:17 us=940805   inetd = 0
2017-08-29 09:47:17 us=940809   log = ENABLED
2017-08-29 09:47:17 us=940814   suppress_timestamps = DISABLED
2017-08-29 09:47:17 us=940818   nice = 0
2017-08-29 09:47:17 us=940823   verbosity = 4
2017-08-29 09:47:17 us=940827   mute = 0
2017-08-29 09:47:17 us=940832   status_file = '[UNDEF]'
2017-08-29 09:47:17 us=940836   status_file_version = 1
2017-08-29 09:47:17 us=940841   status_file_update_freq = 60
2017-08-29 09:47:17 us=940845   occ = ENABLED
2017-08-29 09:47:17 us=940850   rcvbuf = 0
2017-08-29 09:47:17 us=940854   sndbuf = 0
2017-08-29 09:47:17 us=940858   sockflags = 0
2017-08-29 09:47:17 us=940863   fast_io = DISABLED
2017-08-29 09:47:17 us=940867   lzo = 7
2017-08-29 09:47:17 us=940872   route_script = '[UNDEF]'
2017-08-29 09:47:17 us=940877   route_default_gateway = '[UNDEF]'
2017-08-29 09:47:17 us=940881   route_default_metric = 0
2017-08-29 09:47:17 us=940885   route_noexec = DISABLED
2017-08-29 09:47:17 us=940890   route_delay = 0
2017-08-29 09:47:17 us=940895   route_delay_window = 30
2017-08-29 09:47:17 us=940900   route_delay_defined = DISABLED
2017-08-29 09:47:17 us=940904   route_nopull = DISABLED
2017-08-29 09:47:17 us=940909   route_gateway_via_dhcp = DISABLED
2017-08-29 09:47:17 us=940914   max_routes = 100
2017-08-29 09:47:17 us=940918   allow_pull_fqdn = DISABLED
2017-08-29 09:47:17 us=940925   [redirect_default_gateway local=0]
2017-08-29 09:47:17 us=940930   management_addr = '127.0.0.1'
2017-08-29 09:47:17 us=940935   management_port = 1337
2017-08-29 09:47:17 us=940940   management_user_pass = '[UNDEF]'
2017-08-29 09:47:17 us=940944   management_log_history_cache = 250
2017-08-29 09:47:17 us=940949   management_echo_buffer_size = 100
2017-08-29 09:47:17 us=940954   management_write_peer_info_file = '[UNDEF]'
2017-08-29 09:47:17 us=940959   management_client_user = '[UNDEF]'
2017-08-29 09:47:17 us=940964   management_client_group = '[UNDEF]'
2017-08-29 09:47:17 us=940968   management_flags = 6
2017-08-29 09:47:17 us=940973   shared_secret_file = '[UNDEF]'
2017-08-29 09:47:17 us=940978   key_direction = 0
2017-08-29 09:47:17 us=940982   ciphername_defined = ENABLED
2017-08-29 09:47:17 us=940987   ciphername = 'BF-CBC'
2017-08-29 09:47:17 us=940992   authname_defined = ENABLED
2017-08-29 09:47:17 us=940997   authname = 'SHA1'
2017-08-29 09:47:17 us=941001   prng_hash = 'SHA1'
2017-08-29 09:47:17 us=941006   prng_nonce_secret_len = 16
2017-08-29 09:47:17 us=941011   keysize = 0
2017-08-29 09:47:17 us=941015   engine = DISABLED
2017-08-29 09:47:17 us=941020   replay = ENABLED
2017-08-29 09:47:17 us=941025   mute_replay_warnings = DISABLED
2017-08-29 09:47:17 us=941029   replay_window = 64
2017-08-29 09:47:17 us=941034   replay_time = 15
2017-08-29 09:47:17 us=941039   packet_id_file = '[UNDEF]'
2017-08-29 09:47:17 us=941048   use_iv = ENABLED
2017-08-29 09:47:17 us=941053   test_crypto = DISABLED
2017-08-29 09:47:17 us=941058   tls_server = DISABLED
2017-08-29 09:47:17 us=941063   tls_client = ENABLED
2017-08-29 09:47:17 us=941067   key_method = 2
2017-08-29 09:47:17 us=941072   ca_file = 'ca.crt'
2017-08-29 09:47:17 us=941077   ca_path = '[UNDEF]'
2017-08-29 09:47:17 us=941081   dh_file = '[UNDEF]'
2017-08-29 09:47:17 us=941086   cert_file = '<user>-macbook.crt'
2017-08-29 09:47:17 us=941090   extra_certs_file = '[UNDEF]'
2017-08-29 09:47:17 us=941095   priv_key_file = '<user>-macbook.key'
2017-08-29 09:47:17 us=941100   pkcs12_file = '[UNDEF]'
2017-08-29 09:47:17 us=941105   cipher_list = '[UNDEF]'
2017-08-29 09:47:17 us=941109   tls_verify = '[UNDEF]'
2017-08-29 09:47:17 us=941114   tls_export_cert = '[UNDEF]'
2017-08-29 09:47:17 us=941120   verify_x509_type = 0
2017-08-29 09:47:17 us=941125   verify_x509_name = '[UNDEF]'
2017-08-29 09:47:17 us=941130   crl_file = '[UNDEF]'
2017-08-29 09:47:17 us=941135   ns_cert_type = 1
2017-08-29 09:47:17 us=941139   remote_cert_ku[i] = 0
2017-08-29 09:47:17 us=941144   remote_cert_ku[i] = 0
2017-08-29 09:47:17 us=941149   remote_cert_ku[i] = 0
2017-08-29 09:47:17 us=941153   remote_cert_ku[i] = 0
2017-08-29 09:47:17 us=941158   remote_cert_ku[i] = 0
2017-08-29 09:47:17 us=941162   remote_cert_ku[i] = 0
2017-08-29 09:47:17 us=941167   remote_cert_ku[i] = 0
2017-08-29 09:47:17 us=941171   remote_cert_ku[i] = 0
2017-08-29 09:47:17 us=941176   remote_cert_ku[i] = 0
2017-08-29 09:47:17 us=941181   remote_cert_ku[i] = 0
2017-08-29 09:47:17 us=941185   remote_cert_ku[i] = 0
2017-08-29 09:47:17 us=941190   remote_cert_ku[i] = 0
2017-08-29 09:47:17 us=941194   remote_cert_ku[i] = 0
2017-08-29 09:47:17 us=941199   remote_cert_ku[i] = 0
2017-08-29 09:47:17 us=941203   remote_cert_ku[i] = 0
2017-08-29 09:47:17 us=941208   remote_cert_ku[i] = 0
2017-08-29 09:47:17 us=941212   remote_cert_eku = '[UNDEF]'
2017-08-29 09:47:17 us=941217   ssl_flags = 0
2017-08-29 09:47:17 us=941221   tls_timeout = 2
2017-08-29 09:47:17 us=941226   renegotiate_bytes = -1
2017-08-29 09:47:17 us=941231   renegotiate_packets = 0
2017-08-29 09:47:17 us=941236   renegotiate_seconds = 3600
2017-08-29 09:47:17 us=941240   handshake_window = 60
2017-08-29 09:47:17 us=941245   transition_window = 3600
2017-08-29 09:47:17 us=941250   single_session = DISABLED
2017-08-29 09:47:17 us=941254   push_peer_info = DISABLED
2017-08-29 09:47:17 us=941259   tls_exit = DISABLED
2017-08-29 09:47:17 us=941264   tls_auth_file = '[UNDEF]'
2017-08-29 09:47:17 us=941268   pkcs11_protected_authentication = DISABLED
2017-08-29 09:47:17 us=941273   pkcs11_protected_authentication = DISABLED
2017-08-29 09:47:17 us=941278   pkcs11_protected_authentication = DISABLED
2017-08-29 09:47:17 us=941283   pkcs11_protected_authentication = DISABLED
2017-08-29 09:47:17 us=941287   pkcs11_protected_authentication = DISABLED
2017-08-29 09:47:17 us=941292   pkcs11_protected_authentication = DISABLED
2017-08-29 09:47:17 us=941297   pkcs11_protected_authentication = DISABLED
2017-08-29 09:47:17 us=941302   pkcs11_protected_authentication = DISABLED
2017-08-29 09:47:17 us=941306   pkcs11_protected_authentication = DISABLED
2017-08-29 09:47:17 us=941311   pkcs11_protected_authentication = DISABLED
2017-08-29 09:47:17 us=941316   pkcs11_protected_authentication = DISABLED
2017-08-29 09:47:17 us=941321   pkcs11_protected_authentication = DISABLED
2017-08-29 09:47:17 us=941325   pkcs11_protected_authentication = DISABLED
2017-08-29 09:47:17 us=941330   pkcs11_protected_authentication = DISABLED
2017-08-29 09:47:17 us=941335   pkcs11_protected_authentication = DISABLED
2017-08-29 09:47:17 us=941339   pkcs11_protected_authentication = DISABLED
2017-08-29 09:47:17 us=941349   pkcs11_private_mode = 00000000
2017-08-29 09:47:17 us=941354   pkcs11_private_mode = 00000000
2017-08-29 09:47:17 us=941359   pkcs11_private_mode = 00000000
2017-08-29 09:47:17 us=941364   pkcs11_private_mode = 00000000
2017-08-29 09:47:17 us=941369   pkcs11_private_mode = 00000000
2017-08-29 09:47:17 us=941373   pkcs11_private_mode = 00000000
2017-08-29 09:47:17 us=941378   pkcs11_private_mode = 00000000
2017-08-29 09:47:17 us=941383   pkcs11_private_mode = 00000000
2017-08-29 09:47:17 us=941387   pkcs11_private_mode = 00000000
2017-08-29 09:47:17 us=941392   pkcs11_private_mode = 00000000
2017-08-29 09:47:17 us=941397   pkcs11_private_mode = 00000000
2017-08-29 09:47:17 us=941401   pkcs11_private_mode = 00000000
2017-08-29 09:47:17 us=941406   pkcs11_private_mode = 00000000
2017-08-29 09:47:17 us=941411   pkcs11_private_mode = 00000000
2017-08-29 09:47:17 us=941415   pkcs11_private_mode = 00000000
2017-08-29 09:47:17 us=941420   pkcs11_private_mode = 00000000
2017-08-29 09:47:17 us=941425   pkcs11_cert_private = DISABLED
2017-08-29 09:47:17 us=941429   pkcs11_cert_private = DISABLED
2017-08-29 09:47:17 us=941434   pkcs11_cert_private = DISABLED
2017-08-29 09:47:17 us=941438   pkcs11_cert_private = DISABLED
2017-08-29 09:47:17 us=941443   pkcs11_cert_private = DISABLED
2017-08-29 09:47:17 us=941448   pkcs11_cert_private = DISABLED
2017-08-29 09:47:17 us=941452   pkcs11_cert_private = DISABLED
2017-08-29 09:47:17 us=941457   pkcs11_cert_private = DISABLED
2017-08-29 09:47:17 us=941461   pkcs11_cert_private = DISABLED
2017-08-29 09:47:17 us=941466   pkcs11_cert_private = DISABLED
2017-08-29 09:47:17 us=941471   pkcs11_cert_private = DISABLED
2017-08-29 09:47:17 us=941475   pkcs11_cert_private = DISABLED
2017-08-29 09:47:17 us=941480   pkcs11_cert_private = DISABLED
2017-08-29 09:47:17 us=941485   pkcs11_cert_private = DISABLED
2017-08-29 09:47:17 us=941489   pkcs11_cert_private = DISABLED
2017-08-29 09:47:17 us=941494   pkcs11_cert_private = DISABLED
2017-08-29 09:47:17 us=941499   pkcs11_pin_cache_period = -1
2017-08-29 09:47:17 us=941503   pkcs11_id = '[UNDEF]'
2017-08-29 09:47:17 us=941512   pkcs11_id_management = DISABLED
2017-08-29 09:47:17 us=941530   server_network = 0.0.0.0
2017-08-29 09:47:17 us=941536   server_netmask = 0.0.0.0
2017-08-29 09:47:17 us=941552   server_network_ipv6 = ::
2017-08-29 09:47:17 us=941557   server_netbits_ipv6 = 0
2017-08-29 09:47:17 us=941562   server_bridge_ip = 0.0.0.0
2017-08-29 09:47:17 us=941568   server_bridge_netmask = 0.0.0.0
2017-08-29 09:47:17 us=941573   server_bridge_pool_start = 0.0.0.0
2017-08-29 09:47:17 us=941578   server_bridge_pool_end = 0.0.0.0
2017-08-29 09:47:17 us=941583   ifconfig_pool_defined = DISABLED
2017-08-29 09:47:17 us=941588   ifconfig_pool_start = 0.0.0.0
2017-08-29 09:47:17 us=941594   ifconfig_pool_end = 0.0.0.0
2017-08-29 09:47:17 us=941599   ifconfig_pool_netmask = 0.0.0.0
2017-08-29 09:47:17 us=941604   ifconfig_pool_persist_filename = '[UNDEF]'
2017-08-29 09:47:17 us=941609   ifconfig_pool_persist_refresh_freq = 600
2017-08-29 09:47:17 us=941614   ifconfig_ipv6_pool_defined = DISABLED
2017-08-29 09:47:17 us=941619   ifconfig_ipv6_pool_base = ::
2017-08-29 09:47:17 us=941624   ifconfig_ipv6_pool_netbits = 0
2017-08-29 09:47:17 us=941629   n_bcast_buf = 256
2017-08-29 09:47:17 us=941633   tcp_queue_limit = 64
2017-08-29 09:47:17 us=941638   real_hash_size = 256
2017-08-29 09:47:17 us=941643   virtual_hash_size = 256
2017-08-29 09:47:17 us=941648   client_connect_script = '[UNDEF]'
2017-08-29 09:47:17 us=941653   learn_address_script = '[UNDEF]'
2017-08-29 09:47:17 us=941657   client_disconnect_script = '[UNDEF]'
2017-08-29 09:47:17 us=941662   client_config_dir = '[UNDEF]'
2017-08-29 09:47:17 us=941669   ccd_exclusive = DISABLED
2017-08-29 09:47:17 us=941679   tmp_dir = '/var/folders/0n/55gzr7354j53vzbgfrtv7c5m0000gn/T/'
2017-08-29 09:47:17 us=941687   push_ifconfig_defined = DISABLED
2017-08-29 09:47:17 us=941692   push_ifconfig_local = 0.0.0.0
2017-08-29 09:47:17 us=941698   push_ifconfig_remote_netmask = 0.0.0.0
2017-08-29 09:47:17 us=941703   push_ifconfig_ipv6_defined = DISABLED
2017-08-29 09:47:17 us=941708   push_ifconfig_ipv6_local = ::/0
2017-08-29 09:47:17 us=941713   push_ifconfig_ipv6_remote = ::
2017-08-29 09:47:17 us=941718   enable_c2c = DISABLED
2017-08-29 09:47:17 us=941722   duplicate_cn = DISABLED
2017-08-29 09:47:17 us=941727   cf_max = 0
2017-08-29 09:47:17 us=941732   cf_per = 0
2017-08-29 09:47:17 us=941737   max_clients = 1024
2017-08-29 09:47:17 us=941742   max_routes_per_client = 256
2017-08-29 09:47:17 us=941746   auth_user_pass_verify_script = '[UNDEF]'
2017-08-29 09:47:17 us=941751   auth_user_pass_verify_script_via_file = DISABLED
2017-08-29 09:47:17 us=941756   port_share_host = '[UNDEF]'
2017-08-29 09:47:17 us=941761   port_share_port = 0
2017-08-29 09:47:17 us=941766   client = ENABLED
2017-08-29 09:47:17 us=941770   pull = ENABLED
2017-08-29 09:47:17 us=941775   auth_user_pass_file = '[UNDEF]'
2017-08-29 09:47:17 us=941782 OpenVPN 2.3.17 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Aug 17 2017
2017-08-29 09:47:17 us=941791 library versions: OpenSSL 1.0.2k  26 Jan 2017, LZO 2.09
2017-08-29 09:47:17 us=942951 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
2017-08-29 09:47:17 us=943118 Need hold release from management interface, waiting...
2017-08-29 09:47:17 *Tunnelblick: openvpnstart starting OpenVPN
2017-08-29 09:47:18 *Tunnelblick: openvpnstart log:
     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
     
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.17-openssl-1.0.2k/openvpn
          --daemon
          --log
          /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-Smacbook.tblk-SContents-SResources-Sconfig.ovpn.1025_0_3_0_1065776.1337.openvpn.log
          --cd
          /Library/Application Support/Tunnelblick/Shared/macbook.tblk/Contents/Resources
          --verb
          4
          --config
          /Library/Application Support/Tunnelblick/Shared/macbook.tblk/Contents/Resources/config.ovpn
          --verb
          4
          --cd
          /Library/Application Support/Tunnelblick/Shared/macbook.tblk/Contents/Resources
          --management
          127.0.0.1
          1337
          --management-query-passwords
          --management-hold
          --redirect-gateway
          def1
          --script-security
          2
          --up
          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
          --down
          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw

2017-08-29 09:47:18 *Tunnelblick: Established communication with OpenVPN
2017-08-29 09:47:18 us=342514 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2017-08-29 09:47:18 us=375401 MANAGEMENT: CMD 'pid'
2017-08-29 09:47:18 us=375553 MANAGEMENT: CMD 'state on'
2017-08-29 09:47:18 us=375628 MANAGEMENT: CMD 'state'
2017-08-29 09:47:18 us=375712 MANAGEMENT: CMD 'bytecount 1'
2017-08-29 09:47:18 us=375780 MANAGEMENT: CMD 'hold release'
2017-08-29 09:47:18 us=376014 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2017-08-29 09:47:18 us=376855 LZO compression initialized
2017-08-29 09:47:18 us=376994 Control Channel MTU parms [ L:1542 D:1212 EF:38 EB:0 ET:0 EL:3 ]
2017-08-29 09:47:18 us=377107 Socket Buffers: R=[196724->196724] S=[9216->9216]
2017-08-29 09:47:18 us=377175 MANAGEMENT: >STATE:1504014438,RESOLVE,,,
2017-08-29 09:47:19 us=645726 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
2017-08-29 09:47:19 us=646028 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
2017-08-29 09:47:19 us=646235 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
2017-08-29 09:47:19 us=646382 Local Options hash (VER=V4): '41690919'
2017-08-29 09:47:19 us=646986 Expected Remote Options hash (VER=V4): '530fdded'
2017-08-29 09:47:19 us=647129 UDPv4 link local: [undef]
2017-08-29 09:47:19 us=647220 UDPv4 link remote: [AF_INET]<my public IP addr>:1194
2017-08-29 09:47:19 us=647330 MANAGEMENT: >STATE:1504014439,WAIT,,,
2017-08-29 09:47:19 us=647568 write UDPv4: Software caused connection abort (code=53)
2017-08-29 09:47:21 us=795918 write UDPv4: Software caused connection abort (code=53)
2017-08-29 09:47:26 us=36786 write UDPv4: Software caused connection abort (code=53)
2017-08-29 09:47:34 us=74444 write UDPv4: Software caused connection abort (code=53)

TinCanTech

six50joe wroteServer log- initialization only, since attempts do not reach server

Indeed .. due to this:

six50joe wroteTunnelblick (macbook client) conneciton log:

2017-08-29 09:47:19 us=647129 UDPv4 link local: [undef]
2017-08-29 09:47:19 us=647220 UDPv4 link remote: [AF_INET]<my public IP addr>:1194
2017-08-29 09:47:19 us=647330 MANAGEMENT: >STATE:1504014439,WAIT,,,
2017-08-29 09:47:19 us=647568 write UDPv4: Software caused connection abort (code=53)

I presume your client is using IPv4 not IPv6 when outside of your LAN ?

six50joe

Yes, definitely IP4. I don't think I follow what the problem is yet- is it that link local is undefined? link remote has the correct public IP. if so, where would be the missing part of of my configuration?

TinCanTech

Do you get the same error if you connect to your TCP:443 server ?

six50joe

When I switch the server and client conf over to 'proto tcp', still not reaching the server. The log looks like this:

2017-08-29 14:56:53 *Tunnelblick: openvpnstart starting OpenVPN

*Tunnelblick: OS X 10.12.2; Tunnelblick 3.7.2 (build 4850)

2017-08-29 14:56:53 *Tunnelblick: Attempting connection with macbook; Set nameserver = 769; monitoring connection

2017-08-29 14:56:53 *Tunnelblick: openvpnstart start macbook.tblk 1337 769 0 3 0 1065264 -ptADGNWradsgnw 2.3.17-openssl-1.0.2k

2017-08-29 14:56:54 *Tunnelblick: openvpnstart log:

     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):

     

          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.17-openssl-1.0.2k/openvpn

          --daemon

          --log

          /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-Smacbook.tblk-SContents-SResources-Sconfig.ovpn.769_0_3_0_1065264.1337.openvpn.log

          --cd

          /Library/Application Support/Tunnelblick/Shared/macbook.tblk/Contents/Resources

          --verb

          3

          --config

          /Library/Application Support/Tunnelblick/Shared/macbook.tblk/Contents/Resources/config.ovpn

          --verb

          3

          --cd

          /Library/Application Support/Tunnelblick/Shared/macbook.tblk/Contents/Resources

          --management

          127.0.0.1

          1337

          --management-query-passwords

          --management-hold

          --script-security

          2

          --up

          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw

          --down

          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw



2017-08-29 14:56:53 OpenVPN 2.3.17 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Aug 17 2017

2017-08-29 14:56:53 library versions: OpenSSL 1.0.2k  26 Jan 2017, LZO 2.09

2017-08-29 14:56:53 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337

2017-08-29 14:56:53 Need hold release from management interface, waiting...

2017-08-29 14:56:54 *Tunnelblick: Established communication with OpenVPN

2017-08-29 14:56:54 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337

2017-08-29 14:56:54 MANAGEMENT: CMD 'pid'

2017-08-29 14:56:54 MANAGEMENT: CMD 'state on'

2017-08-29 14:56:54 MANAGEMENT: CMD 'state'

2017-08-29 14:56:54 MANAGEMENT: CMD 'bytecount 1'

2017-08-29 14:56:54 MANAGEMENT: CMD 'hold release'

2017-08-29 14:56:54 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2017-08-29 14:56:54 Socket Buffers: R=[131072->131072] S=[131072->131072]

2017-08-29 14:56:54 MANAGEMENT: >STATE:1504033014,RESOLVE,,,

2017-08-29 14:56:54 Attempting to establish TCP connection with [AF_INET]<my public IP>:1194 [nonblock]

2017-08-29 14:56:54 MANAGEMENT: >STATE:1504033014,TCP_CONNECT,,,

2017-08-29 14:56:54 TCP: connect to [AF_INET]<my public IP>:1194 failed, will try again in 5 seconds: Software caused connection abort

2017-08-29 14:56:59 MANAGEMENT: >STATE:1504033019,RESOLVE,,,

2017-08-29 14:56:59 MANAGEMENT: >STATE:1504033019,TCP_CONNECT,,,

2017-08-29 14:56:59 TCP: connect to [AF_INET]<my public IP>:1194 failed, will try again in 5 seconds: Software caused connection abort

2017-08-29 14:57:04 MANAGEMENT: >STATE:1504033024,RESOLVE,,,

2017-08-29 14:57:04 MANAGEMENT: >STATE:1504033024,TCP_CONNECT,,,

....

six50joe

Oops, forgot to change the port. I will try that and report back....

six50joe

Log looks the same, just substitute :1194 with :443

TinCanTech

My first impression is that the remote network is blocking you .. can you verify that ?

six50joe

That had been my original guess as well since my IPhone connects over my LTE service. For my macbook I'm using a mobile hotspot from the same carrier.
However, when I tether my macbook to the IPhone, which obviously would put it on the same network, it still doesn't connect with the same error. I would think that rules out any network issues, especially since other services besides openvpn on the same host work without issue.

I've been trying to imagine a setting in OSX itself that would be interfering with the outgoing client connection. Seems unlikely.

six50joe

I've been trying to imagine a setting in OSX itself that would be interfering with the outgoing client connection. Seems unlikely.

Just after writing and posting this, I finally figured out what it was; and I feel like an idiot. :roll: In order to keep my macbook from accidentally burning through all the data on my hotspot plan, I run a background app called 'TripMode' that limits internet connectivity to only the apps you choose. (I have it set to allow everything when on my home wifi) All the while I was tinkering with this connection I forgot that I never enabled Tunnelblick. Once I did, connected immediately.

Thanks much for your help TMT, sorry if I have wasted your time trying to help.

TinCanTech

six50joe wrotesorry if I have wasted your time trying to help

No problem 😃

You put all the work into documenting your problem after reading the howto request help.
(not an easy read I understand 😉 )

Except for this:
six50joe wroteLast edited by ecrist on 2017 Aug 29 : 14:47, edited 1 time in total.
Reason: used [oconf] tags for client/server configurations

I do not have access to Mac or Tunnelblick so helping others I can learn. :mrgreen:

And you even solved the problem, which is always a good result. 8-)

six50joe wrote In order to keep my macbook from accidentally burning through all the data on my hotspot plan, I run a background app called 'TripMode' that limits internet connectivity to only the apps you choose.

Thanks for letting us know your solution .. it is good to know openvpn works for you.