Cannot Fetch IP Address - Errors Connecting to VPN

genlee

I am a self employed American living in China so I have to resolve this problem myself. All the Internet in China must go through a Great Firewall and most of the things that you take for granted (like Google, Facebook, NY Times) are blocked. Individuals living in China with a legitimate reason to communicate with the Internet overseas are allowed to access a VPN server overseas from China. I need help with matching the setup of my VPS with OpenVPN Community Edition and Tunnelblick for Mac OS X.

I can connect to the VPN but it takes a few tries and I inevitably end up with the error message:

"Tunnelblick could not fetch IP address information before the connection to clientname was made."

I am not sure if this is because the Great China Firewall is so good that it is causing this error or because I've messed something up. I think it is probably my fault.

Eventually, after a few minutes or a few tries I am able to connect to the internet, but this error message is slowing down the connection process and worries me that the connection may not be very secure.

I installed OpenVPN using the GitHub OpenVPN install script:

wget https://git.io/vpn -O openvpn-install.sh && bash openvpn-install.sh

which is located here:

https://github.com/Nyr/openvpn-install

I think this is probably the problem because I am pretty sure this script has left out some security settings that are probably necessary. I have no clue how to make these settings.

I have a VPS with OpenVPN 2.4.7-1.e17 installed on a VPS with CentOS7 and TUN activated.

I have Tunnelblick 3.8.1 (build 5400) installed on my MacBook running High Sierra 10.13.6 OS X.

I set up OpenVPN on my server choosing UDP protocol and OpenDNS for DNS rendering.

My client config file ClientName.ovpn is:

client
dev tun
proto udp
remote xx.xxx.xxx.xx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
ignore-unknown-option block-outside-dns
block-outside-dns
verb 3
<ca>
[Security-related line(s) omitted]
</ca>
<cert>
[Security-related line(s) omitted]
</cert>
<key>
[Security-related line(s) omitted]
</key>
<tls-crypt>
[Security-related line(s) omitted]
</tls-crypt>

My Tunnelblick client is configured as:

Connect: Manually
Set DNS/WINS: Set nameserver
OpenVPN version: Default 2.4.7
Monitor network settings: checked
Route all IPv4 traffic through VPN: checked
Disable IPv6 unless VPN server is accessed using IPV6: checked
Check if apparent public IP address changed after connecting: checked

Advanced:
Flush DNS cache after connecting / disconnecting: checked
Allow changes to manually-set network settings: NOT checked
Set DNS after routes are set: checked

Load Tun driver automatically
Load Tap driver automatically

The DNS for my wifi connection is set to OpenDNS servers

genlee

Here is a Log of a recent connection to the VPN from the client side:

2019-10-29 23:20:14.678347 *Tunnelblick: macOS 10.13.6 (17G8037); Tunnelblick 3.8.1 (build 5400)
2019-10-29 23:20:14.825945 *Tunnelblick: Attempting connection with ClientName; Set nameserver = 769; monitoring connection
2019-10-29 23:20:14.826679 *Tunnelblick: openvpnstart start ClientName.tblk 49376 769 0 3 0 1098544 -ptADGNWradsgnw 2.4.7-openssl-1.0.2t
2019-10-29 23:20:14.852848 *Tunnelblick: openvpnstart starting OpenVPN
2019-10-29 23:20:15.144379 Unrecognized option or missing or extra parameter(s) in /Library/Application Support/Tunnelblick/Shared/ClientName.tblk/Contents/Resources/config.ovpn:13: block-outside-dns (2.4.7)
2019-10-29 23:20:15.144703 OpenVPN 2.4.7 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Sep 11 2019
2019-10-29 23:20:15.144722 library versions: OpenSSL 1.0.2t  10 Sep 2019, LZO 2.10
2019-10-29 23:20:15.146356 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:49376
2019-10-29 23:20:15.146393 Need hold release from management interface, waiting...
2019-10-29 23:20:15.451037 *Tunnelblick: openvpnstart log:
     OpenVPN started successfully.
     Command used to start OpenVPN (one argument per displayed line):
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.7-openssl-1.0.2t/openvpn
          --daemon
          --log /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-SClientName.tblk-SContents-SResources-Sconfig.ovpn.769_0_3_0_1098544.49376.openvpn.log
          --cd /Library/Application Support/Tunnelblick/Shared/ClientName.tblk/Contents/Resources
          --machine-readable-output
          --setenv IV_GUI_VER "net.tunnelblick.tunnelblick 5400 3.8.1 (build 5400)"
          --verb 3
          --config /Library/Application Support/Tunnelblick/Shared/ClientName.tblk/Contents/Resources/config.ovpn
          --setenv TUNNELBLICK_CONFIG_FOLDER /Library/Application Support/Tunnelblick/Shared/ClientName.tblk/Contents/Resources
          --verb 3
          --cd /Library/Application Support/Tunnelblick/Shared/ClientName.tblk/Contents/Resources
          --management 127.0.0.1 49376 /Library/Application Support/Tunnelblick/kgmbmcnhcknmcofclpknkagmgkhbmlgfnokdiajf.mip
          --management-query-passwords
          --management-hold
          --redirect-gateway def1
          --script-security 2
          --route-up /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
          --down /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
2019-10-29 23:20:15.460388 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:49376
2019-10-29 23:20:15.480470 MANAGEMENT: CMD 'pid'
2019-10-29 23:20:15.480519 MANAGEMENT: CMD 'auth-retry interact'
2019-10-29 23:20:15.480547 MANAGEMENT: CMD 'state on'
2019-10-29 23:20:15.480567 MANAGEMENT: CMD 'state'
2019-10-29 23:20:15.480599 MANAGEMENT: CMD 'bytecount 1'
2019-10-29 23:20:15.482825 *Tunnelblick: Established communication with OpenVPN
2019-10-29 23:20:15.483908 *Tunnelblick: >INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info
2019-10-29 23:20:15.486900 MANAGEMENT: CMD 'hold release'
2019-10-29 23:20:15.487478 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2019-10-29 23:20:15.489245 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2019-10-29 23:20:15.489274 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2019-10-29 23:20:15.489284 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2019-10-29 23:20:15.489303 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2019-10-29 23:20:15.489432 TCP/UDP: Preserving recently used remote address: [AF_INET]xx.xxx.xxx.xx:1194
2019-10-29 23:20:15.489570 Socket Buffers: R=[196724->196724] S=[9216->9216]
2019-10-29 23:20:15.490840 UDP link local: (not bound)
2019-10-29 23:20:15.491446 UDP link remote: [AF_INET]xx.xxx.xxx.xx:1194
2019-10-29 23:20:15.492225 MANAGEMENT: >STATE:1572362415,WAIT,,,,,,
2019-10-29 23:20:15.853027 MANAGEMENT: >STATE:1572362415,AUTH,,,,,,
2019-10-29 23:20:15.853083 TLS: Initial packet from [AF_INET]xx.xxx.xxx.xx:1194, sid=11853fdd 32373e32
2019-10-29 23:20:16.222586 VERIFY OK: depth=1, CN=ChangeMe
2019-10-29 23:20:16.223909 VERIFY KU OK
2019-10-29 23:20:16.223933 Validating certificate extended key usage
2019-10-29 23:20:16.224006 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2019-10-29 23:20:16.224025 VERIFY EKU OK
2019-10-29 23:20:16.224034 VERIFY OK: depth=0, CN=server
2019-10-29 23:20:16.969597 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
2019-10-29 23:20:16.969632 [server] Peer Connection Initiated with [AF_INET]xx.xxx.xxx.xx:1194
2019-10-29 23:20:18.054478 MANAGEMENT: >STATE:1572362418,GET_CONFIG,,,,,,
2019-10-29 23:20:18.054552 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2019-10-29 23:20:18.414402 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM'
2019-10-29 23:20:18.414568 OPTIONS IMPORT: timers and/or timeouts modified
2019-10-29 23:20:18.414585 OPTIONS IMPORT: --ifconfig/up options modified
2019-10-29 23:20:18.414594 OPTIONS IMPORT: route options modified
2019-10-29 23:20:18.414603 OPTIONS IMPORT: route-related options modified
2019-10-29 23:20:18.414612 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2019-10-29 23:20:18.414621 OPTIONS IMPORT: peer-id set
2019-10-29 23:20:18.414631 OPTIONS IMPORT: adjusting link_mtu to 1624
2019-10-29 23:20:18.414639 OPTIONS IMPORT: data channel crypto options modified
2019-10-29 23:20:18.414650 Data Channel: using negotiated cipher 'AES-256-GCM'
2019-10-29 23:20:18.414854 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2019-10-29 23:20:18.414928 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2019-10-29 23:20:18.416047 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2019-10-29 23:20:18.416219 Opened utun device utun1
2019-10-29 23:20:18.416245 MANAGEMENT: >STATE:1572362418,ASSIGN_IP,,10.8.0.2,,,,
2019-10-29 23:20:18.416265 /sbin/ifconfig utun1 delete
                           ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2019-10-29 23:20:18.422194 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2019-10-29 23:20:18.422296 /sbin/ifconfig utun1 10.8.0.2 10.8.0.2 netmask 255.255.255.0 mtu 1500 up
2019-10-29 23:20:18.425995 /sbin/route add -net 10.8.0.0 10.8.0.2 255.255.255.0
                           add net 10.8.0.0: gateway 10.8.0.2
2019-10-29 23:20:18.431709 /sbin/route add -net xx.xxx.xxx.xx 192.168.5.1 255.255.255.255
                           add net xx.xxx.xxx.xx: gateway 192.168.5.1
2019-10-29 23:20:18.434585 /sbin/route add -net 0.0.0.0 10.8.0.1 128.0.0.0
                           add net 0.0.0.0: gateway 10.8.0.1
2019-10-29 23:20:18.437493 /sbin/route add -net 128.0.0.0 10.8.0.1 128.0.0.0
                           add net 128.0.0.0: gateway 10.8.0.1
                           23:20:18 *Tunnelblick:  **********************************************
                           23:20:18 *Tunnelblick:  Start of output from client.up.tunnelblick.sh
                           23:20:20 *Tunnelblick:  Disabled IPv6 for 'Wi-Fi'
                           23:20:20 *Tunnelblick:  Disabled IPv6 for 'Bluetooth PAN'
                           23:20:20 *Tunnelblick:  Disabled IPv6 for 'Thunderbolt Bridge'
                           23:20:20 *Tunnelblick:  Retrieved from OpenVPN: name server(s) [ 208.67.222.222 208.67.220.220 ], search domain(s) [ ] and SMB server(s) [ ] and using default domain name [ openvpn ]
                           23:20:20 *Tunnelblick:  WARNING: Ignoring ServerAddresses '208.67.222.222 208.67.220.220' because ServerAddresses was set manually and '-allowChangesToManuallySetNetworkSettings' was not specified
                           23:20:20 *Tunnelblick:  Setting search domains to 'openvpn' because the search domains were not set manually (or are allowed to be changed) and 'Prepend domain name to search domains' was not selected
                           23:20:22 *Tunnelblick:  Saved the DNS and SMB configurations so they can be restored
                           23:20:22 *Tunnelblick:  Did not change DNS ServerAddresses setting of '208.67.222.222 208.67.220.220' (but re-set it)
                           23:20:22 *Tunnelblick:  Changed DNS SearchDomains setting from '' to 'openvpn'
                           23:20:22 *Tunnelblick:  Changed DNS DomainName setting from '' to 'openvpn'
                           23:20:22 *Tunnelblick:  Did not change SMB NetBIOSName setting of ''
                           23:20:22 *Tunnelblick:  Did not change SMB Workgroup setting of ''
                           23:20:22 *Tunnelblick:  Did not change SMB WINSAddresses setting of ''
                           23:20:22 *Tunnelblick:  DNS servers '208.67.222.222 208.67.220.220' were set manually
                           23:20:22 *Tunnelblick:  DNS servers '208.67.222.222 208.67.220.220' will be used for DNS queries when the VPN is active
                           23:20:22 *Tunnelblick:  The DNS servers include only free public DNS servers known to Tunnelblick.
                           23:20:22 *Tunnelblick:  Flushed the DNS cache via dscacheutil
                           23:20:22 *Tunnelblick:  /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil
                           23:20:22 *Tunnelblick:  Notified mDNSResponder that the DNS cache was flushed
                           23:20:22 *Tunnelblick:  Not notifying mDNSResponderHelper that the DNS cache was flushed because it is not running
                           23:20:22 *Tunnelblick:  Setting up to monitor system configuration with process-network-changes
                           23:20:22 *Tunnelblick:  End of output from client.up.tunnelblick.sh
                           23:20:22 *Tunnelblick:  **********************************************
2019-10-29 23:20:22.569730 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2019-10-29 23:20:22.569778 Initialization Sequence Completed
2019-10-29 23:20:22.569875 MANAGEMENT: >STATE:1572362422,CONNECTED,SUCCESS,10.8.0.2,xx.xxx.xxx.xx,1194,,
2019-10-29 23:20:22.719569 *Tunnelblick: Could not determine this computer's apparent public IP address before the connection was completed
2019-10-29 23:20:27.211095 *Tunnelblick: process-network-changes: A system configuration change was ignored
2019-10-29 23:20:36.601493 *Tunnelblick: DNS address 208.67.220.220 is being routed through the VPN
2019-10-29 23:20:36.602311 *Tunnelblick: DNS address 208.67.222.222 is being routed through the VPN

Here is the CentOS 7 OpenVPN Server Configuration file location in /etc/openvpn/server/server.conf :

local xx.xxx.xxx.xx
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
explicit-exit-notify

Here is the OpenVPN Server Log file location in /etc/openvpn/server/openvpn-status.log:

 TITLE,OpenVPN 2.4.7 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
TIME,Tue Oct 29 13:40:42 2019,1572370842
HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Virtual IPv6 Address,Bytes Received,Bytes Sent,Connected Since,Connected Since (time_t),Username,Client ID,Peer ID
CLIENT_LIST,ClientName,yy.yyy.yyy.yy:13701,10.8.0.2,,10920159,82760967,Tue Oct 29 12:13:28 2019,1572365608,UNDEF,51,0
HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last Ref,Last Ref (time_t)
ROUTING_TABLE,10.8.0.2,ClientName,yy.yyy.yyy.yy:13701,Tue Oct 29 13:40:41 2019,1572370841
GLOBAL_STATS,Max bcast/mcast queue length,0
END

TinCanTech

Are you saying there is something wrong with Nyr's script ..

genlee

Yes, I guess so. What I am saying is every time I connect I get errors.

The logs are giving me flags saying some parts of the configuration are not set.

And maybe the problem is with the settings on my client, which need to match the Server Settings, so maybe the problem is some directions need to be added to the script to define how to set up the client side so there are no errors.

genlee

I did a netstat -nr on my MacBook and came up with these results:

netstat -nr
Routing tables

Internet:
Destination Gateway Flags Refs Use Netif Expire
0/1 10.8.0.1 UGSc 56 0 utun1
default 192.168.5.1 UGSc 0 0 en0
10.8/24 10.8.0.2 UGSc 18 0 utun1
10.8.0.2 10.8.0.2 UH 1 0 utun1
xx.xxx.xxx.xx/32 192.168.5.1 UGSc 1 0 en0
127 127.0.0.1 UCS 0 0 lo0
127.0.0.1 127.0.0.1 UH 4 33933 lo0
128.0/1 10.8.0.1 UGSc 7 4 utun1
169.254 link#5 UCS 0 0 en0
192.168.5 link#5 UCS 0 0 en0
192.168.5.1/32 link#5 UCS 1 0 en0
192.168.5.1 7c:39:53:92:c1:98 UHLWIir 4 56 en0 1127
192.168.5.5/32 link#5 UCS 0 0 en0
224.0.0/4 link#5 UmCS 2 0 en0
224.0.0.251 1:0:5e:0:0:fb UHmLWI 0 0 en0
239.255.255.250 1:0:5e:7f:ff:fa UHmLWI 0 330 en0
255.255.255.255/32 link#5 UCS 0 0 en0

Internet6:
Destination Gateway Flags Netif Expire
default fe80::%utun0 UGcI utun0
::1 ::1 UHL lo0
fe80::%lo0/64 fe80::1%lo0 UcI lo0
fe80::1%lo0 link#1 UHLI lo0
fe80::%awdl0/64 link#7 UCI awdl0
fe80::80f0:c1ff:fe6a:430e%awdl0 82:f0:c1:6a:43:e UHLI lo0
fe80::%utun0/64 fe80::3181:de3:2996:ff94%utun0 UcI utun0
fe80::3181:de3:2996:ff94%utun0 link#11 UHLI lo0
ff01::%lo0/32 ::1 UmCI lo0
ff01::%awdl0/32 link#7 UmCI awdl0
ff01::%utun0/32 fe80::3181:de3:2996:ff94%utun0 UmCI utun0
ff02::%lo0/32 ::1 UmCI lo0
ff02::%awdl0/32 link#7 UmCI awdl0
ff02::%utun0/32 fe80::3181:de3:2996:ff94%utun0 UmCI utun0

I did a iptables -L -t nat -v on the server and came up with these results:

[root@server ~]# iptables -L -t nat -v
Chain PREROUTING (policy ACCEPT 14002 packets, 1073K bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 438 packets, 27724 bytes)
pkts bytes target prot opt in out source destination
8418 647K SNAT all -- any any 10.8.0.0/24 !10.8.0.0/24 to:xx.xxx.xxx.xx

Chain OUTPUT (policy ACCEPT 438 packets, 27724 bytes)
pkts bytes target prot opt in out source destination

Some problems I see which I don't understand:

1. "Tunnelblick: DNS address 208.67.220.220 is being routed through the VPN" Would it be better if I used the DNS on the other end of the VPN to handle DNS? If so how might you tell me what setting to change for Tunnelblick?

2. Mainly how to configure OpenVPN to get rid of the message "Tunnelblick could not fetch IP address information before the connection to ClientName was made."

Thanks to ALL who help!

genlee

I've researched using Google and in one other instance when this error appeared the user did "Nothing" and the error just went away.

This has happened to me. The error has just disappeared on its own. So my only advice would be if you are connecting to the VPN OK then ... don't worry about it.

Because I am in China this may be a Man-In-The-Middle attack. If anybody can comment on this ... that would be

Replaced with a new "Unrecognized option or missing or extra parameter(s)" error which I will post a clean post.