Arch openvpn server works but has routing problem - no LAN or internet. Have already tried usual solutions

jimdoe

Hi I’ve installed the openvpn package on my aarch64 rpi3, and have it setup as a server. However, I am experiencing the exact same issues as described in this thread https://archlinuxarm.org/forum/viewtopic.php?f=31&t=9283 however the solutions provided and referenced there haved not worked for me.

The server starts correctly using a systemd service. What’s more, I can connect to the server from the internet outside the LAN, and I can ping the vpn server address, as well as the LAN ip address of the server. I can even access the pi via ssh through the VPN when outside the LAN. So the VPN tunnel is working fine. I just can’t ping any other devices on the lan or access the internet. What's strange is that, even though I can ping the pi and access the ssh server, I can’t access a web server that is running on the pi through a browser.

At any rate, I’m assuming it must be a routing issue? But I have read then man, I have entered

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

and have also read lots of other threads with similar issues, but none seem to work. So now I’m at bit of a lost as to what to try next.

iptables-save outputs the following:

# Generated by iptables-save v1.6.2 on Sun May 20 13:12:01 2018
*filter
:INPUT ACCEPT [12075:9348318]
:FORWARD ACCEPT [1716:187730]
:OUTPUT ACCEPT [7476:643730]
COMMIT
# Completed on Sun May 20 13:12:01 2018
# Generated by iptables-save v1.6.2 on Sun May 20 13:12:01 2018
*nat
:PREROUTING ACCEPT [1304:187835]
:INPUT ACCEPT [951:165405]
:OUTPUT ACCEPT [41:2791]
:POSTROUTING ACCEPT [3:121]
-A POSTROUTING -s 192.168.150.0/24 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Sun May 20 13:12:01 2018
# Generated by iptables-save v1.6.2 on Sun May 20 13:12:01 2018
*mangle
:PREROUTING ACCEPT [13875:9543188]
:INPUT ACCEPT [12155:9354706]
:FORWARD ACCEPT [1716:187730]
:OUTPUT ACCEPT [7563:651330]
:POSTROUTING ACCEPT [9285:839372]
COMMIT
# Completed on Sun May 20 13:12:01 2018
# Generated by iptables-save v1.6.2 on Sun May 20 13:12:01 2018
*raw
:PREROUTING ACCEPT [13875:9543188]
:OUTPUT ACCEPT [7568:652014]
COMMIT
# Completed on Sun May 20 13:12:01 2018

/etc/systemd/network/et0.network outputs

[Match]
Name=eth0

[Network]
DHCP=yes
IPForward=yes
IPMasquerade=yes

sysctl -a | grep forwarding | grep ipv4

net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.eth0.mc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.tun0.forwarding = 1
net.ipv4.conf.tun0.mc_forwarding = 0

dev tun
proto udp4
port 1198
reneg-sec 72000
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/server_*.crt
key /etc/openvpn/pki/server_*.key
dh none
ecdh-curve brainpoolP384r1
tls-crypt /etc/openvpn/pki/ta.key
tls-version-min 1.2
cipher AES-256-CBC
auth SHA256
ncp-ciphers AES-256-GCM
compress lz4-v2
user nobody
group nogroup
topology subnet
server 10.8.0.0 255.255.255.0
push "dhcp-option DNS 196.168.150.62"
push "redirect-gateway def1"
push "route 192.168.150.0 255.255.255.0"
keepalive 15 60
remote-cert-tls client
persist-key
persist-tun
float
status /var/log/openvpn-status.log 20
status-version 3
log /var/log/openvpn.log
verb 3

Any help would be greatly appreciated

TinCanTech

What is the output from ifconfig (or ip link) ?

jimdoe

TinCanTech wrote What is the output from ifconfig (or ip link) ?

$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.150.62  netmask 255.255.255.0  broadcast 192.168.150.255
        inet6 fe80::ba27:ebff:fedd:7f4b  prefixlen 64  scopeid 0x20<link>
        ether b8:27:eb:dd:7f:4b  txqueuelen 1000  (Ethernet)
        RX packets 939  bytes 125493 (122.5 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 131  bytes 22263 (21.7 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 20  bytes 1668 (1.6 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 20  bytes 1668 (1.6 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.1  netmask 255.255.255.0  destination 10.8.0.1
        inet6 fe80::b1e7:17d8:16f6:b490  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 781  bytes 53821 (52.5 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 79  bytes 8633 (8.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

$ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether b8:27:eb:dd:7f:4b brd ff:ff:ff:ff:ff:ff
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN mode DEFAULT group default qlen 100
    link/none

TinCanTech

OK .. so your masquerade rules should be working .. you need to use tcpdump to verify that packets from your client, when exiting to the server LAN, are properly masqueraded ..

Also, to my knowledge, this does not work yet:

jimdoe wrote dh none
ecdh-curve brainpoolP384r1

So please post your server and client log at verb 4 (remove private data), see an example here:
HOWTO: Request Help ! {2}

jimdoe

TinCanTech wrote OK .. so your masquerade rules should be working .. you need to use tcpdump to verify that packets from your client, when exiting to the server LAN, are properly masqueraded ..

Also, to my knowledge, this does not work yet:
jimdoe wrote dh none
ecdh-curve brainpoolP384r1
So please post your server and client log at verb 4 (remove private data), see an example here:
HOWTO: Request Help ! {2}

Server Initialising log:

Current Parameter Settings:
  config = 'server.conf'
  mode = 1
  persist_config = DISABLED
  persist_mode = 1
  show_ciphers = DISABLED
  show_digests = DISABLED
  show_engines = DISABLED
  genkey = DISABLED
  key_pass_file = '[UNDEF]'
  show_tls_ciphers = DISABLED
  connect_retry_max = 0
Connection profiles [0]:
  proto = udp4
  local = '[UNDEF]'
  local_port = '*'
  remote = '[UNDEF]'
  remote_port = '*'
  remote_float = ENABLED
  bind_defined = DISABLED
  bind_local = ENABLED
  bind_ipv6_only = DISABLED
  connect_retry_seconds = 5
  connect_timeout = 120
  socks_proxy_server = '[UNDEF]'
  socks_proxy_port = '[UNDEF]'
  tun_mtu = 1500
  tun_mtu_defined = ENABLED
  link_mtu = 1500
  link_mtu_defined = DISABLED
  tun_mtu_extra = 0
  tun_mtu_extra_defined = DISABLED
  mtu_discover_type = -1
  fragment = 0
  mssfix = 1450
  explicit_exit_notification = 0
Connection profiles END
  remote_random = DISABLED
  ipchange = '[UNDEF]'
  dev = 'tun'
  dev_type = '[UNDEF]'
  dev_node = '[UNDEF]'
  lladdr = '[UNDEF]'
  topology = 3
  ifconfig_local = '10.8.0.1'
  ifconfig_remote_netmask = '255.255.255.0'
  ifconfig_noexec = DISABLED
  ifconfig_nowarn = DISABLED
  ifconfig_ipv6_local = '[UNDEF]'
  ifconfig_ipv6_netbits = 0
  ifconfig_ipv6_remote = '[UNDEF]'
  shaper = 0
  mtu_test = 0
  mlock = DISABLED
  keepalive_ping = 15
  keepalive_timeout = 60
  inactivity_timeout = 0
  ping_send_timeout = 15
  ping_rec_timeout = 120
  ping_rec_timeout_action = 2
  ping_timer_remote = DISABLED
  remap_sigusr1 = 0
  persist_tun = ENABLED
  persist_local_ip = DISABLED
  persist_remote_ip = DISABLED
  persist_key = ENABLED
  passtos = DISABLED
  resolve_retry_seconds = 1000000000
  resolve_in_advance = DISABLED
  username = 'nobody'
  groupname = 'nogroup'
  chroot_dir = '[UNDEF]'
  cd_dir = '[UNDEF]'
  writepid = '[UNDEF]'
  up_script = '[UNDEF]'
  down_script = '[UNDEF]'
  down_pre = DISABLED
  up_restart = DISABLED
  up_delay = DISABLED
  daemon = DISABLED
  inetd = 0
  log = ENABLED
  suppress_timestamps = ENABLED
  machine_readable_output = DISABLED
  nice = 0
  verbosity = 4
  mute = 0
  gremlin = 0
  status_file = '/var/log/openvpn-status.log'
  status_file_version = 3
  status_file_update_freq = 20
  occ = ENABLED
  rcvbuf = 0
  sndbuf = 0
  mark = 0
  sockflags = 0
  fast_io = DISABLED
  comp.alg = 11
  comp.flags = 0
  route_script = '[UNDEF]'
  route_default_gateway = '10.8.0.2'
  route_default_metric = 0
  route_noexec = DISABLED
  route_delay = 0
  route_delay_window = 30
  route_delay_defined = DISABLED
  route_nopull = DISABLED
  route_gateway_via_dhcp = DISABLED
  allow_pull_fqdn = DISABLED
  management_addr = '[UNDEF]'
  management_port = '[UNDEF]'
  management_user_pass = '[UNDEF]'
  management_log_history_cache = 250
  management_echo_buffer_size = 100
  management_write_peer_info_file = '[UNDEF]'
  management_client_user = '[UNDEF]'
  management_client_group = '[UNDEF]'
  management_flags = 0
  shared_secret_file = '[UNDEF]'
  key_direction = not set
  ciphername = 'AES-256-CBC'
  ncp_enabled = ENABLED
  ncp_ciphers = 'AES-256-GCM'
  authname = 'SHA256'
  prng_hash = 'SHA1'
  prng_nonce_secret_len = 16
  keysize = 0
  engine = DISABLED
  replay = ENABLED
  mute_replay_warnings = DISABLED
  replay_window = 64
  replay_time = 15
  packet_id_file = '[UNDEF]'
  use_iv = ENABLED
  test_crypto = DISABLED
  tls_server = ENABLED
  tls_client = DISABLED
  key_method = 2
  ca_file = '/etc/openvpn/pki/ca.crt'
  ca_path = '[UNDEF]'
  dh_file = '[UNDEF]'
  cert_file = '/etc/openvpn/pki/server_*.crt'
  extra_certs_file = '[UNDEF]'
  priv_key_file = '/etc/openvpn/pki/server_*.key'
  pkcs12_file = '[UNDEF]'
  cipher_list = '[UNDEF]'
  tls_cert_profile = '[UNDEF]'
  tls_verify = '[UNDEF]'
  tls_export_cert = '[UNDEF]'
  verify_x509_type = 0
  verify_x509_name = '[UNDEF]'
  crl_file = '[UNDEF]'
  ns_cert_type = 0
  remote_cert_ku[i] = 65535
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_eku = 'TLS Web Client Authentication'
  ssl_flags = 192
  tls_timeout = 2
  renegotiate_bytes = -1
  renegotiate_packets = 0
  renegotiate_seconds = 72000
  handshake_window = 60
  transition_window = 3600
  single_session = DISABLED
  push_peer_info = DISABLED
  tls_exit = DISABLED
  tls_auth_file = '[UNDEF]'
  tls_crypt_file = '/etc/openvpn/pki/ta.key'
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_pin_cache_period = -1
  pkcs11_id = '[UNDEF]'
  pkcs11_id_management = DISABLED
  server_network = 10.8.0.0
  server_netmask = 255.255.255.0
  server_network_ipv6 = ::
  server_netbits_ipv6 = 0
  server_bridge_ip = 0.0.0.0
  server_bridge_netmask = 0.0.0.0
  server_bridge_pool_start = 0.0.0.0
  server_bridge_pool_end = 0.0.0.0
  push_entry = 'dhcp-option DNS 196.168.150.1'
  push_entry = 'route 192.168.150.0 255.255.255.0 vpn_gateway 500'
  push_entry = 'redirect-gateway def1'
  push_entry = 'route-gateway 10.8.0.1'
  push_entry = 'topology subnet'
  push_entry = 'ping 15'
  push_entry = 'ping-restart 60'
  ifconfig_pool_defined = ENABLED
  ifconfig_pool_start = 10.8.0.2
  ifconfig_pool_end = 10.8.0.253
  ifconfig_pool_netmask = 255.255.255.0
  ifconfig_pool_persist_filename = '[UNDEF]'
  ifconfig_pool_persist_refresh_freq = 600
  ifconfig_ipv6_pool_defined = DISABLED
  ifconfig_ipv6_pool_base = ::
  ifconfig_ipv6_pool_netbits = 0
  n_bcast_buf = 256
  tcp_queue_limit = 64
  real_hash_size = 256
  virtual_hash_size = 256
  client_connect_script = '[UNDEF]'
  learn_address_script = '[UNDEF]'
  client_disconnect_script = '[UNDEF]'
  client_config_dir = '[UNDEF]'
  ccd_exclusive = DISABLED
  tmp_dir = '/tmp'
  push_ifconfig_defined = DISABLED
  push_ifconfig_local = 0.0.0.0
  push_ifconfig_remote_netmask = 0.0.0.0
  push_ifconfig_ipv6_defined = DISABLED
  push_ifconfig_ipv6_local = ::/0
  push_ifconfig_ipv6_remote = ::
  enable_c2c = ENABLED
  duplicate_cn = DISABLED
  cf_max = 0
  cf_per = 0
  max_clients = 1024
  max_routes_per_client = 256
  auth_user_pass_verify_script = '[UNDEF]'
  auth_user_pass_verify_script_via_file = DISABLED
  auth_token_generate = DISABLED
  auth_token_lifetime = 0
  port_share_host = '[UNDEF]'
  port_share_port = '[UNDEF]'
  client = DISABLED
  pull = DISABLED
  auth_user_pass_file = '[UNDEF]'
OpenVPN 2.4.6 aarch64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 26 2018
library versions: OpenSSL 1.1.0h  27 Mar 2018, LZO 2.10
ECDH curve brainpoolP384r1 added
Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
TLS-Auth MTU parms [ L:1622 D:1156 EF:94 EB:0 ET:0 EL:3 ]
TUN/TAP device tun0 opened
TUN/TAP TX queue length set to 100
do_ifconfig, tt->did_ifconfig_ipv6_setup=0
/usr/bin/ip link set dev tun0 up mtu 1500
/usr/bin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Socket Buffers: R=[229376->229376] S=[229376->229376]
UDPv4 link local (bound): [AF_INET][undef]:*
UDPv4 link remote: [AF_UNSPEC]
GID set to nogroup
UID set to nobody
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Initialization Sequence Completed

Server log, verb 4, upon client connection:

MULTI: multi_create_instance called
***:* Re-using SSL/TLS context
***:* LZ4v2 compression initializing
***:* Control Channel MTU parms [ L:1622 D:1156 EF:94 EB:0 ET:0 EL:3 ]
***:* Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
***:* Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-server'
***:63073 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-client'
***:* TLS: Initial packet from [AF_INET]94.255.149.118:63073, sid=634c242d a04b9f5e
***:* VERIFY OK: depth=1, CN=PiVPN_CA
***:* VERIFY KU OK
***:* Validating certificate extended key usage
***:* ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
***:* VERIFY EKU OK
***:* VERIFY OK: depth=0, CN=*
***:* peer info: IV_VER=2.4.6
***:* peer info: IV_PLAT=mac
***:* peer info: IV_PROTO=2
***:* peer info: IV_NCP=2
***:* peer info: IV_LZ4=1
***:* peer info: IV_LZ4v2=1
***:* peer info: IV_LZO=1
***:* peer info: IV_COMP_STUB=1
***:* peer info: IV_COMP_STUBv2=1
***:* peer info: IV_TCPNL=1
***:* peer info: IV_GUI_VER="net.tunnelblick.tunnelblick_5050_3.7.6beta04__build_5050)"
***:* Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 384 bit EC, curve: brainpoolP384r1
***:* [*] Peer Connection Initiated with [AF_INET]***:***
***/***:* MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
***/***:* MULTI: Learn: 10.8.0.2 -> ***/***:*
***/***:* MULTI: primary virtual IP for ***/***:*: 10.8.0.2
***/***:* PUSH: Received control message: 'PUSH_REQUEST'
***/***:* SENT CONTROL [***]: 'PUSH_REPLY,dhcp-option DNS 196.168.150.1,route 192.168.150.0 255.255.255.0 vpn_gateway 500,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 15,ping-restart 60,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
***/***:* Data Channel: using negotiated cipher 'AES-256-GCM'
***/***:* Data Channel MTU parms [ L:1550 D:1450 EF:50 EB:406 ET:0 EL:3 ]
***/***:* Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
***/***:* Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
***/***:* PID_ERR replay-window backtrack occurred [2] [SSL-0] [00_0] 0:4 0:2 t=1527069650[0] r=[0,64,15,2,1] sl=[60,4,64,528]
***/***:* PID_ERR replay-window backtrack occurred [1] [TLS_WRAP-0] [0_455556666] 1527069644:11 1527069644:10 t=1527069650[0] r=[0,64,15,1,1] sl=[53,11,64,528]
***/***:* PID_ERR replay-window backtrack occurred [3] [SSL-0] [0___000111111111111111111111111111111111111111] 0:46 0:43 t=1527069651[0] r=[-1,64,15,3,1] sl=[18,46,64,528]

Clinet log, verb 4, upon connnecton

*Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.6beta04 (build 5050); prior version 3.7.6beta03 (build 5031)
2018-05-23 13:55:54 *Tunnelblick: Attempting connection with RaspberryPi using shadow copy; Set nameserver = 1025; monitoring connection
2018-05-23 13:55:54 *Tunnelblick: openvpnstart start RaspberryPi.tblk 58998 1025 0 1 0 1164080 -ptADGNWradsgnw 2.4.6-openssl-1.0.2o
2018-05-23 13:55:54 *Tunnelblick: openvpnstart log:
     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
     
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.6-openssl-1.0.2o/openvpn
          --daemon
          --log
          /Library/Application Support/Tunnelblick/Logs/-SUsers-S***-SLibrary-SApplication Support-STunnelblick-SConfigurations-SRaspberryPi.tblk-SContents-SResources-Sconfig.ovpn.1025_0_1_0_1164080.58998.openvpn.log
          --cd
          /Library/Application Support/Tunnelblick/Users/***/RaspberryPi.tblk/Contents/Resources
          --setenv
          IV_GUI_VER
          "net.tunnelblick.tunnelblick 5050 3.7.6beta04 (build 5050)"
          --verb
          4
          --config
          /Library/Application Support/Tunnelblick/Users/***/RaspberryPi.tblk/Contents/Resources/config.ovpn
          --verb
          4
          --cd
          /Library/Application Support/Tunnelblick/Users/***/RaspberryPi.tblk/Contents/Resources
          --management
          127.0.0.1
          58998
          /Library/Application Support/Tunnelblick/ppbdogklfkilgpicobamlihplnkeliehcbadadha.mip
          --management-query-passwords
          --management-hold
          --redirect-gateway
          def1
          --script-security
          2
          --route-up
          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -o -w -ptADGNWradsgnw
          --down
          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -o -w -ptADGNWradsgnw

2018-05-23 13:55:54 *Tunnelblick: Established communication with OpenVPN
2018-05-23 13:55:54 us=542261 Current Parameter Settings:
2018-05-23 13:55:54 us=542558   config = '/Library/Application Support/Tunnelblick/Users/***/RaspberryPi.tblk/Contents/Resources/config.ovpn'
2018-05-23 13:55:54 us=542576   mode = 0
2018-05-23 13:55:54 us=542588   show_ciphers = DISABLED
2018-05-23 13:55:54 us=542599   show_digests = DISABLED
2018-05-23 13:55:54 us=542610   show_engines = DISABLED
2018-05-23 13:55:54 us=542620   genkey = DISABLED
2018-05-23 13:55:54 us=542632   key_pass_file = '[UNDEF]'
2018-05-23 13:55:54 us=542642   show_tls_ciphers = DISABLED
2018-05-23 13:55:54 us=542653   connect_retry_max = 0
2018-05-23 13:55:54 us=542664 Connection profiles [0]:
2018-05-23 13:55:54 us=542675   proto = udp
2018-05-23 13:55:54 us=542686   local = '[UNDEF]'
2018-05-23 13:55:54 us=542697   local_port = '[UNDEF]'
2018-05-23 13:55:54 us=542708   remote = ' *** '
2018-05-23 13:55:54 us=542718   remote_port = ' *** '
2018-05-23 13:55:54 us=542729   remote_float = DISABLED
2018-05-23 13:55:54 us=542739   bind_defined = DISABLED
2018-05-23 13:55:54 us=542750   bind_local = DISABLED
2018-05-23 13:55:54 us=542760   bind_ipv6_only = DISABLED
2018-05-23 13:55:54 us=542771   connect_retry_seconds = 5
2018-05-23 13:55:54 us=542781   connect_timeout = 120
2018-05-23 13:55:54 us=542791   xormethod = 0
2018-05-23 13:55:54 us=542802   xormask = ''
2018-05-23 13:55:54 us=542812   xormasklen = 0
2018-05-23 13:55:54 us=542823   socks_proxy_server = '[UNDEF]'
2018-05-23 13:55:54 us=542833   socks_proxy_port = '[UNDEF]'
2018-05-23 13:55:54 us=542844   tun_mtu = 1500
2018-05-23 13:55:54 us=542854   tun_mtu_defined = ENABLED
2018-05-23 13:55:54 us=542864   link_mtu = 1500
2018-05-23 13:55:54 us=542875   link_mtu_defined = DISABLED
2018-05-23 13:55:54 us=542885   tun_mtu_extra = 0
2018-05-23 13:55:54 us=542896   tun_mtu_extra_defined = DISABLED
2018-05-23 13:55:54 us=542906   mtu_discover_type = -1
2018-05-23 13:55:54 us=542917   fragment = 0
2018-05-23 13:55:54 us=542927   mssfix = 1450
2018-05-23 13:55:54 us=542937   explicit_exit_notification = 5
2018-05-23 13:55:54 us=542948 Connection profiles END
2018-05-23 13:55:54 us=542958   remote_random = DISABLED
2018-05-23 13:55:54 us=542969   ipchange = '[UNDEF]'
2018-05-23 13:55:54 us=542979   dev = 'tun'
2018-05-23 13:55:54 us=542989   dev_type = '[UNDEF]'
2018-05-23 13:55:54 us=543000   dev_node = '[UNDEF]'
2018-05-23 13:55:54 us=543010   lladdr = '[UNDEF]'
2018-05-23 13:55:54 us=543020   topology = 1
2018-05-23 13:55:54 us=543030   ifconfig_local = '[UNDEF]'
2018-05-23 13:55:54 us=543041   ifconfig_remote_netmask = '[UNDEF]'
2018-05-23 13:55:54 us=543051   ifconfig_noexec = DISABLED
2018-05-23 13:55:54 us=543061   ifconfig_nowarn = DISABLED
2018-05-23 13:55:54 us=543072   ifconfig_ipv6_local = '[UNDEF]'
2018-05-23 13:55:54 us=543082   ifconfig_ipv6_netbits = 0
2018-05-23 13:55:54 us=543093   ifconfig_ipv6_remote = '[UNDEF]'
2018-05-23 13:55:54 us=543103   shaper = 0
2018-05-23 13:55:54 us=543113   mtu_test = 0
2018-05-23 13:55:54 us=543124   mlock = DISABLED
2018-05-23 13:55:54 us=543134   keepalive_ping = 0
2018-05-23 13:55:54 us=543145   keepalive_timeout = 0
2018-05-23 13:55:54 us=543155   inactivity_timeout = 0
2018-05-23 13:55:54 us=543165   ping_send_timeout = 0
2018-05-23 13:55:54 us=543175   ping_rec_timeout = 0
2018-05-23 13:55:54 us=543185   ping_rec_timeout_action = 0
2018-05-23 13:55:54 us=543196   ping_timer_remote = DISABLED
2018-05-23 13:55:54 us=543206   remap_sigusr1 = 0
2018-05-23 13:55:54 us=543216   persist_tun = ENABLED
2018-05-23 13:55:54 us=543227   persist_local_ip = DISABLED
2018-05-23 13:55:54 us=543237   persist_remote_ip = DISABLED
2018-05-23 13:55:54 us=543247   persist_key = ENABLED
2018-05-23 13:55:54 us=543258   passtos = DISABLED
2018-05-23 13:55:54 us=543281   resolve_retry_seconds = 1000000000
2018-05-23 13:55:54 us=543292   resolve_in_advance = DISABLED
2018-05-23 13:55:54 us=543303   username = '[UNDEF]'
2018-05-23 13:55:54 us=543313   groupname = '[UNDEF]'
2018-05-23 13:55:54 us=543323   chroot_dir = '[UNDEF]'
2018-05-23 13:55:54 us=543334   cd_dir = '/Library/Application Support/Tunnelblick/Users/***/RaspberryPi.tblk/Contents/Resources'
2018-05-23 13:55:54 us=543344   writepid = '[UNDEF]'
2018-05-23 13:55:54 us=543355   up_script = '[UNDEF]'
2018-05-23 13:55:54 us=543370   down_script = '/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -o -w -ptADGNWradsgnw'
2018-05-23 13:55:54 us=543382   down_pre = DISABLED
2018-05-23 13:55:54 us=543392   up_restart = DISABLED
2018-05-23 13:55:54 us=543402   up_delay = DISABLED
2018-05-23 13:55:54 us=543439   daemon = ENABLED
2018-05-23 13:55:54 us=543451   inetd = 0
2018-05-23 13:55:54 us=543462   log = ENABLED
2018-05-23 13:55:54 us=543472   suppress_timestamps = DISABLED
2018-05-23 13:55:54 us=543482   machine_readable_output = DISABLED
2018-05-23 13:55:54 us=543493   nice = 0
2018-05-23 13:55:54 us=543503   verbosity = 4
2018-05-23 13:55:54 us=543513   mute = 0
2018-05-23 13:55:54 us=543524   status_file = '[UNDEF]'
2018-05-23 13:55:54 us=543534   status_file_version = 1
2018-05-23 13:55:54 us=543544   status_file_update_freq = 60
2018-05-23 13:55:54 us=543555   occ = ENABLED
2018-05-23 13:55:54 us=543565   rcvbuf = 0
2018-05-23 13:55:54 us=543575   sndbuf = 0
2018-05-23 13:55:54 us=543585   sockflags = 0
2018-05-23 13:55:54 us=543596   fast_io = DISABLED
2018-05-23 13:55:54 us=543606   comp.alg = 11
2018-05-23 13:55:54 us=543616   comp.flags = 0
2018-05-23 13:55:54 us=543627   route_script = '/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -o -w -ptADGNWradsgnw'
2018-05-23 13:55:54 us=543637   route_default_gateway = '[UNDEF]'
2018-05-23 13:55:54 us=543648   route_default_metric = 0
2018-05-23 13:55:54 us=543659   route_noexec = DISABLED
2018-05-23 13:55:54 us=543669   route_delay = 0
2018-05-23 13:55:54 us=543680   route_delay_window = 30
2018-05-23 13:55:54 us=543691   route_delay_defined = DISABLED
2018-05-23 13:55:54 us=543701   route_nopull = DISABLED
2018-05-23 13:55:54 us=543712   route_gateway_via_dhcp = DISABLED
2018-05-23 13:55:54 us=543722   allow_pull_fqdn = DISABLED
2018-05-23 13:55:54 us=543782   [redirect_default_gateway local=0]
2018-05-23 13:55:54 us=543794   management_addr = '127.0.0.1'
2018-05-23 13:55:54 us=543805   management_port = '58998'
2018-05-23 13:55:54 us=543816   management_user_pass = '/Library/Application Support/Tunnelblick/ppbdogklfkilgpicobamlihplnkeliehcbadadha.mip'
2018-05-23 13:55:54 us=543827   management_log_history_cache = 250
2018-05-23 13:55:54 us=543837   management_echo_buffer_size = 100
2018-05-23 13:55:54 us=543848   management_write_peer_info_file = '[UNDEF]'
2018-05-23 13:55:54 us=543859   management_client_user = '[UNDEF]'
2018-05-23 13:55:54 us=543870   management_client_group = '[UNDEF]'
2018-05-23 13:55:54 us=543881   management_flags = 6
2018-05-23 13:55:54 us=543891   shared_secret_file = '[UNDEF]'
2018-05-23 13:55:54 us=543902   key_direction = not set
2018-05-23 13:55:54 us=543913   ciphername = 'AES-256-CBC'
2018-05-23 13:55:54 us=543924   ncp_enabled = ENABLED
2018-05-23 13:55:54 us=543934   ncp_ciphers = 'AES-256-GCM'
2018-05-23 13:55:54 us=543945   authname = 'SHA256'
2018-05-23 13:55:54 us=543956   prng_hash = 'SHA1'
2018-05-23 13:55:54 us=543966   prng_nonce_secret_len = 16
2018-05-23 13:55:54 us=543977   keysize = 0
2018-05-23 13:55:54 us=543987   engine = DISABLED
2018-05-23 13:55:54 us=543998   replay = ENABLED
2018-05-23 13:55:54 us=544008   mute_replay_warnings = DISABLED
2018-05-23 13:55:54 us=544029   replay_window = 64
2018-05-23 13:55:54 us=544041   replay_time = 15
2018-05-23 13:55:54 us=544051   packet_id_file = '[UNDEF]'
2018-05-23 13:55:54 us=544062   use_iv = ENABLED
2018-05-23 13:55:54 us=544073   test_crypto = DISABLED
2018-05-23 13:55:54 us=544083   tls_server = DISABLED
2018-05-23 13:55:54 us=544094   tls_client = ENABLED
2018-05-23 13:55:54 us=544104   key_method = 2
2018-05-23 13:55:54 us=544115   ca_file = 'ca.crt'
2018-05-23 13:55:54 us=544125   ca_path = '[UNDEF]'
2018-05-23 13:55:54 us=544161   dh_file = '[UNDEF]'
2018-05-23 13:55:54 us=544173   cert_file = '***.crt'
2018-05-23 13:55:54 us=544183   extra_certs_file = '[UNDEF]'
2018-05-23 13:55:54 us=544194   priv_key_file = '***.key'
2018-05-23 13:55:54 us=544205   pkcs12_file = '[UNDEF]'
2018-05-23 13:55:54 us=544215   cipher_list = '[UNDEF]'
2018-05-23 13:55:54 us=544226   tls_cert_profile = '[UNDEF]'
2018-05-23 13:55:54 us=544237   tls_verify = '[UNDEF]'
2018-05-23 13:55:54 us=544247   tls_export_cert = '[UNDEF]'
2018-05-23 13:55:54 us=544258   verify_x509_type = 2
2018-05-23 13:55:54 us=544269   verify_x509_name = 'server_***'
2018-05-23 13:55:54 us=544280   crl_file = '[UNDEF]'
2018-05-23 13:55:54 us=544290   ns_cert_type = 0
2018-05-23 13:55:54 us=544301   remote_cert_ku[i] = 65535
2018-05-23 13:55:54 us=544312   remote_cert_ku[i] = 0
2018-05-23 13:55:54 us=544322   remote_cert_ku[i] = 0
2018-05-23 13:55:54 us=544332   remote_cert_ku[i] = 0
2018-05-23 13:55:54 us=544342   remote_cert_ku[i] = 0
2018-05-23 13:55:54 us=544353   remote_cert_ku[i] = 0
2018-05-23 13:55:54 us=544363   remote_cert_ku[i] = 0
2018-05-23 13:55:54 us=544373   remote_cert_ku[i] = 0
2018-05-23 13:55:54 us=544383   remote_cert_ku[i] = 0
2018-05-23 13:55:54 us=544393   remote_cert_ku[i] = 0
2018-05-23 13:55:54 us=544404   remote_cert_ku[i] = 0
2018-05-23 13:55:54 us=544414   remote_cert_ku[i] = 0
2018-05-23 13:55:54 us=544424   remote_cert_ku[i] = 0
2018-05-23 13:55:54 us=544434   remote_cert_ku[i] = 0
2018-05-23 13:55:54 us=544452   remote_cert_ku[i] = 0
2018-05-23 13:55:54 us=544462   remote_cert_ku[i] = 0
2018-05-23 13:55:54 us=544473   remote_cert_eku = 'TLS Web Server Authentication'
2018-05-23 13:55:54 us=544492   ssl_flags = 192
2018-05-23 13:55:54 us=544501   tls_timeout = 2
2018-05-23 13:55:54 us=544511   renegotiate_bytes = -1
2018-05-23 13:55:54 us=544520   renegotiate_packets = 0
2018-05-23 13:55:54 us=544529   renegotiate_seconds = 3600
2018-05-23 13:55:54 us=544539   handshake_window = 60
2018-05-23 13:55:54 us=544548   transition_window = 3600
2018-05-23 13:55:54 us=544558   single_session = DISABLED
2018-05-23 13:55:54 us=544567   push_peer_info = DISABLED
2018-05-23 13:55:54 us=544577   tls_exit = DISABLED
2018-05-23 13:55:54 us=544586   tls_auth_file = '[UNDEF]'
2018-05-23 13:55:54 us=544596   tls_crypt_file = '[[INLINE]]'
2018-05-23 13:55:54 us=544605   pkcs11_protected_authentication = DISABLED
2018-05-23 13:55:54 us=544615   pkcs11_protected_authentication = DISABLED
2018-05-23 13:55:54 us=544625   pkcs11_protected_authentication = DISABLED
2018-05-23 13:55:54 us=544634   pkcs11_protected_authentication = DISABLED
2018-05-23 13:55:54 us=544644   pkcs11_protected_authentication = DISABLED
2018-05-23 13:55:54 us=544653   pkcs11_protected_authentication = DISABLED
2018-05-23 13:55:54 us=544663   pkcs11_protected_authentication = DISABLED
2018-05-23 13:55:54 us=544672   pkcs11_protected_authentication = DISABLED
2018-05-23 13:55:54 us=544682   pkcs11_protected_authentication = DISABLED
2018-05-23 13:55:54 us=544691   pkcs11_protected_authentication = DISABLED
2018-05-23 13:55:54 us=544701   pkcs11_protected_authentication = DISABLED
2018-05-23 13:55:54 us=544719   pkcs11_protected_authentication = DISABLED
2018-05-23 13:55:54 us=544729   pkcs11_protected_authentication = DISABLED
2018-05-23 13:55:54 us=544739   pkcs11_protected_authentication = DISABLED
2018-05-23 13:55:54 us=544748   pkcs11_protected_authentication = DISABLED
2018-05-23 13:55:54 us=544758   pkcs11_protected_authentication = DISABLED
2018-05-23 13:55:54 us=544768   pkcs11_private_mode = 00000000
2018-05-23 13:55:54 us=544778   pkcs11_private_mode = 00000000
2018-05-23 13:55:54 us=544787   pkcs11_private_mode = 00000000
2018-05-23 13:55:54 us=544797   pkcs11_private_mode = 00000000
2018-05-23 13:55:54 us=544807   pkcs11_private_mode = 00000000
2018-05-23 13:55:54 us=544816   pkcs11_private_mode = 00000000
2018-05-23 13:55:54 us=544826   pkcs11_private_mode = 00000000
2018-05-23 13:55:54 us=544835   pkcs11_private_mode = 00000000
2018-05-23 13:55:54 us=544845   pkcs11_private_mode = 00000000
2018-05-23 13:55:54 us=544854   pkcs11_private_mode = 00000000
2018-05-23 13:55:54 us=544864   pkcs11_private_mode = 00000000
2018-05-23 13:55:54 us=544873   pkcs11_private_mode = 00000000
2018-05-23 13:55:54 us=544883   pkcs11_private_mode = 00000000
2018-05-23 13:55:54 us=544892   pkcs11_private_mode = 00000000
2018-05-23 13:55:54 us=544902   pkcs11_private_mode = 00000000
2018-05-23 13:55:54 us=544912   pkcs11_private_mode = 00000000
2018-05-23 13:55:54 us=544921   pkcs11_cert_private = DISABLED
2018-05-23 13:55:54 us=544930   pkcs11_cert_private = DISABLED
2018-05-23 13:55:54 us=544940   pkcs11_cert_private = DISABLED
2018-05-23 13:55:54 us=544949   pkcs11_cert_private = DISABLED
2018-05-23 13:55:54 us=544959   pkcs11_cert_private = DISABLED
2018-05-23 13:55:54 us=544968   pkcs11_cert_private = DISABLED
2018-05-23 13:55:54 us=544978   pkcs11_cert_private = DISABLED
2018-05-23 13:55:54 us=544987   pkcs11_cert_private = DISABLED
2018-05-23 13:55:54 us=544997   pkcs11_cert_private = DISABLED
2018-05-23 13:55:54 us=545006   pkcs11_cert_private = DISABLED
2018-05-23 13:55:54 us=545016   pkcs11_cert_private = DISABLED
2018-05-23 13:55:54 us=545025   pkcs11_cert_private = DISABLED
2018-05-23 13:55:54 us=545035   pkcs11_cert_private = DISABLED
2018-05-23 13:55:54 us=545044   pkcs11_cert_private = DISABLED
2018-05-23 13:55:54 us=545054   pkcs11_cert_private = DISABLED
2018-05-23 13:55:54 us=545063   pkcs11_cert_private = DISABLED
2018-05-23 13:55:54 us=545072   pkcs11_pin_cache_period = -1
2018-05-23 13:55:54 us=545082   pkcs11_id = '[UNDEF]'
2018-05-23 13:55:54 us=545091   pkcs11_id_management = DISABLED
2018-05-23 13:55:54 us=545132   server_network = 0.0.0.0
2018-05-23 13:55:54 us=545143   server_netmask = 0.0.0.0
2018-05-23 13:55:54 us=545163   server_network_ipv6 = ::
2018-05-23 13:55:54 us=545173   server_netbits_ipv6 = 0
2018-05-23 13:55:54 us=545183   server_bridge_ip = 0.0.0.0
2018-05-23 13:55:54 us=545193   server_bridge_netmask = 0.0.0.0
2018-05-23 13:55:54 us=545204   server_bridge_pool_start = 0.0.0.0
2018-05-23 13:55:54 us=545214   server_bridge_pool_end = 0.0.0.0
2018-05-23 13:55:54 us=545224   ifconfig_pool_defined = DISABLED
2018-05-23 13:55:54 us=545234   ifconfig_pool_start = 0.0.0.0
2018-05-23 13:55:54 us=545244   ifconfig_pool_end = 0.0.0.0
2018-05-23 13:55:54 us=545254   ifconfig_pool_netmask = 0.0.0.0
2018-05-23 13:55:54 us=545264   ifconfig_pool_persist_filename = '[UNDEF]'
2018-05-23 13:55:54 us=545274   ifconfig_pool_persist_refresh_freq = 600
2018-05-23 13:55:54 us=545284   ifconfig_ipv6_pool_defined = DISABLED
2018-05-23 13:55:54 us=545294   ifconfig_ipv6_pool_base = ::
2018-05-23 13:55:54 us=545303   ifconfig_ipv6_pool_netbits = 0
2018-05-23 13:55:54 us=545313   n_bcast_buf = 256
2018-05-23 13:55:54 us=545323   tcp_queue_limit = 64
2018-05-23 13:55:54 us=545332   real_hash_size = 256
2018-05-23 13:55:54 us=545350   virtual_hash_size = 256
2018-05-23 13:55:54 us=545360   client_connect_script = '[UNDEF]'
2018-05-23 13:55:54 us=545370   learn_address_script = '[UNDEF]'
2018-05-23 13:55:54 us=545380   client_disconnect_script = '[UNDEF]'
2018-05-23 13:55:54 us=545389   client_config_dir = '[UNDEF]'
2018-05-23 13:55:54 us=545399   ccd_exclusive = DISABLED
2018-05-23 13:55:54 us=545409   tmp_dir = '/var/folders/bp/vsj7tg9510b11bnf6wfh92tr0000gn/T/'
2018-05-23 13:55:54 us=545418   push_ifconfig_defined = DISABLED
2018-05-23 13:55:54 us=545429   push_ifconfig_local = 0.0.0.0
2018-05-23 13:55:54 us=545439   push_ifconfig_remote_netmask = 0.0.0.0
2018-05-23 13:55:54 us=545449   push_ifconfig_ipv6_defined = DISABLED
2018-05-23 13:55:54 us=545459   push_ifconfig_ipv6_local = ::/0
2018-05-23 13:55:54 us=545469   push_ifconfig_ipv6_remote = ::
2018-05-23 13:55:54 us=545478   enable_c2c = DISABLED
2018-05-23 13:55:54 us=545488   duplicate_cn = DISABLED
2018-05-23 13:55:54 us=545498   cf_max = 0
2018-05-23 13:55:54 us=545507   cf_per = 0
2018-05-23 13:55:54 us=545516   max_clients = 1024
2018-05-23 13:55:54 us=545526   max_routes_per_client = 256
2018-05-23 13:55:54 us=545535   auth_user_pass_verify_script = '[UNDEF]'
2018-05-23 13:55:54 us=545545   auth_user_pass_verify_script_via_file = DISABLED
2018-05-23 13:55:54 us=545554   auth_token_generate = DISABLED
2018-05-23 13:55:54 us=545564   auth_token_lifetime = 0
2018-05-23 13:55:54 us=545573   port_share_host = '[UNDEF]'
2018-05-23 13:55:54 us=545583   port_share_port = '[UNDEF]'
2018-05-23 13:55:54 us=545593   client = ENABLED
2018-05-23 13:55:54 us=545602   pull = ENABLED
2018-05-23 13:55:54 us=545611   auth_user_pass_file = '[UNDEF]'
2018-05-23 13:55:54 us=545623 OpenVPN 2.4.6 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Apr 26 2018
2018-05-23 13:55:54 us=545640 library versions: OpenSSL 1.0.2o  27 Mar 2018, LZO 2.10
2018-05-23 13:55:54 us=547788 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:58998
2018-05-23 13:55:54 us=547977 Need hold release from management interface, waiting...
2018-05-23 13:55:54 us=928930 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:58998
2018-05-23 13:55:54 us=972489 MANAGEMENT: CMD 'pid'
2018-05-23 13:55:54 us=972740 MANAGEMENT: CMD 'state on'
2018-05-23 13:55:54 us=972936 MANAGEMENT: CMD 'state'
2018-05-23 13:55:54 us=973230 MANAGEMENT: CMD 'bytecount 1'
2018-05-23 13:55:54 us=976164 MANAGEMENT: CMD 'hold release'
2018-05-23 13:55:54 us=977833 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2018-05-23 13:55:54 *Tunnelblick: openvpnstart starting OpenVPN
2018-05-23 13:55:55 *Tunnelblick: Obtained passphrase from the Keychain
2018-05-23 13:55:55 us=155268 MANAGEMENT: CMD 'password [...]'
2018-05-23 13:55:55 us=170217 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2018-05-23 13:55:55 us=170466 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2018-05-23 13:55:55 us=172486 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2018-05-23 13:55:55 us=172669 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2018-05-23 13:55:55 us=172835 LZ4v2 compression initializing
2018-05-23 13:55:55 us=173304 Control Channel MTU parms [ L:1622 D:1156 EF:94 EB:0 ET:0 EL:3 ]
2018-05-23 13:55:55 us=173532 MANAGEMENT: >STATE:1527076555,RESOLVE,,,,,,
2018-05-23 13:55:55 us=190559 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
2018-05-23 13:55:55 us=190757 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-client'
2018-05-23 13:55:55 us=190857 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-server'
2018-05-23 13:55:55 us=191707 TCP/UDP: Preserving recently used remote address: [AF_INET]***:*
2018-05-23 13:55:55 us=192613 Socket Buffers: R=[196724->196724] S=[9216->9216]
2018-05-23 13:55:55 us=192758 UDP link local: (not bound)
2018-05-23 13:55:55 us=194112 UDP link remote: [AF_INET]***:*
2018-05-23 13:55:55 us=194324 MANAGEMENT: >STATE:1527076555,WAIT,,,,,,
2018-05-23 13:55:55 us=242844 MANAGEMENT: >STATE:1527076555,AUTH,,,,,,
2018-05-23 13:55:55 us=243030 TLS: Initial packet from [AF_INET]***:*, sid=2a4a5cf4 f3a16bbb
2018-05-23 13:55:55 us=314566 VERIFY OK: depth=1, CN=PiVPN_CA
2018-05-23 13:55:55 us=319127 VERIFY KU OK
2018-05-23 13:55:55 us=319263 Validating certificate extended key usage
2018-05-23 13:55:55 us=319355 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2018-05-23 13:55:55 us=319432 VERIFY EKU OK
2018-05-23 13:55:55 us=321067 VERIFY X509NAME OK: CN=server_***
2018-05-23 13:55:55 us=321907 VERIFY OK: depth=0, CN=server_***
2018-05-23 13:55:55 us=436109 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-ECDSA-AES256-GCM-SHA384, 384 bit EC, curve: brainpoolP384r1
2018-05-23 13:55:55 us=436316 [server_***] Peer Connection Initiated with [AF_INET]***:*
2018-05-23 13:55:56 us=596073 MANAGEMENT: >STATE:1527076556,GET_CONFIG,,,,,,
2018-05-23 13:55:56 us=596410 SENT CONTROL [server_***]: 'PUSH_REQUEST' (status=1)
2018-05-23 13:55:56 us=630362 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 196.168.150.1,route 192.168.150.0 255.255.255.0 vpn_gateway 500,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 15,ping-restart 60,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM'
2018-05-23 13:55:56 us=630616 OPTIONS IMPORT: timers and/or timeouts modified
2018-05-23 13:55:56 us=630720 OPTIONS IMPORT: --ifconfig/up options modified
2018-05-23 13:55:56 us=632898 OPTIONS IMPORT: route options modified
2018-05-23 13:55:56 us=633056 OPTIONS IMPORT: route-related options modified
2018-05-23 13:55:56 us=633206 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2018-05-23 13:55:56 us=635394 OPTIONS IMPORT: peer-id set
2018-05-23 13:55:56 us=635599 OPTIONS IMPORT: adjusting link_mtu to 1625
2018-05-23 13:55:56 us=636322 OPTIONS IMPORT: data channel crypto options modified
2018-05-23 13:55:56 us=637153 Data Channel: using negotiated cipher 'AES-256-GCM'
2018-05-23 13:55:56 us=637858 Data Channel MTU parms [ L:1553 D:1450 EF:53 EB:406 ET:0 EL:3 ]
2018-05-23 13:55:56 us=639446 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2018-05-23 13:55:56 us=639550 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2018-05-23 13:55:56 us=641265 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2018-05-23 13:55:56 us=641399 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2018-05-23 13:55:56 us=642373 Opened utun device utun2
2018-05-23 13:55:56 us=643303 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
2018-05-23 13:55:56 us=643449 MANAGEMENT: >STATE:1527076556,ASSIGN_IP,,10.8.0.2,,,,
2018-05-23 13:55:56 us=645880 /sbin/ifconfig utun2 delete
                                        ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2018-05-23 13:55:56 us=661632 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2018-05-23 13:55:56 us=661861 /sbin/ifconfig utun2 10.8.0.2 10.8.0.2 netmask 255.255.255.0 mtu 1500 up
2018-05-23 13:55:56 us=666552 /sbin/route add -net 10.8.0.0 10.8.0.2 255.255.255.0
                                        add net 10.8.0.0: gateway 10.8.0.2
2018-05-23 13:55:56 us=677101 /sbin/route add -net *** 192.168.0.1 255.255.255.255
                                        add net ***: gateway 192.168.0.1
2018-05-23 13:55:56 us=681751 /sbin/route add -net 0.0.0.0 10.8.0.1 128.0.0.0
                                        add net 0.0.0.0: gateway 10.8.0.1
2018-05-23 13:55:56 us=686429 /sbin/route add -net 128.0.0.0 10.8.0.1 128.0.0.0
                                        add net 128.0.0.0: gateway 10.8.0.1
2018-05-23 13:55:56 us=690340 MANAGEMENT: >STATE:1527076556,ADD_ROUTES,,,,,,
2018-05-23 13:55:56 us=691184 /sbin/route add -net 192.168.150.0 10.8.0.1 255.255.255.0
                                        add net 192.168.150.0: gateway 10.8.0.1
                                        **********************************************
                                        Start of output from client.up.tunnelblick.sh
                                        Retrieved from OpenVPN: name server(s) [ 196.168.150.1 ], search domain(s) [  ] and SMB server(s) [  ] and using default domain name [ openvpn ]
                                        Not aggregating ServerAddresses because running on OS X 10.6 or higher
                                        Setting search domains to 'openvpn' because running under OS X 10.6 or higher and the search domains were not set manually (or are allowed to be changed) and 'Prepend domain name to search domains' was not selected
                                        Saved the DNS and SMB configurations so they can be restored
                                        Changed DNS ServerAddresses setting from '176.103.130.130 176.103.130.131' to '196.168.150.1'
                                        Changed DNS SearchDomains setting from '' to 'openvpn'
                                        Changed DNS DomainName setting from 'domain.name' to 'openvpn'
                                        Did not change SMB NetBIOSName setting of ''
                                        Did not change SMB Workgroup setting of 'WORKGROUP'
                                        Did not change SMB WINSAddresses setting of ''
                                        DNS servers '196.168.150.1' will be used for DNS queries when the VPN is active
                                        NOTE: The DNS servers do not include any free public DNS servers known to Tunnelblick. This may cause DNS queries to fail or be intercepted or falsified even if they are directed through the VPN. Specify only known public DNS servers or DNS servers located on the VPN network to avoid such problems.
                                        Flushed the DNS cache via dscacheutil
                                        /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil
                                        Notified mDNSResponder that the DNS cache was flushed
                                        Setting up to monitor system configuration with process-network-changes
                                        End of output from client.up.tunnelblick.sh
                                        **********************************************
2018-05-23 13:56:00 *Tunnelblick: No 'connected.sh' script to execute
2018-05-23 13:56:00 us=696837 Initialization Sequence Completed
2018-05-23 13:56:00 us=697130 MANAGEMENT: >STATE:1527076560,CONNECTED,SUCCESS,10.8.0.2,***,*,,
2018-05-23 13:56:05 *Tunnelblick process-network-changes: A system configuration change was ignored

Could it be something to do with the PID_ERR?

TinCanTech

TinCanTech wrote Also, to my knowledge, this does not work yet:
jimdoe wrote dh none
ecdh-curve brainpoolP384r1

Turns out that is does work for your version.

jimdoe

TinCanTech wrote

Turns out that is does work for your version.
[/quote]

Yes, aren’t thos options enables in 2.4? Openvnpn —version outputs

OpenVPN 2.4.6 aarch64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 26 2018
library versions: OpenSSL 1.1.0h  27 Mar 2018, LZO 2.10
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_iproute2=yes enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_management=yes enable_multihome=yes enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_werror=no enable_win32_dll=yes enable_x509_alt_username=yes with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_sysroot=no

So no idea on what could be causing the routing issue?

jimdoe

TinCanTech wrote
Turns out that is does work for your version.

Yes, aren’t thos options enables in 2.4? Openvnpn —version outputs

OpenVPN 2.4.6 aarch64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 26 2018
library versions: OpenSSL 1.1.0h  27 Mar 2018, LZO 2.10
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_iproute2=yes enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_management=yes enable_multihome=yes enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_werror=no enable_win32_dll=yes enable_x509_alt_username=yes with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_sysroot=no

So no idea on what could be causing the routing issue?

(Oops, made a mess of formatting quote. Tried to fix it but somehow ended up making a whole new post :oops: please delete the other post)

TinCanTech

jimdoe wrote aren’t thos options enables in 2.4?

The SSL library handles the EC curve and currently, the only version which will work as you have it setup is openssl-1.0.2o

jimdoe wrote no idea on what could be causing the routing issue?

Your setup looks ok .. you will have to use tcpdump to analyse the traffic and work out what's wrong.

jimdoe wrote please delete the other post

Don't worry about it 8-)

jimdoe

TinCanTech wrote The SSL library handles the EC curve and currently, the only version which will work as you have it setup is openssl-1.0.2o

Interesting. Any idea why it seems to be working on my setup with openssl 1.1.0 if it technically shouldn't be? Could that be a source of the problem I'm facing?

TinCanTech wrote Your setup looks ok .. you will have to use tcpdump to analyse the traffic and work out what's wrong.

Performed a tcpdump. Lots of output, and none relating to the tun0 openvpn interface that I could see. There were a lot of packets

dropped by kernel

...could that be an issue?
Most notably however, when running

tcpdump -ni tun0

there was no activity at all, even when connecting (successfully) to the openvpn server from outside the LAN (using a phone sharing wifi to computer) :?: Guessing this could have a lot to do with the problem?

TinCanTech wrote Don't worry about it 8-)

Thanks 🙂

TinCanTech

jimdoe wrote
TinCanTech wrote The SSL library handles the EC curve and currently, the only version which will work as you have it setup is openssl-1.0.2o
Interesting. Any idea why it seems to be working on my setup with openssl 1.1.0 if it technically shouldn't be?

This only effects the client .. your client is tunnelblick with openssl-1.0.2o
IE:

jimdoe wrote 2018-05-23 13:55:54 us=545623 OpenVPN 2.4.6 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Apr 26 2018
2018-05-23 13:55:54 us=545640 library versions: OpenSSL 1.0.2o 27 Mar 2018, LZO 2.10

It is a new-ish feature ..

jimdoe wrote Could that be a source of the problem I'm facing?

No .. because your client successfully connects. It is some other problem ..

jimdoe wrote tcpdump -ni tun0

there was no activity at all

I presume you have enabled IP Forwarding correctly .. sorry to ask but sometimes we make mistakes.

jimdoe

TinCanTech wrote I presume you have enabled IP Forwarding correctly .. sorry to ask but sometimes we make mistakes.

Don't be sorry, it could well be that I made a mistake. I am assuming I have.

# sysctl -a | grep forward
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.eth0.mc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.tun0.forwarding = 1
net.ipv4.conf.tun0.mc_forwarding = 0
net.ipv4.ip_forward = 1
net.ipv4.ip_forward_use_pmtu = 0
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.all.mc_forwarding = 0
net.ipv6.conf.default.forwarding = 1
net.ipv6.conf.default.mc_forwarding = 0
net.ipv6.conf.eth0.forwarding = 1
net.ipv6.conf.eth0.mc_forwarding = 0
net.ipv6.conf.lo.forwarding = 1
net.ipv6.conf.lo.mc_forwarding = 0
net.ipv6.conf.tun0.forwarding = 1
net.ipv6.conf.tun0.mc_forwarding = 0

This is persistent through reboots. I enabled this via

[Match]
Name=eth*

[Network]
DHCP=yes
IPForward=yes

/etc/systemd/network/eth.network

and

/etc/systemd/network/tun.network

(Name=tun* and no DHCP option in the tun.network file), as per the instructions herehttps://bbs.archlinux.org/viewtopic.php?id=196809 and herehttps://bugs.freedesktop.org/show_bug.cgi?id=89509

TinCanTech

You are pushing a DNS server:

jimdoe wrote push "dhcp-option DNS 196.168.150.62"

Is that host really a DNS server ?

jimdoe

TinCanTech wrote You are pushing a DNS server:
jimdoe wrote push "dhcp-option DNS 196.168.150.62"
Is that host really a DNS server ?

Yep. That's the IP of the pi itself, which is also the DNS server on my LAN as well as the (hopefully soon) OpenVPN server. In a previous configuration on a similar setup, except with Raspbian, this setting worked fine, as did

push "dhcp-option DNS 10.8.0.1"

, which actually was my preferred option as the hope was that the pi didn't need to query the router beforehand.

TinCanTech

I presume then it is successfully serving DNS data to the rest of your LAN ?

This log entry does not match your config file:

jimdoe wrote SENT CONTROL [***]: 'PUSH_REPLY,dhcp-option DNS 196.168.150.1,route 192.168.150.0 255.255.255.0 vpn_gateway 500,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 15,ping-restart 60,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)

better double check that ..

jimdoe

Ok, this is going to be so frustrating, and I am really sorry for this, but....it's working now, and I have absolutely no idea what I did to fix it 😃 :oops:

I've been playing around with so many different options. I've been restarting obsessively, I've added interface=tun0 to /etc/dnsmasq.d/openvpn.conf, I've reinstalled dnsmasq, I've installed ufw to manage iptables, I've redone the ip forwarding. I guess one of these things worked. It's just a shame I don't know which, and so I can't help anyone who may stumble upon this in the future :/

I was trying all these things without much hope of them working, as I had done them all before, and so I didn't really take proper note of what it was I doing and at which step it made it work. I only connected on the off chance something had changed. Perhaps it's a certain combination of the steps I took that suddenly made it work.

Again, I am sorry that I may not be able to help anyone in the future.

TinCanTech

Never mind .. if you do work out what you changed let us know 8-)