"Unrecognized option or missing or extra parameter(s)" - Slow VPN Connection Speed

genlee

I have a VPS with OpenVPN 2.4.7-1.e17 installed on CentOS7 with TUN activated located in Michigan, USA. I am connecting to the VPN from Shanghai, China using Tunnelblick 3.8.1 (build 5400) installed on my MacBook with High Sierra 10.13.6.

I am connecting fine, without any errors. Originally I was getting a "Tunnelblick could not fetch IP address information before the connection to clientname was made." error. I did nothing to the configuration but the error just topped. Now every time I disconnect I get the error:

"Unrecognized option or missing or extra parameter(s)"

My Client Configuration is:

client
dev tun
proto udp
remote xx.xxx.xxx.xx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
ignore-unknown-option block-outside-dns
block-outside-dns
verb 3
<ca>

My Server Configuration is:

local xx.xxx.xxx.xx
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
"server.conf" 26L, 479C

I will post the client and server logs on the next post.

genlee

There error I receive in Tunnelblick is:

"Unrecognized option or missing or extra parameter(s)".

This error means that an option that is contained in the OpenVPN configuration file or was "pushed" by the OpenVPN server:

     • has been misspelled,

     • has missing or extra arguments, or

     • is not implemented by the version of OpenVPN which is being used for this configuration. It may be a new option that is not implemented in an old version of OpenVPN, or an old option that has been removed in a new version of OpenVPN. You can choose what version of OpenVPN to use with this configuration in the "Settings" tab of the "Configurations" panel of Tunnelblick's "VPN Details" window.

See the VPN log in the "Log" tab of the "Configurations" panel of Tunnelblick's "VPN Details" window for details.

The Client Log is:

2019-11-02 09:06:14.122491 *Tunnelblick: macOS 10.13.6 (17G8037); Tunnelblick 3.8.1 (build 5400)
2019-11-02 09:06:14.433189 *Tunnelblick: Attempting connection with client; Set nameserver = 769; monitoring connection
2019-11-02 09:06:14.433757 *Tunnelblick: openvpnstart start client.tblk 62603 769 0 3 0 1098544 -ptADGNWradsgnw 2.4.7-openssl-1.0.2t
2019-11-02 09:06:14.459281 *Tunnelblick: openvpnstart starting OpenVPN
2019-11-02 09:06:14.656115 Unrecognized option or missing or extra parameter(s) in /Library/Application Support/Tunnelblick/Shared/client.tblk/Contents/Resources/config.ovpn:13: block-outside-dns (2.4.7)
2019-11-02 09:06:14.656520 OpenVPN 2.4.7 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Sep 11 2019
2019-11-02 09:06:14.656544 library versions: OpenSSL 1.0.2t  10 Sep 2019, LZO 2.10
2019-11-02 09:06:14.658225 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:62603
2019-11-02 09:06:14.658257 Need hold release from management interface, waiting...
2019-11-02 09:06:15.058166 *Tunnelblick: openvpnstart log:
     OpenVPN started successfully.
     Command used to start OpenVPN (one argument per displayed line):
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.7-openssl-1.0.2t/openvpn
          --daemon
          --log /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-Sclient.tblk-SContents-SResources-Sconfig.ovpn.769_0_3_0_1098544.62603.openvpn.log
          --cd /Library/Application Support/Tunnelblick/Shared/client.tblk/Contents/Resources
          --machine-readable-output
          --setenv IV_GUI_VER "net.tunnelblick.tunnelblick 5400 3.8.1 (build 5400)"
          --verb 3
          --config /Library/Application Support/Tunnelblick/Shared/client.tblk/Contents/Resources/config.ovpn
          --setenv TUNNELBLICK_CONFIG_FOLDER /Library/Application Support/Tunnelblick/Shared/client.tblk/Contents/Resources
          --verb 3
          --cd /Library/Application Support/Tunnelblick/Shared/client.tblk/Contents/Resources
          --management 127.0.0.1 62603 /Library/Application Support/Tunnelblick/kgmbmcnhcknmcofclpknkagmgkhbmlgfnokdiajf.mip
          --management-query-passwords
          --management-hold
          --redirect-gateway def1
          --script-security 2
          --route-up /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
          --down /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
2019-11-02 09:06:15.068173 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:62603
2019-11-02 09:06:15.086450 MANAGEMENT: CMD 'pid'
2019-11-02 09:06:15.086641 MANAGEMENT: CMD 'auth-retry interact'
2019-11-02 09:06:15.087148 MANAGEMENT: CMD 'state on'
2019-11-02 09:06:15.087193 MANAGEMENT: CMD 'state'
2019-11-02 09:06:15.087288 MANAGEMENT: CMD 'bytecount 1'
2019-11-02 09:06:15.089195 *Tunnelblick: Established communication with OpenVPN
2019-11-02 09:06:15.090395 *Tunnelblick: >INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info
2019-11-02 09:06:15.093292 MANAGEMENT: CMD 'hold release'
2019-11-02 09:06:15.093629 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2019-11-02 09:06:15.096980 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2019-11-02 09:06:15.097043 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2019-11-02 09:06:15.097059 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2019-11-02 09:06:15.097073 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2019-11-02 09:06:15.097296 TCP/UDP: Preserving recently used remote address: [AF_INET]xx.xxx.xxx.xx:1194
2019-11-02 09:06:15.097691 Socket Buffers: R=[196724->196724] S=[9216->9216]
2019-11-02 09:06:15.098730 UDP link local: (not bound)
2019-11-02 09:06:15.098793 UDP link remote: [AF_INET]xx.xxx.xxx.xx:1194
2019-11-02 09:06:15.098862 MANAGEMENT: >STATE:1572656775,WAIT,,,,,,
2019-11-02 09:06:15.465512 MANAGEMENT: >STATE:1572656775,AUTH,,,,,,
2019-11-02 09:06:15.465556 TLS: Initial packet from [AF_INET]xx.xxx.xxx.xx:1194, sid=ebd88e97 36639ded
2019-11-02 09:06:15.826964 VERIFY OK: depth=1, CN=ChangeMe
2019-11-02 09:06:15.827879 VERIFY KU OK
2019-11-02 09:06:15.827911 Validating certificate extended key usage
2019-11-02 09:06:15.827986 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2019-11-02 09:06:15.828047 VERIFY EKU OK
2019-11-02 09:06:15.828069 VERIFY OK: depth=0, CN=server
2019-11-02 09:06:16.560699 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
2019-11-02 09:06:16.560759 [server] Peer Connection Initiated with [AF_INET]xx.xxx.xxx.xx:1194
2019-11-02 09:06:17.683795 MANAGEMENT: >STATE:1572656777,GET_CONFIG,,,,,,
2019-11-02 09:06:17.683863 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2019-11-02 09:06:18.115426 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM'
2019-11-02 09:06:18.115549 OPTIONS IMPORT: timers and/or timeouts modified
2019-11-02 09:06:18.115561 OPTIONS IMPORT: --ifconfig/up options modified
2019-11-02 09:06:18.115567 OPTIONS IMPORT: route options modified
2019-11-02 09:06:18.115574 OPTIONS IMPORT: route-related options modified
2019-11-02 09:06:18.115581 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2019-11-02 09:06:18.115587 OPTIONS IMPORT: peer-id set
2019-11-02 09:06:18.115594 OPTIONS IMPORT: adjusting link_mtu to 1624
2019-11-02 09:06:18.115600 OPTIONS IMPORT: data channel crypto options modified
2019-11-02 09:06:18.115608 Data Channel: using negotiated cipher 'AES-256-GCM'
2019-11-02 09:06:18.115722 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2019-11-02 09:06:18.115776 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2019-11-02 09:06:18.117008 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2019-11-02 09:06:18.117359 Opened utun device utun1
2019-11-02 09:06:18.117380 MANAGEMENT: >STATE:1572656778,ASSIGN_IP,,10.8.0.2,,,,
2019-11-02 09:06:18.117392 /sbin/ifconfig utun1 delete
                           ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2019-11-02 09:06:18.124657 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2019-11-02 09:06:18.124741 /sbin/ifconfig utun1 10.8.0.2 10.8.0.2 netmask 255.255.255.0 mtu 1500 up
2019-11-02 09:06:18.128167 /sbin/route add -net 10.8.0.0 10.8.0.2 255.255.255.0
                           add net 10.8.0.0: gateway 10.8.0.2
2019-11-02 09:06:18.132390 /sbin/route add -net xx.xxx.xxx.xx 192.168.5.1 255.255.255.255
                           add net xx.xxx.xxx.xx: gateway 192.168.5.1
2019-11-02 09:06:18.136123 /sbin/route add -net 0.0.0.0 10.8.0.1 128.0.0.0
                           add net 0.0.0.0: gateway 10.8.0.1
2019-11-02 09:06:18.140215 /sbin/route add -net 128.0.0.0 10.8.0.1 128.0.0.0
                           add net 128.0.0.0: gateway 10.8.0.1
                           09:06:18 *Tunnelblick:  **********************************************
                           09:06:18 *Tunnelblick:  Start of output from client.up.tunnelblick.sh
                           09:06:20 *Tunnelblick:  Disabled IPv6 for 'Wi-Fi'
                           09:06:20 *Tunnelblick:  Disabled IPv6 for 'Bluetooth PAN'
                           09:06:20 *Tunnelblick:  Disabled IPv6 for 'Thunderbolt Bridge'
                           09:06:20 *Tunnelblick:  Retrieved from OpenVPN: name server(s) [ 208.67.222.222 208.67.220.220 ], search domain(s) [ ] and SMB server(s) [ ] and using default domain name [ openvpn ]
                           09:06:20 *Tunnelblick:  WARNING: Ignoring ServerAddresses '208.67.222.222 208.67.220.220' because ServerAddresses was set manually and '-allowChangesToManuallySetNetworkSettings' was not specified
                           09:06:20 *Tunnelblick:  Setting search domains to 'openvpn' because the search domains were not set manually (or are allowed to be changed) and 'Prepend domain name to search domains' was not selected
                           09:06:22 *Tunnelblick:  Saved the DNS and SMB configurations so they can be restored
                           09:06:22 *Tunnelblick:  Did not change DNS ServerAddresses setting of '208.67.222.222 208.67.220.220' (but re-set it)
                           09:06:22 *Tunnelblick:  Changed DNS SearchDomains setting from '' to 'openvpn'
                           09:06:22 *Tunnelblick:  Changed DNS DomainName setting from '' to 'openvpn'
                           09:06:22 *Tunnelblick:  Did not change SMB NetBIOSName setting of ''
                           09:06:22 *Tunnelblick:  Did not change SMB Workgroup setting of ''
                           09:06:22 *Tunnelblick:  Did not change SMB WINSAddresses setting of ''
                           09:06:22 *Tunnelblick:  DNS servers '208.67.222.222 208.67.220.220' were set manually
                           09:06:22 *Tunnelblick:  DNS servers '208.67.222.222 208.67.220.220' will be used for DNS queries when the VPN is active
                           09:06:22 *Tunnelblick:  The DNS servers include only free public DNS servers known to Tunnelblick.
                           09:06:22 *Tunnelblick:  Flushed the DNS cache via dscacheutil
                           09:06:22 *Tunnelblick:  /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil
                           09:06:22 *Tunnelblick:  Notified mDNSResponder that the DNS cache was flushed
                           09:06:22 *Tunnelblick:  Not notifying mDNSResponderHelper that the DNS cache was flushed because it is not running
                           09:06:22 *Tunnelblick:  Setting up to monitor system configuration with process-network-changes
                           09:06:22 *Tunnelblick:  End of output from client.up.tunnelblick.sh
                           09:06:22 *Tunnelblick:  **********************************************
2019-11-02 09:06:22.629261 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2019-11-02 09:06:22.630003 Initialization Sequence Completed
2019-11-02 09:06:22.630965 MANAGEMENT: >STATE:1572656782,CONNECTED,SUCCESS,10.8.0.2,xx.xxx.xxx.xx,1194,,
2019-11-02 09:06:22.778174 *Tunnelblick: Could not determine this computer's apparent public IP address before the connection was completed
2019-11-02 09:06:22.843906 *Tunnelblick: DNS address 208.67.220.220 is being routed through the VPN
2019-11-02 09:06:22.946893 *Tunnelblick: DNS address 208.67.222.222 is being routed through the VPN
2019-11-02 09:06:27.388962 *Tunnelblick: process-network-changes: A system configuration change was ignored
2019-11-02 09:07:50.582335 *Tunnelblick: Disconnecting; notification window disconnect button pressed
2019-11-02 09:07:50.888176 *Tunnelblick: Disconnecting using 'kill'
2019-11-02 09:07:51.051749 event_wait : Interrupted system call (code=4)
2019-11-02 09:07:51.053314 /sbin/route delete -net xx.xxx.xxx.xx 192.168.5.1 255.255.255.255
                           delete net xx.xxx.xxx.xx: gateway 192.168.5.1
2019-11-02 09:07:51.058031 /sbin/route delete -net 0.0.0.0 10.8.0.1 128.0.0.0
                           delete net 0.0.0.0: gateway 10.8.0.1
2019-11-02 09:07:51.063785 /sbin/route delete -net 128.0.0.0 10.8.0.1 128.0.0.0
                           delete net 128.0.0.0: gateway 10.8.0.1
2019-11-02 09:07:51.068420 Closing TUN/TAP interface
2019-11-02 09:07:51.068868 /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw utun1 1500 1552 10.8.0.2 255.255.255.0 init
                           09:07:51 *Tunnelblick:  **********************************************
                           09:07:51 *Tunnelblick:  Start of output from client.down.tunnelblick.sh
                           09:07:51 *Tunnelblick:  Cancelled monitoring system configuration changes
                           09:07:51 *Tunnelblick:  Restored State:DNS
                           09:07:51 *Tunnelblick:  Restored Setup:DNS
                           09:07:51 *Tunnelblick:  Restored DNS and SMB settings
                           09:07:51 *Tunnelblick:  Re-enabled IPv6 (automatic) for "Wi-Fi"
                           09:07:51 *Tunnelblick:  Re-enabled IPv6 (automatic) for "Bluetooth PAN"
                           09:07:51 *Tunnelblick:  Re-enabled IPv6 (automatic) for "Thunderbolt Bridge"
                           09:07:51 *Tunnelblick:  Flushed the DNS cache with dscacheutil -flushcache
                           09:07:51 *Tunnelblick:  Notified mDNSResponder that the DNS cache was flushed
                           09:07:51 *Tunnelblick:  End of output from client.down.tunnelblick.sh
                           09:07:51 *Tunnelblick:  **********************************************
2019-11-02 09:07:51.735742 SIGTERM[hard,] received, process exiting
2019-11-02 09:07:51.735792 MANAGEMENT: >STATE:1572656871,EXITING,SIGTERM,,,,,
2019-11-02 09:07:51.989840 *Tunnelblick: Expected disconnection occurred.

The Server Log is:

TITLE,OpenVPN 2.4.7 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
TIME,Fri Nov  1 20:59:29 2019,1572656369
HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Virtual IPv6 Address,Bytes Received,Bytes Sent,Connected Since,Connected Since (time_t),Username,Client ID,Peer ID
CLIENT_LIST,client,yyy.yy.yyy.yy:14128,10.8.0.2,,33249449,11581940,Fri Nov  1 20:18:36 2019,1572653916,UNDEF,4,1
HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last Ref,Last Ref (time_t)
ROUTING_TABLE,10.8.0.2,client,xxx.xx.xxx.xx:14128,Fri Nov  1 20:59:27 2019,1572656367
GLOBAL_STATS,Max bcast/mcast queue length,0
END