Hello,
I've been trying to set up a double-hop VPN for several weeks now and got pretty much everything working, but I have issue on the last step – when I connect to my Pi via Tunnelblick. I establish the connection, but there is no internet, neither on phone or computer, whichever I try.
Here's a little more info about the setup:
I've followed a guide to setup a constant connection between my Pi and my VPN provider Mullvad (via PiVPN). The connection is established automatically after booting and works fine. PiHole is also installed in conjunction and is blocking the ads on the whole network. I wanted to expand on that and setup another connection, so when I connect via my phone or laptop, I also get the benefit of ad-blocking wherever I might be, while also having the Mullvad VPN active. So I set up the conf files, setup dynamic dns via Cloudflare and ddclient, opened up a port on Mullvad and added that port to the conf. However, as soon as I connect, the internet suddenly grinds to a halt and after 30 seconds I get the infamous "After 30.0 seconds, gave up trying to fetch IP address information...".
So far I've tried changing protocols TCP/UDP; both seem to connect fine, but internet still doesn't work. Below are my conf files. I've also tried establishing the connection both on the same network and on mobile tethered network, always the same result.
dev tun-incoming
dev-type tun
proto udp
port 10781
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/***MYKEY***.crt
key /etc/openvpn/easy-rsa/pki/private/***MYKEY***.key
dh none
topology subnet
server 10.8.0.0 255.255.255.0
# Set your primary domain name server address for clients
push "dhcp-option DOMAIN MYDOMAIN.COM"
push "dhcp-option DNS 193.138.218.74" ***<--- this is Mullvad DNS***
# Prevent DNS leaks on Windows
#push "block-outside-dns"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
keepalive 1800 3600
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/easy-rsa/pki/ta.key
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 3
#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device.
#duplicate-cn
# Generated for use by PiVPN.io
client
dev tun
proto udp
remote ***MYDOMAIN.COM*** 10781
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tls-version-min 1.2
verify-x509-name ***MYKEY*** name
cipher AES-256-CBC
auth SHA256
auth-nocache
verb 3
Also, Tunnelblick log:
2019-10-26 18:56:08.425468 *Tunnelblick: macOS 10.14.6 (18G95); Tunnelblick 3.8.1 (build 5400); prior version 3.8.0 (build 5370)
2019-10-26 18:56:08.935878 *Tunnelblick: Attempting connection with MBP using shadow copy; Set nameserver = 769; monitoring connection
2019-10-26 18:56:08.936514 *Tunnelblick: openvpnstart start MBP.tblk 57817 769 0 1 0 1163568 -ptADGNWradsgnw 2.4.7-openssl-1.0.2t
2019-10-26 18:56:08.973195 *Tunnelblick: openvpnstart starting OpenVPN
2019-10-26 18:56:09.227557 OpenVPN 2.4.7 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Sep 11 2019
2019-10-26 18:56:09.227765 library versions: OpenSSL 1.0.2t 10 Sep 2019, LZO 2.10
2019-10-26 18:56:09.229836 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:57817
2019-10-26 18:56:09.229895 Need hold release from management interface, waiting...
2019-10-26 18:56:09.559998 *Tunnelblick: openvpnstart log:
OpenVPN started successfully.
Command used to start OpenVPN (one argument per displayed line):
/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.7-openssl-1.0.2t/openvpn
--daemon
--log /Library/Application Support/Tunnelblick/Logs/-SUsers-Smarkiljas-SLibrary-SApplication Support-STunnelblick-SConfigurations-SMBP.tblk-SContents-SResources-Sconfig.ovpn.769_0_1_0_1163568.57817.openvpn.log
--cd /Library/Application Support/Tunnelblick/Users/markiljas/MBP.tblk/Contents/Resources
--machine-readable-output
--setenv IV_GUI_VER "net.tunnelblick.tunnelblick 5400 3.8.1 (build 5400)"
--verb 3
--config /Library/Application Support/Tunnelblick/Users/markiljas/MBP.tblk/Contents/Resources/config.ovpn
--setenv TUNNELBLICK_CONFIG_FOLDER /Library/Application Support/Tunnelblick/Users/markiljas/MBP.tblk/Contents/Resources
--verb 3
--cd /Library/Application Support/Tunnelblick/Users/markiljas/MBP.tblk/Contents/Resources
--management 127.0.0.1 57817 /Library/Application Support/Tunnelblick/lgbkbjilpcbkpkehddlfgaafmalhccpdfmbpbnll.mip
--management-query-passwords
--management-hold
--script-security 2
--route-up /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -o -w -ptADGNWradsgnw
--down /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -o -w -ptADGNWradsgnw
2019-10-26 18:56:09.584646 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:57817
2019-10-26 18:56:09.744605 MANAGEMENT: CMD 'pid'
2019-10-26 18:56:09.744667 MANAGEMENT: CMD 'auth-retry interact'
2019-10-26 18:56:09.744750 MANAGEMENT: CMD 'state on'
2019-10-26 18:56:09.744820 MANAGEMENT: CMD 'state'
2019-10-26 18:56:09.744887 MANAGEMENT: CMD 'bytecount 1'
2019-10-26 18:56:09.752741 *Tunnelblick: Established communication with OpenVPN
2019-10-26 18:56:09.768553 *Tunnelblick: >INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info
2019-10-26 18:56:09.772261 MANAGEMENT: CMD 'hold release'
2019-10-26 18:56:09.773396 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2019-10-26 18:56:09.817665 *Tunnelblick: Obtained passphrase from the Keychain
2019-10-26 18:56:09.818699 MANAGEMENT: CMD 'password [...]'
2019-10-26 18:56:09.827861 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2019-10-26 18:56:09.827898 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2019-10-26 18:56:09.827908 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2019-10-26 18:56:09.827917 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2019-10-26 18:56:09.828150 MANAGEMENT: >STATE:1572108969,RESOLVE,,,,,,
2019-10-26 18:56:09.966342 TCP/UDP: Preserving recently used remote address: [AF_INET]***MY_PI_IP_ADDESS***:10781
2019-10-26 18:56:09.966452 Socket Buffers: R=[786896->786896] S=[9216->9216]
2019-10-26 18:56:09.966486 UDP link local: (not bound)
2019-10-26 18:56:09.966516 UDP link remote: [AF_INET]***MY_PI_IP_ADDESS***:10781
2019-10-26 18:56:09.967145 MANAGEMENT: >STATE:1572108969,WAIT,,,,,,
2019-10-26 18:56:10.082179 MANAGEMENT: >STATE:1572108970,AUTH,,,,,,
2019-10-26 18:56:10.082351 TLS: Initial packet from [AF_INET]***MY_PI_IP_ADDESS***:10781, sid=c3e25291 45046597
2019-10-26 18:56:10.371634 VERIFY OK: depth=1, CN=ChangeMe
2019-10-26 18:56:10.377629 VERIFY KU OK
2019-10-26 18:56:10.379429 Validating certificate extended key usage
2019-10-26 18:56:10.379509 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2019-10-26 18:56:10.379528 VERIFY EKU OK
2019-10-26 18:56:10.379542 VERIFY X509NAME OK: CN=***MYKEY***
2019-10-26 18:56:10.379557 VERIFY OK: depth=0, CN=***MYKEY***
2019-10-26 18:56:10.777863 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-ECDSA-AES256-GCM-SHA384, 384 bit EC, curve: secp384r1
2019-10-26 18:56:10.778088 [***MYKEY***] Peer Connection Initiated with [AF_INET]***MY_PI_IP_ADDESS***:10781
2019-10-26 18:56:11.882160 MANAGEMENT: >STATE:1572108971,GET_CONFIG,,,,,,
2019-10-26 18:56:11.882402 SENT CONTROL [***MYKEY***]: 'PUSH_REQUEST' (status=1)
2019-10-26 18:56:11.978930 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DOMAIN ***MYDOMAIN.COM***,dhcp-option DNS 193.138.218.74,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM'
2019-10-26 18:56:11.979238 OPTIONS IMPORT: timers and/or timeouts modified
2019-10-26 18:56:11.979349 OPTIONS IMPORT: --ifconfig/up options modified
2019-10-26 18:56:11.979407 OPTIONS IMPORT: route options modified
2019-10-26 18:56:11.979433 OPTIONS IMPORT: route-related options modified
2019-10-26 18:56:11.979457 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2019-10-26 18:56:11.979495 OPTIONS IMPORT: peer-id set
2019-10-26 18:56:11.979541 OPTIONS IMPORT: adjusting link_mtu to 1624
2019-10-26 18:56:11.979586 OPTIONS IMPORT: data channel crypto options modified
2019-10-26 18:56:11.980211 Data Channel: using negotiated cipher 'AES-256-GCM'
2019-10-26 18:56:11.980555 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2019-10-26 18:56:11.980641 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2019-10-26 18:56:11.981397 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2019-10-26 18:56:11.981465 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2019-10-26 18:56:11.983174 Opened utun device utun2
2019-10-26 18:56:11.983233 MANAGEMENT: >STATE:1572108971,ASSIGN_IP,,10.8.0.2,,,,
2019-10-26 18:56:11.983267 /sbin/ifconfig utun2 delete
ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2019-10-26 18:56:12.055009 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2019-10-26 18:56:12.055082 /sbin/ifconfig utun2 10.8.0.2 10.8.0.2 netmask 255.255.255.0 mtu 1500 up
2019-10-26 18:56:12.058850 /sbin/route add -net 10.8.0.0 10.8.0.2 255.255.255.0
add net 10.8.0.0: gateway 10.8.0.2
2019-10-26 18:56:12.085462 /sbin/route add -net ***MY_PI_IP_ADDESS*** 10.0.1.1 255.255.255.255
add net 185.9.18.99: gateway 10.0.1.1
2019-10-26 18:56:12.088657 /sbin/route add -net 0.0.0.0 10.8.0.1 128.0.0.0
add net 0.0.0.0: gateway 10.8.0.1
2019-10-26 18:56:12.091560 /sbin/route add -net 128.0.0.0 10.8.0.1 128.0.0.0
add net 128.0.0.0: gateway 10.8.0.1
18:56:12 *Tunnelblick: **********************************************
18:56:12 *Tunnelblick: Start of output from client.up.tunnelblick.sh
18:56:14 *Tunnelblick: Disabled IPv6 for 'LPSS Serial Adapter (1)'
18:56:14 *Tunnelblick: Disabled IPv6 for 'LPSS Serial Adapter (2)'
18:56:14 *Tunnelblick: Disabled IPv6 for 'iPhone USB'
18:56:14 *Tunnelblick: Disabled IPv6 for 'Wi-Fi'
18:56:14 *Tunnelblick: Disabled IPv6 for 'Bluetooth PAN'
18:56:14 *Tunnelblick: Disabled IPv6 for 'Thunderbolt Bridge'
18:56:14 *Tunnelblick: Retrieved from OpenVPN: name server(s) [ 193.138.218.74 ], domain name [ ***MYDOMAIN.COM*** ], search domain(s) [ ], and SMB server(s) [ ]
18:56:14 *Tunnelblick: Not aggregating ServerAddresses because running on macOS 10.6 or higher
18:56:14 *Tunnelblick: Setting search domains to '***MYDOMAIN.COM***' because the search domains were not set manually (or are allowed to be changed) and 'Prepend domain name to search domains' was not selected
18:56:16 *Tunnelblick: Saved the DNS and SMB configurations so they can be restored
18:56:16 *Tunnelblick: Changed DNS ServerAddresses setting from '10.0.1.2' to '193.138.218.74'
18:56:16 *Tunnelblick: Changed DNS SearchDomains setting from '' to '***MYDOMAIN.COM***'
18:56:16 *Tunnelblick: Changed DNS DomainName setting from '' to '***MYDOMAIN.COM***'
18:56:16 *Tunnelblick: Did not change SMB NetBIOSName setting of ''
18:56:16 *Tunnelblick: Did not change SMB Workgroup setting of ''
18:56:16 *Tunnelblick: Did not change SMB WINSAddresses setting of ''
18:56:16 *Tunnelblick: DNS servers '193.138.218.74' will be used for DNS queries when the VPN is active
18:56:16 *Tunnelblick: NOTE: The DNS servers do not include any free public DNS servers known to Tunnelblick. This may cause DNS queries to fail or be intercepted or falsified even if they are directed through the VPN. Specify only known public DNS servers or DNS servers located on the VPN network to avoid such problems.
18:56:16 *Tunnelblick: Flushed the DNS cache via dscacheutil
18:56:16 *Tunnelblick: /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil
18:56:16 *Tunnelblick: Notified mDNSResponder that the DNS cache was flushed
18:56:16 *Tunnelblick: Notified mDNSResponderHelper that the DNS cache was flushed
18:56:16 *Tunnelblick: Setting up to monitor system configuration with process-network-changes
18:56:16 *Tunnelblick: End of output from client.up.tunnelblick.sh
18:56:16 *Tunnelblick: **********************************************
2019-10-26 18:56:16.542052 Initialization Sequence Completed
2019-10-26 18:56:16.542131 MANAGEMENT: >STATE:1572108976,CONNECTED,SUCCESS,10.8.0.2,***MY_PI_IP_ADDESS***,10781,,
2019-10-26 18:56:16.781301 *Tunnelblick: DNS address 193.138.218.74 is being routed through the VPN
2019-10-26 18:57:00.113668 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's name after connecting.
2019-10-26 18:57:38.337792 *Tunnelblick: An error occured fetching IP address information using the ipInfo host's IP address after connecting
2019-10-26 18:57:47.874245 *Tunnelblick: Disconnecting; VPN Details… window disconnect button pressed
2019-10-26 18:57:48.183450 *Tunnelblick: Disconnecting using 'kill'
2019-10-26 18:57:48.353224 event_wait : Interrupted system call (code=4)
2019-10-26 18:57:48.355782 /sbin/route delete -net ***MY_PI_IP_ADDESS*** 10.0.1.1 255.255.255.255
delete net ***MY_PI_IP_ADDESS***: gateway 10.0.1.1
2019-10-26 18:57:48.359204 /sbin/route delete -net 0.0.0.0 10.8.0.1 128.0.0.0
delete net 0.0.0.0: gateway 10.8.0.1
2019-10-26 18:57:48.363474 /sbin/route delete -net 128.0.0.0 10.8.0.1 128.0.0.0
delete net 128.0.0.0: gateway 10.8.0.1
2019-10-26 18:57:48.366139 Closing TUN/TAP interface
2019-10-26 18:57:48.366506 /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -o -w -ptADGNWradsgnw utun2 1500 1552 10.8.0.2 255.255.255.0 init
18:57:48 *Tunnelblick: **********************************************
18:57:48 *Tunnelblick: Start of output from client.down.tunnelblick.sh
18:57:48 *Tunnelblick: Cancelled monitoring system configuration changes
18:57:48 *Tunnelblick: Restored State:DNS
18:57:48 *Tunnelblick: Removed Setup:DNS
18:57:48 *Tunnelblick: Restored DNS and SMB settings
18:57:48 *Tunnelblick: Re-enabled IPv6 (automatic) for "LPSS Serial Adapter (1)"
18:57:48 *Tunnelblick: Re-enabled IPv6 (automatic) for "LPSS Serial Adapter (2)"
18:57:48 *Tunnelblick: Re-enabled IPv6 (automatic) for "iPhone USB"
18:57:48 *Tunnelblick: Re-enabled IPv6 (automatic) for "Wi-Fi"
18:57:48 *Tunnelblick: Re-enabled IPv6 (automatic) for "Bluetooth PAN"
18:57:48 *Tunnelblick: Re-enabled IPv6 (automatic) for "Thunderbolt Bridge"
18:57:49 *Tunnelblick: Flushed the DNS cache with dscacheutil -flushcache
18:57:49 *Tunnelblick: Notified mDNSResponder that the DNS cache was flushed
18:57:49 *Tunnelblick: End of output from client.down.tunnelblick.sh
18:57:49 *Tunnelblick: **********************************************
2019-10-26 18:57:49.615379 SIGTERM[hard,] received, process exiting
2019-10-26 18:57:49.615452 MANAGEMENT: >STATE:1572109069,EXITING,SIGTERM,,,,,
2019-10-26 18:57:50.135446 *Tunnelblick: Expected disconnection occurred.
Needless to say, I am way over my head here. I learned a lot over the past couple of months, but since I am fairly new to the world of Pi and VPN, I just can't figure this one out, no matter what I googled and how much I stared at it. If anyone might know what I am doing wrong or at least the direction in which to head, I'd be very grateful!
Thanks!
