Cannot access external internet on OpenVPN TUN configuration (can connect and access local devices)

JoshHeng

I am unable to access the external internet on my OpenVPN server running on Raspbian.

I am able to ping 10.8.0.1 and access devices on my LAN (e.g. the router/default gateway), but cannot ping external websites such as 8.8.8.8 or 1.1.1.1
I am also running a TAP configuration with ethernet bridging separately, and this works (I need this TUN configuration for mobile clients).

Note that for the logs below, I am connecting the client on my local network, however this also does not work if connecting from a remote network.
My Configuration & Logs
Server Configuration

port 80
proto tcp
port-share 127.0.0.1 4546
#4546 is nginx
tls-server
mode server

dev tun

ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh.pem

topology subnet

server 10.8.0.0 255.255.255.0
#server-bridge 192.168.1.160 255.255.255.0 192.168.1.220 192.168.1.240

push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.1.1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "route 192.168.1.0 255.255.255.0"
client-to-client

keepalive 10 120

tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC

compress lz4-v2
push "compress lz4-v2"

user nobody
group nogroup

persist-key
persist-tun

#status /var/log/openvpn/openvpn-status2.log
log /var/log/openvpn/openvpn2-new.log
log-append /var/log/openvpn/openvpn2-new.log

verb 4
mute 20

#explicit-exit-notify 1

Other Server Config

iptables firewall flushed
/proc/sys/net/ipv4/ip_forward = 1

Operating System

uname -a
Linux PiServer 4.19.66-v7+ #1253 SMP Thu Aug 15 11:49:46 BST 2019 armv7l GNU/Linux

Network Config

ifconfig
eth0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST>  mtu 1500
        inet 192.168.1.160  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 fe80::a6fb:5573:eeb4:4855  prefixlen 64  scopeid 0x20<link>
        ether b8:27:eb:14:b9:50  txqueuelen 1000  (Ethernet)
        RX packets 49497601  bytes 1295282281 (1.2 GiB)
        RX errors 66  dropped 0  overruns 0  frame 0
        TX packets 41638866  bytes 925128660 (882.2 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 332367  bytes 302808462 (288.7 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 332367  bytes 302808462 (288.7 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Server Log

Sun Nov  3 21:11:36 2019 us=295806 Current Parameter Settings:
Sun Nov  3 21:11:36 2019 us=296149   config = 'server2.conf'
Sun Nov  3 21:11:36 2019 us=296228   mode = 1
Sun Nov  3 21:11:36 2019 us=296296   persist_config = DISABLED
Sun Nov  3 21:11:36 2019 us=296365   persist_mode = 1
Sun Nov  3 21:11:36 2019 us=296433   show_ciphers = DISABLED
Sun Nov  3 21:11:36 2019 us=296500   show_digests = DISABLED
Sun Nov  3 21:11:36 2019 us=296566   show_engines = DISABLED
Sun Nov  3 21:11:36 2019 us=296633   genkey = DISABLED
Sun Nov  3 21:11:36 2019 us=296700   key_pass_file = '[UNDEF]'
Sun Nov  3 21:11:36 2019 us=296766   show_tls_ciphers = DISABLED
Sun Nov  3 21:11:36 2019 us=296836   connect_retry_max = 0
Sun Nov  3 21:11:36 2019 us=296903 Connection profiles [0]:
Sun Nov  3 21:11:36 2019 us=296972   proto = tcp-server
Sun Nov  3 21:11:36 2019 us=297037   local = '[UNDEF]'
Sun Nov  3 21:11:36 2019 us=297104   local_port = '80'
Sun Nov  3 21:11:36 2019 us=297169   remote = '[UNDEF]'
Sun Nov  3 21:11:36 2019 us=297236   remote_port = '80'
Sun Nov  3 21:11:36 2019 us=297301   remote_float = DISABLED
Sun Nov  3 21:11:36 2019 us=297368   bind_defined = DISABLED
Sun Nov  3 21:11:36 2019 us=297433 NOTE: --mute triggered...
Sun Nov  3 21:11:36 2019 us=297544 272 variation(s) on previous 20 message(s) suppressed by --mute
Sun Nov  3 21:11:36 2019 us=297616 OpenVPN 2.4.7 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
Sun Nov  3 21:11:36 2019 us=297725 library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.10
Sun Nov  3 21:11:36 2019 us=298796 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Sun Nov  3 21:11:36 2019 us=300717 Diffie-Hellman initialized with 2048 bit key
Sun Nov  3 21:11:36 2019 us=304027 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Nov  3 21:11:36 2019 us=304171 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Nov  3 21:11:36 2019 us=304269 TLS-Auth MTU parms [ L:1624 D:1182 EF:68 EB:0 ET:0 EL:3 ]
Sun Nov  3 21:11:36 2019 us=306490 TUN/TAP device tun0 opened
Sun Nov  3 21:11:36 2019 us=306916 TUN/TAP TX queue length set to 100
Sun Nov  3 21:11:36 2019 us=307075 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Sun Nov  3 21:11:36 2019 us=307212 /sbin/ip link set dev tun0 up mtu 1500
Sun Nov  3 21:11:36 2019 us=318979 /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Sun Nov  3 21:11:36 2019 us=329197 Data Channel MTU parms [ L:1624 D:1450 EF:124 EB:406 ET:0 EL:3 ]
Sun Nov  3 21:11:36 2019 us=333049 Could not determine IPv4/IPv6 protocol. Using AF_INET
Sun Nov  3 21:11:36 2019 us=333310 Socket Buffers: R=[87380->87380] S=[16384->16384]
Sun Nov  3 21:11:36 2019 us=333439 Listening for incoming TCP connection on [AF_INET][undef]:80
Sun Nov  3 21:11:36 2019 us=333571 TCPv4_SERVER link local (bound): [AF_INET][undef]:80
Sun Nov  3 21:11:36 2019 us=333645 TCPv4_SERVER link remote: [AF_UNSPEC]
Sun Nov  3 21:11:36 2019 us=333733 GID set to nogroup
Sun Nov  3 21:11:36 2019 us=333824 UID set to nobody
Sun Nov  3 21:11:36 2019 us=335465 MULTI: multi_init called, r=256 v=256
Sun Nov  3 21:11:36 2019 us=335517 PORT SHARE PROXY: proxy starting
Sun Nov  3 21:11:36 2019 us=335720 IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Sun Nov  3 21:11:36 2019 us=335838 MULTI: TCP INIT maxclients=1024 maxevents=1028
Sun Nov  3 21:11:36 2019 us=335939 Initialization Sequence Completed
Sun Nov  3 21:11:40 2019 us=267091 MULTI: multi_create_instance called
Sun Nov  3 21:11:40 2019 us=267519 Re-using SSL/TLS context
Sun Nov  3 21:11:40 2019 us=267660 LZ4v2 compression initializing
Sun Nov  3 21:11:40 2019 us=268210 Control Channel MTU parms [ L:1624 D:1182 EF:68 EB:0 ET:0 EL:3 ]
Sun Nov  3 21:11:40 2019 us=268397 Data Channel MTU parms [ L:1624 D:1450 EF:124 EB:406 ET:0 EL:3 ]
Sun Nov  3 21:11:40 2019 us=268698 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Sun Nov  3 21:11:40 2019 us=268843 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Sun Nov  3 21:11:40 2019 us=269048 TCP connection established with [AF_INET]192.168.1.1:50583
Sun Nov  3 21:11:40 2019 us=269123 TCPv4_SERVER link local: (not bound)
Sun Nov  3 21:11:40 2019 us=269200 TCPv4_SERVER link remote: [AF_INET]192.168.1.1:50583
Sun Nov  3 21:11:41 2019 us=335221 192.168.1.1:50583 TLS: Initial packet from [AF_INET]192.168.1.1:50583, sid=e6818dc3 44884345
Sun Nov  3 21:11:41 2019 us=478332 192.168.1.1:50583 VERIFY OK: depth=1, CN=PiServer
Sun Nov  3 21:11:41 2019 us=479481 192.168.1.1:50583 VERIFY OK: depth=0, CN=JoshVPNiPhone8
Sun Nov  3 21:11:41 2019 us=484846 192.168.1.1:50583 peer info: IV_VER=2.4.7
Sun Nov  3 21:11:41 2019 us=484970 192.168.1.1:50583 peer info: IV_PLAT=mac
Sun Nov  3 21:11:41 2019 us=485006 192.168.1.1:50583 peer info: IV_PROTO=2
Sun Nov  3 21:11:41 2019 us=485038 192.168.1.1:50583 peer info: IV_NCP=2
Sun Nov  3 21:11:41 2019 us=485068 192.168.1.1:50583 peer info: IV_LZ4=1
Sun Nov  3 21:11:41 2019 us=485099 192.168.1.1:50583 peer info: IV_LZ4v2=1
Sun Nov  3 21:11:41 2019 us=485128 192.168.1.1:50583 peer info: IV_LZO=1
Sun Nov  3 21:11:41 2019 us=485158 192.168.1.1:50583 peer info: IV_COMP_STUB=1
Sun Nov  3 21:11:41 2019 us=485189 192.168.1.1:50583 peer info: IV_COMP_STUBv2=1
Sun Nov  3 21:11:41 2019 us=485220 192.168.1.1:50583 peer info: IV_TCPNL=1
Sun Nov  3 21:11:41 2019 us=485252 192.168.1.1:50583 peer info: IV_GUI_VER="net.tunnelblick.tunnelblick_5400_3.8.1__build_5400)"
Sun Nov  3 21:11:41 2019 us=485334 192.168.1.1:50583 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1560', remote='link-mtu 1559'
Sun Nov  3 21:11:41 2019 us=485392 192.168.1.1:50583 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Sun Nov  3 21:11:41 2019 us=489356 192.168.1.1:50583 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Sun Nov  3 21:11:41 2019 us=489431 192.168.1.1:50583 [JoshVPNiPhone8] Peer Connection Initiated with [AF_INET]192.168.1.1:50583
Sun Nov  3 21:11:41 2019 us=489500 JoshVPNiPhone8/192.168.1.1:50583 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Sun Nov  3 21:11:41 2019 us=489627 JoshVPNiPhone8/192.168.1.1:50583 MULTI: Learn: 10.8.0.2 -> JoshVPNiPhone8/192.168.1.1:50583
Sun Nov  3 21:11:41 2019 us=489664 JoshVPNiPhone8/192.168.1.1:50583 MULTI: primary virtual IP for JoshVPNiPhone8/192.168.1.1:50583: 10.8.0.2
Sun Nov  3 21:11:42 2019 us=738503 JoshVPNiPhone8/192.168.1.1:50583 PUSH: Received control message: 'PUSH_REQUEST'
Sun Nov  3 21:11:42 2019 us=738890 JoshVPNiPhone8/192.168.1.1:50583 SENT CONTROL [JoshVPNiPhone8]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 192.168.1.1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 192.168.1.0 255.255.255.0,compress lz4-v2,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Sun Nov  3 21:11:42 2019 us=738973 JoshVPNiPhone8/192.168.1.1:50583 Data Channel: using negotiated cipher 'AES-256-GCM'
Sun Nov  3 21:11:42 2019 us=739094 JoshVPNiPhone8/192.168.1.1:50583 Data Channel MTU parms [ L:1552 D:1450 EF:52 EB:406 ET:0 EL:3 ]
Sun Nov  3 21:11:42 2019 us=739875 JoshVPNiPhone8/192.168.1.1:50583 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sun Nov  3 21:11:42 2019 us=739971 JoshVPNiPhone8/192.168.1.1:50583 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

Client Configuration

##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .ovpn extension #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

tls-client
key-direction 1
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one. On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap
;dev-node tap-bridge

# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
proto tcp
#proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote [domain] 80
remote [domain2] 80
remote [ip] 80

;remote my-server-2 1194

# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
;remote-random

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nogroup

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.

# Verify server certificate by checking that the
# certicate has the correct key usage set.
# This is an important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the keyUsage set to
# digitalSignature, keyEncipherment
# and the extendedKeyUsage to
# serverAuth
# EasyRSA can do this for you.
remote-cert-tls server

# If a tls-auth key is used on the server
# then every client must also have the key.
#tls-auth [inline] 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
# Note that v2.4 client/server will automatically
# negotiate AES-256-GCM in TLS mode.
# See also the ncp-cipher option in the manpage
cipher AES-256-CBC

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
#comp-lzo

# Set log file verbosity.
verb 3

# Silence repeating messages
;mute 20

<ca>
[x]
</ca>

<cert>
[x]
</cert>

<key>
[x]
</key>

<tls-auth>
[x]
</tls-auth>

Client Log

2019-11-03 21:20:46.982261 *Tunnelblick: macOS 10.15 (19A602); Tunnelblick 3.8.1 (build 5400); prior version 3.8.0 (build 5370)
2019-11-03 21:20:47.137964 *Tunnelblick: Attempting connection with JoshVPNiPhone8; Set nameserver = 1025; monitoring connection
2019-11-03 21:20:47.138726 *Tunnelblick: openvpnstart start JoshVPNiPhone8.tblk 58082 1025 0 3 0 1098032 -ptADGNWradsgnw 2.4.7-openssl-1.0.2t
2019-11-03 21:20:47.158573 *Tunnelblick: openvpnstart starting OpenVPN
2019-11-03 21:20:47.321488 Current Parameter Settings:
2019-11-03 21:20:47.321557   config = '/Library/Application Support/Tunnelblick/Shared/JoshVPNiPhone8.tblk/Contents/Resources/config.ovpn'
2019-11-03 21:20:47.321570   mode = 0
2019-11-03 21:20:47.321581   show_ciphers = DISABLED
2019-11-03 21:20:47.321590   show_digests = DISABLED
2019-11-03 21:20:47.321599   show_engines = DISABLED
2019-11-03 21:20:47.321608   genkey = DISABLED
2019-11-03 21:20:47.321617   key_pass_file = '[UNDEF]'
2019-11-03 21:20:47.321626   show_tls_ciphers = DISABLED
2019-11-03 21:20:47.321635   connect_retry_max = 0
2019-11-03 21:20:47.321645 Connection profiles [0]:
2019-11-03 21:20:47.321654   proto = tcp-client
2019-11-03 21:20:47.321663   local = '[UNDEF]'
2019-11-03 21:20:47.321672   local_port = '[UNDEF]'
2019-11-03 21:20:47.321681   remote = 'vpn.joshheng.co.uk'
2019-11-03 21:20:47.321690   remote_port = '80'
2019-11-03 21:20:47.321699   remote_float = DISABLED
2019-11-03 21:20:47.321708   bind_defined = DISABLED
2019-11-03 21:20:47.321717   bind_local = DISABLED
2019-11-03 21:20:47.321728   bind_ipv6_only = DISABLED
2019-11-03 21:20:47.321738   connect_retry_seconds = 5
2019-11-03 21:20:47.321747   connect_timeout = 120
2019-11-03 21:20:47.321756   xormethod = 0
2019-11-03 21:20:47.321768   xormask = ''
2019-11-03 21:20:47.321777   xormasklen = 0
2019-11-03 21:20:47.321786   socks_proxy_server = '[UNDEF]'
2019-11-03 21:20:47.321795   socks_proxy_port = '[UNDEF]'
2019-11-03 21:20:47.321804   tun_mtu = 1500
2019-11-03 21:20:47.321813   tun_mtu_defined = ENABLED
2019-11-03 21:20:47.321822   link_mtu = 1500
2019-11-03 21:20:47.321831   link_mtu_defined = DISABLED
2019-11-03 21:20:47.321840   tun_mtu_extra = 0
2019-11-03 21:20:47.321849   tun_mtu_extra_defined = DISABLED
2019-11-03 21:20:47.321858   mtu_discover_type = -1
2019-11-03 21:20:47.321867   fragment = 0
2019-11-03 21:20:47.321876   mssfix = 1450
2019-11-03 21:20:47.321885   explicit_exit_notification = 0
2019-11-03 21:20:47.321895 Connection profiles [1]:
2019-11-03 21:20:47.321904   proto = tcp-client
2019-11-03 21:20:47.321913   local = '[UNDEF]'
2019-11-03 21:20:47.321922   local_port = '[UNDEF]'
2019-11-03 21:20:47.321931   remote = 'joshheng.co.uk'
2019-11-03 21:20:47.321939   remote_port = '80'
2019-11-03 21:20:47.321948   remote_float = DISABLED
2019-11-03 21:20:47.321957   bind_defined = DISABLED
2019-11-03 21:20:47.321966   bind_local = DISABLED
2019-11-03 21:20:47.321975   bind_ipv6_only = DISABLED
2019-11-03 21:20:47.321984   connect_retry_seconds = 5
2019-11-03 21:20:47.321993   connect_timeout = 120
2019-11-03 21:20:47.322004   xormethod = 0
2019-11-03 21:20:47.322013   xormask = ''
2019-11-03 21:20:47.322022   xormasklen = 0
2019-11-03 21:20:47.322031   socks_proxy_server = '[UNDEF]'
2019-11-03 21:20:47.322040   socks_proxy_port = '[UNDEF]'
2019-11-03 21:20:47.322049   tun_mtu = 1500
2019-11-03 21:20:47.322058   tun_mtu_defined = ENABLED
2019-11-03 21:20:47.322067   link_mtu = 1500
2019-11-03 21:20:47.322076   link_mtu_defined = DISABLED
2019-11-03 21:20:47.322085   tun_mtu_extra = 0
2019-11-03 21:20:47.322094   tun_mtu_extra_defined = DISABLED
2019-11-03 21:20:47.322103   mtu_discover_type = -1
2019-11-03 21:20:47.322112   fragment = 0
2019-11-03 21:20:47.322121   mssfix = 1450
2019-11-03 21:20:47.322130   explicit_exit_notification = 0
2019-11-03 21:20:47.322139 Connection profiles [2]:
2019-11-03 21:20:47.322148   proto = tcp-client
2019-11-03 21:20:47.322157   local = '[UNDEF]'
2019-11-03 21:20:47.322166   local_port = '[UNDEF]'
2019-11-03 21:20:47.322175   remote = '[x.x.x.x]'
2019-11-03 21:20:47.322184   remote_port = '80'
2019-11-03 21:20:47.322193   remote_float = DISABLED
2019-11-03 21:20:47.322202   bind_defined = DISABLED
2019-11-03 21:20:47.322211   bind_local = DISABLED
2019-11-03 21:20:47.322220   bind_ipv6_only = DISABLED
2019-11-03 21:20:47.322229   connect_retry_seconds = 5
2019-11-03 21:20:47.322239   connect_timeout = 120
2019-11-03 21:20:47.322248   xormethod = 0
2019-11-03 21:20:47.322256   xormask = ''
2019-11-03 21:20:47.322265   xormasklen = 0
2019-11-03 21:20:47.322298   socks_proxy_server = '[UNDEF]'
2019-11-03 21:20:47.322305   socks_proxy_port = '[UNDEF]'
2019-11-03 21:20:47.322311   tun_mtu = 1500
2019-11-03 21:20:47.322317   tun_mtu_defined = ENABLED
2019-11-03 21:20:47.322323   link_mtu = 1500
2019-11-03 21:20:47.322328   link_mtu_defined = DISABLED
2019-11-03 21:20:47.322334   tun_mtu_extra = 0
2019-11-03 21:20:47.322340   tun_mtu_extra_defined = DISABLED
2019-11-03 21:20:47.322346   mtu_discover_type = -1
2019-11-03 21:20:47.322352   fragment = 0
2019-11-03 21:20:47.322357   mssfix = 1450
2019-11-03 21:20:47.322363   explicit_exit_notification = 0
2019-11-03 21:20:47.322369 Connection profiles END
2019-11-03 21:20:47.322375   remote_random = DISABLED
2019-11-03 21:20:47.322424   ipchange = '[UNDEF]'
2019-11-03 21:20:47.322497   dev = 'tun'
2019-11-03 21:20:47.322511   dev_type = '[UNDEF]'
2019-11-03 21:20:47.322519   dev_node = '[UNDEF]'
2019-11-03 21:20:47.322525   lladdr = '[UNDEF]'
2019-11-03 21:20:47.322531   topology = 1
2019-11-03 21:20:47.322537   ifconfig_local = '[UNDEF]'
2019-11-03 21:20:47.322544   ifconfig_remote_netmask = '[UNDEF]'
2019-11-03 21:20:47.322550   ifconfig_noexec = DISABLED
2019-11-03 21:20:47.322556   ifconfig_nowarn = DISABLED
2019-11-03 21:20:47.322562   ifconfig_ipv6_local = '[UNDEF]'
2019-11-03 21:20:47.322568   ifconfig_ipv6_netbits = 0
2019-11-03 21:20:47.322574   ifconfig_ipv6_remote = '[UNDEF]'
2019-11-03 21:20:47.322580   shaper = 0
2019-11-03 21:20:47.322586   mtu_test = 0
2019-11-03 21:20:47.322592   mlock = DISABLED
2019-11-03 21:20:47.322598   keepalive_ping = 0
2019-11-03 21:20:47.322604   keepalive_timeout = 0
2019-11-03 21:20:47.322610   inactivity_timeout = 0
2019-11-03 21:20:47.322616   ping_send_timeout = 0
2019-11-03 21:20:47.322622   ping_rec_timeout = 0
2019-11-03 21:20:47.322628   ping_rec_timeout_action = 0
2019-11-03 21:20:47.322638   ping_timer_remote = DISABLED
2019-11-03 21:20:47.322644   remap_sigusr1 = 0
2019-11-03 21:20:47.322650   persist_tun = ENABLED
2019-11-03 21:20:47.322656   persist_local_ip = DISABLED
2019-11-03 21:20:47.322662   persist_remote_ip = DISABLED
2019-11-03 21:20:47.322667   persist_key = ENABLED
2019-11-03 21:20:47.322673   passtos = DISABLED
2019-11-03 21:20:47.322679   resolve_retry_seconds = 1000000000
2019-11-03 21:20:47.322685   resolve_in_advance = DISABLED
2019-11-03 21:20:47.322691   username = '[UNDEF]'
2019-11-03 21:20:47.322697   groupname = '[UNDEF]'
2019-11-03 21:20:47.322703   chroot_dir = '[UNDEF]'
2019-11-03 21:20:47.322709   cd_dir = '/Library/Application Support/Tunnelblick/Shared/JoshVPNiPhone8.tblk/Contents/Resources'
2019-11-03 21:20:47.322715   writepid = '[UNDEF]'
2019-11-03 21:20:47.322721   up_script = '[UNDEF]'
2019-11-03 21:20:47.322727   down_script = '/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw'
2019-11-03 21:20:47.322734   down_pre = DISABLED
2019-11-03 21:20:47.322739   up_restart = DISABLED
2019-11-03 21:20:47.322746   up_delay = DISABLED
2019-11-03 21:20:47.322751   daemon = ENABLED
2019-11-03 21:20:47.322757   inetd = 0
2019-11-03 21:20:47.322763   log = ENABLED
2019-11-03 21:20:47.322769   suppress_timestamps = DISABLED
2019-11-03 21:20:47.322775   machine_readable_output = ENABLED
2019-11-03 21:20:47.322781   nice = 0
2019-11-03 21:20:47.322787   verbosity = 4
2019-11-03 21:20:47.322793   mute = 0
2019-11-03 21:20:47.322799   status_file = '[UNDEF]'
2019-11-03 21:20:47.322805   status_file_version = 1
2019-11-03 21:20:47.322811   status_file_update_freq = 60
2019-11-03 21:20:47.322817   occ = ENABLED
2019-11-03 21:20:47.322823   rcvbuf = 0
2019-11-03 21:20:47.322829   sndbuf = 0
2019-11-03 21:20:47.322835   sockflags = 0
2019-11-03 21:20:47.322840   fast_io = DISABLED
2019-11-03 21:20:47.322846   comp.alg = 0
2019-11-03 21:20:47.322852   comp.flags = 0
2019-11-03 21:20:47.322858   route_script = '/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw'
2019-11-03 21:20:47.322864   route_default_gateway = '[UNDEF]'
2019-11-03 21:20:47.322870   route_default_metric = 0
2019-11-03 21:20:47.322899   route_noexec = DISABLED
2019-11-03 21:20:47.322921   route_delay = 0
2019-11-03 21:20:47.322926   route_delay_window = 30
2019-11-03 21:20:47.322931   route_delay_defined = DISABLED
2019-11-03 21:20:47.322936   route_nopull = DISABLED
2019-11-03 21:20:47.322941   route_gateway_via_dhcp = DISABLED
2019-11-03 21:20:47.322946   allow_pull_fqdn = DISABLED
2019-11-03 21:20:47.322951   management_addr = '127.0.0.1'
2019-11-03 21:20:47.322956   management_port = '58082'
2019-11-03 21:20:47.322961   management_user_pass = '/Library/Application Support/Tunnelblick/jlkipmcbikaeohpidmbbippjakcbkbpjmpbgpebp.mip'
2019-11-03 21:20:47.322967   management_log_history_cache = 250
2019-11-03 21:20:47.322972   management_echo_buffer_size = 100
2019-11-03 21:20:47.322977   management_write_peer_info_file = '[UNDEF]'
2019-11-03 21:20:47.322983   management_client_user = '[UNDEF]'
2019-11-03 21:20:47.322988   management_client_group = '[UNDEF]'
2019-11-03 21:20:47.322993   management_flags = 6
2019-11-03 21:20:47.322998   shared_secret_file = '[UNDEF]'
2019-11-03 21:20:47.323003   key_direction = 1
2019-11-03 21:20:47.323008   ciphername = 'AES-256-CBC'
2019-11-03 21:20:47.323015   ncp_enabled = ENABLED
2019-11-03 21:20:47.323021   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
2019-11-03 21:20:47.323026   authname = 'SHA1'
2019-11-03 21:20:47.323031   prng_hash = 'SHA1'
2019-11-03 21:20:47.323036   prng_nonce_secret_len = 16
2019-11-03 21:20:47.323041   keysize = 0
2019-11-03 21:20:47.323046   engine = DISABLED
2019-11-03 21:20:47.323051   replay = ENABLED
2019-11-03 21:20:47.323056   mute_replay_warnings = DISABLED
2019-11-03 21:20:47.323061   replay_window = 64
2019-11-03 21:20:47.323066   replay_time = 15
2019-11-03 21:20:47.323071   packet_id_file = '[UNDEF]'
2019-11-03 21:20:47.323076   use_iv = ENABLED
2019-11-03 21:20:47.323082   test_crypto = DISABLED
2019-11-03 21:20:47.323087   tls_server = DISABLED
2019-11-03 21:20:47.323091   tls_client = ENABLED
2019-11-03 21:20:47.323096   key_method = 2
2019-11-03 21:20:47.323101   ca_file = '[[INLINE]]'
2019-11-03 21:20:47.323106   ca_path = '[UNDEF]'
2019-11-03 21:20:47.323112   dh_file = '[UNDEF]'
2019-11-03 21:20:47.323117   cert_file = '[[INLINE]]'
2019-11-03 21:20:47.323122   extra_certs_file = '[UNDEF]'
2019-11-03 21:20:47.323127   priv_key_file = '[[INLINE]]'
2019-11-03 21:20:47.323132   pkcs12_file = '[UNDEF]'
2019-11-03 21:20:47.323137   cipher_list = '[UNDEF]'
2019-11-03 21:20:47.323142   cipher_list_tls13 = '[UNDEF]'
2019-11-03 21:20:47.323147   tls_cert_profile = '[UNDEF]'
2019-11-03 21:20:47.323152   tls_verify = '[UNDEF]'
2019-11-03 21:20:47.323157   tls_export_cert = '[UNDEF]'
2019-11-03 21:20:47.323162   verify_x509_type = 0
2019-11-03 21:20:47.323167   verify_x509_name = '[UNDEF]'
2019-11-03 21:20:47.323172   crl_file = '[UNDEF]'
2019-11-03 21:20:47.323177   ns_cert_type = 0
2019-11-03 21:20:47.323182   remote_cert_ku[i] = 65535
2019-11-03 21:20:47.323188   remote_cert_ku[i] = 0
2019-11-03 21:20:47.323192   remote_cert_ku[i] = 0
2019-11-03 21:20:47.323197   remote_cert_ku[i] = 0
2019-11-03 21:20:47.323202   remote_cert_ku[i] = 0
2019-11-03 21:20:47.323207   remote_cert_ku[i] = 0
2019-11-03 21:20:47.323212   remote_cert_ku[i] = 0
2019-11-03 21:20:47.323217   remote_cert_ku[i] = 0
2019-11-03 21:20:47.323221   remote_cert_ku[i] = 0
2019-11-03 21:20:47.323226   remote_cert_ku[i] = 0
2019-11-03 21:20:47.323231   remote_cert_ku[i] = 0
2019-11-03 21:20:47.323236   remote_cert_ku[i] = 0
2019-11-03 21:20:47.323241   remote_cert_ku[i] = 0
2019-11-03 21:20:47.323246   remote_cert_ku[i] = 0
2019-11-03 21:20:47.323250   remote_cert_ku[i] = 0
2019-11-03 21:20:47.323255   remote_cert_ku[i] = 0
2019-11-03 21:20:47.323260   remote_cert_eku = 'TLS Web Server Authentication'
2019-11-03 21:20:47.323266   ssl_flags = 0
2019-11-03 21:20:47.323271   tls_timeout = 2
2019-11-03 21:20:47.323276   renegotiate_bytes = -1
2019-11-03 21:20:47.323281   renegotiate_packets = 0
2019-11-03 21:20:47.323286   renegotiate_seconds = 3600
2019-11-03 21:20:47.323291   handshake_window = 60
2019-11-03 21:20:47.323307   transition_window = 3600
2019-11-03 21:20:47.323313   single_session = DISABLED
2019-11-03 21:20:47.323318   push_peer_info = DISABLED
2019-11-03 21:20:47.323323   tls_exit = DISABLED
2019-11-03 21:20:47.323328   tls_auth_file = '[[INLINE]]'
2019-11-03 21:20:47.323333   tls_crypt_file = '[UNDEF]'
2019-11-03 21:20:47.323338   pkcs11_protected_authentication = DISABLED
2019-11-03 21:20:47.323343   pkcs11_protected_authentication = DISABLED
2019-11-03 21:20:47.323348   pkcs11_protected_authentication = DISABLED
2019-11-03 21:20:47.323353   pkcs11_protected_authentication = DISABLED
2019-11-03 21:20:47.323358   pkcs11_protected_authentication = DISABLED
2019-11-03 21:20:47.323363   pkcs11_protected_authentication = DISABLED
2019-11-03 21:20:47.323368   pkcs11_protected_authentication = DISABLED
2019-11-03 21:20:47.323373   pkcs11_protected_authentication = DISABLED
2019-11-03 21:20:47.323378   pkcs11_protected_authentication = DISABLED
2019-11-03 21:20:47.323383   pkcs11_protected_authentication = DISABLED
2019-11-03 21:20:47.323388   pkcs11_protected_authentication = DISABLED
2019-11-03 21:20:47.323393   pkcs11_protected_authentication = DISABLED
2019-11-03 21:20:47.323398   pkcs11_protected_authentication = DISABLED
2019-11-03 21:20:47.323403   pkcs11_protected_authentication = DISABLED
2019-11-03 21:20:47.323408   pkcs11_protected_authentication = DISABLED
2019-11-03 21:20:47.323413   pkcs11_protected_authentication = DISABLED
2019-11-03 21:20:47.323418   pkcs11_private_mode = 00000000
2019-11-03 21:20:47.323423   pkcs11_private_mode = 00000000
2019-11-03 21:20:47.323428   pkcs11_private_mode = 00000000
2019-11-03 21:20:47.323433   pkcs11_private_mode = 00000000
2019-11-03 21:20:47.323438   pkcs11_private_mode = 00000000
2019-11-03 21:20:47.323443   pkcs11_private_mode = 00000000
2019-11-03 21:20:47.323448   pkcs11_private_mode = 00000000
2019-11-03 21:20:47.323453   pkcs11_private_mode = 00000000
2019-11-03 21:20:47.323458   pkcs11_private_mode = 00000000
2019-11-03 21:20:47.323465   pkcs11_private_mode = 00000000
2019-11-03 21:20:47.323471   pkcs11_private_mode = 00000000
2019-11-03 21:20:47.323476   pkcs11_private_mode = 00000000
2019-11-03 21:20:47.323481   pkcs11_private_mode = 00000000
2019-11-03 21:20:47.323486   pkcs11_private_mode = 00000000
2019-11-03 21:20:47.323491   pkcs11_private_mode = 00000000
2019-11-03 21:20:47.323496   pkcs11_private_mode = 00000000
2019-11-03 21:20:47.323501   pkcs11_cert_private = DISABLED
2019-11-03 21:20:47.323505   pkcs11_cert_private = DISABLED
2019-11-03 21:20:47.323510   pkcs11_cert_private = DISABLED
2019-11-03 21:20:47.323515   pkcs11_cert_private = DISABLED
2019-11-03 21:20:47.323520   pkcs11_cert_private = DISABLED
2019-11-03 21:20:47.323525   pkcs11_cert_private = DISABLED
2019-11-03 21:20:47.323530   pkcs11_cert_private = DISABLED
2019-11-03 21:20:47.323535   pkcs11_cert_private = DISABLED
2019-11-03 21:20:47.323540   pkcs11_cert_private = DISABLED
2019-11-03 21:20:47.323545   pkcs11_cert_private = DISABLED
2019-11-03 21:20:47.323550   pkcs11_cert_private = DISABLED
2019-11-03 21:20:47.323555   pkcs11_cert_private = DISABLED
2019-11-03 21:20:47.323560   pkcs11_cert_private = DISABLED
2019-11-03 21:20:47.323565   pkcs11_cert_private = DISABLED
2019-11-03 21:20:47.323570   pkcs11_cert_private = DISABLED
2019-11-03 21:20:47.323575   pkcs11_cert_private = DISABLED
2019-11-03 21:20:47.323580   pkcs11_pin_cache_period = -1
2019-11-03 21:20:47.323585   pkcs11_id = '[UNDEF]'
2019-11-03 21:20:47.323590   pkcs11_id_management = DISABLED
2019-11-03 21:20:47.323606   server_network = 0.0.0.0
2019-11-03 21:20:47.323612   server_netmask = 0.0.0.0
2019-11-03 21:20:47.323627   server_network_ipv6 = ::
2019-11-03 21:20:47.323632   server_netbits_ipv6 = 0
2019-11-03 21:20:47.323638   server_bridge_ip = 0.0.0.0
2019-11-03 21:20:47.323644   server_bridge_netmask = 0.0.0.0
2019-11-03 21:20:47.323649   server_bridge_pool_start = 0.0.0.0
2019-11-03 21:20:47.323655   server_bridge_pool_end = 0.0.0.0
2019-11-03 21:20:47.323661   ifconfig_pool_defined = DISABLED
2019-11-03 21:20:47.323677   ifconfig_pool_start = 0.0.0.0
2019-11-03 21:20:47.323683   ifconfig_pool_end = 0.0.0.0
2019-11-03 21:20:47.323689   ifconfig_pool_netmask = 0.0.0.0
2019-11-03 21:20:47.323694   ifconfig_pool_persist_filename = '[UNDEF]'
2019-11-03 21:20:47.323699   ifconfig_pool_persist_refresh_freq = 600
2019-11-03 21:20:47.323705   ifconfig_ipv6_pool_defined = DISABLED
2019-11-03 21:20:47.323710   ifconfig_ipv6_pool_base = ::
2019-11-03 21:20:47.323715   ifconfig_ipv6_pool_netbits = 0
2019-11-03 21:20:47.323720   n_bcast_buf = 256
2019-11-03 21:20:47.323725   tcp_queue_limit = 64
2019-11-03 21:20:47.323730   real_hash_size = 256
2019-11-03 21:20:47.323735   virtual_hash_size = 256
2019-11-03 21:20:47.323740   client_connect_script = '[UNDEF]'
2019-11-03 21:20:47.323745   learn_address_script = '[UNDEF]'
2019-11-03 21:20:47.323750   client_disconnect_script = '[UNDEF]'
2019-11-03 21:20:47.323755   client_config_dir = '[UNDEF]'
2019-11-03 21:20:47.323760   ccd_exclusive = DISABLED
2019-11-03 21:20:47.323765   tmp_dir = '/var/folders/q0/7cvt6n2n3376phjtcxl2137c0000gn/T/'
2019-11-03 21:20:47.323771   push_ifconfig_defined = DISABLED
2019-11-03 21:20:47.323779   push_ifconfig_local = 0.0.0.0
2019-11-03 21:20:47.323785   push_ifconfig_remote_netmask = 0.0.0.0
2019-11-03 21:20:47.323790   push_ifconfig_ipv6_defined = DISABLED
2019-11-03 21:20:47.323796   push_ifconfig_ipv6_local = ::/0
2019-11-03 21:20:47.323801   push_ifconfig_ipv6_remote = ::
2019-11-03 21:20:47.323806   enable_c2c = DISABLED
2019-11-03 21:20:47.323811   duplicate_cn = DISABLED
2019-11-03 21:20:47.323817   cf_max = 0
2019-11-03 21:20:47.323822   cf_per = 0
2019-11-03 21:20:47.323827   max_clients = 1024
2019-11-03 21:20:47.323832   max_routes_per_client = 256
2019-11-03 21:20:47.323837   auth_user_pass_verify_script = '[UNDEF]'
2019-11-03 21:20:47.323842   auth_user_pass_verify_script_via_file = DISABLED
2019-11-03 21:20:47.323847   auth_token_generate = DISABLED
2019-11-03 21:20:47.323852   auth_token_lifetime = 0
2019-11-03 21:20:47.323857   port_share_host = '[UNDEF]'
2019-11-03 21:20:47.323862   port_share_port = '[UNDEF]'
2019-11-03 21:20:47.323867   client = ENABLED
2019-11-03 21:20:47.323872   pull = ENABLED
2019-11-03 21:20:47.323877   auth_user_pass_file = '[UNDEF]'
2019-11-03 21:20:47.323884 OpenVPN 2.4.7 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Sep 11 2019
2019-11-03 21:20:47.323895 library versions: OpenSSL 1.0.2t  10 Sep 2019, LZO 2.10
2019-11-03 21:20:47.325018 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:58082
2019-11-03 21:20:47.325048 Need hold release from management interface, waiting...
2019-11-03 21:20:47.443122 *Tunnelblick: openvpnstart log:
     OpenVPN started successfully.
     Command used to start OpenVPN (one argument per displayed line):
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.7-openssl-1.0.2t/openvpn
          --daemon
          --log /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-SJoshVPNiPhone8.tblk-SContents-SResources-Sconfig.ovpn.1025_0_3_0_1098032.58082.openvpn.log
          --cd /Library/Application Support/Tunnelblick/Shared/JoshVPNiPhone8.tblk/Contents/Resources
          --machine-readable-output
          --setenv IV_GUI_VER "net.tunnelblick.tunnelblick 5400 3.8.1 (build 5400)"
          --verb 4
          --config /Library/Application Support/Tunnelblick/Shared/JoshVPNiPhone8.tblk/Contents/Resources/config.ovpn
          --setenv TUNNELBLICK_CONFIG_FOLDER /Library/Application Support/Tunnelblick/Shared/JoshVPNiPhone8.tblk/Contents/Resources
          --verb 4
          --cd /Library/Application Support/Tunnelblick/Shared/JoshVPNiPhone8.tblk/Contents/Resources
          --management 127.0.0.1 58082 /Library/Application Support/Tunnelblick/jlkipmcbikaeohpidmbbippjakcbkbpjmpbgpebp.mip
          --management-query-passwords
          --management-hold
          --script-security 2
          --route-up /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
          --down /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
2019-11-03 21:20:47.455858 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:58082
2019-11-03 21:20:47.482424 MANAGEMENT: CMD 'pid'
2019-11-03 21:20:47.482484 MANAGEMENT: CMD 'auth-retry interact'
2019-11-03 21:20:47.482525 MANAGEMENT: CMD 'state on'
2019-11-03 21:20:47.482541 MANAGEMENT: CMD 'state'
2019-11-03 21:20:47.482589 MANAGEMENT: CMD 'bytecount 1'
2019-11-03 21:20:47.483245 *Tunnelblick: Established communication with OpenVPN
2019-11-03 21:20:47.485812 *Tunnelblick: >INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info
2019-11-03 21:20:47.487607 MANAGEMENT: CMD 'hold release'
2019-11-03 21:20:47.487968 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2019-11-03 21:20:47.491846 *Tunnelblick: Obtained passphrase from the Keychain
2019-11-03 21:20:47.492733 MANAGEMENT: CMD 'password [...]'
2019-11-03 21:20:47.492859 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2019-11-03 21:20:47.496013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2019-11-03 21:20:47.496040 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2019-11-03 21:20:47.496117 Control Channel MTU parms [ L:1623 D:1182 EF:68 EB:0 ET:0 EL:3 ]
2019-11-03 21:20:47.496147 MANAGEMENT: >STATE:1572816047,RESOLVE,,,,,,
2019-11-03 21:20:47.641752 Data Channel MTU parms [ L:1623 D:1450 EF:123 EB:406 ET:0 EL:3 ]
2019-11-03 21:20:47.641819 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_CLIENT,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
2019-11-03 21:20:47.641857 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_SERVER,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
2019-11-03 21:20:47.641879 TCP/UDP: Preserving recently used remote address: [AF_INET][x.x.x.x]:80
2019-11-03 21:20:47.641963 Socket Buffers: R=[131072->131072] S=[131072->131072]
2019-11-03 21:20:47.641981 Attempting to establish TCP connection with [AF_INET][x.x.x.x]:80 [nonblock]
2019-11-03 21:20:47.642028 MANAGEMENT: >STATE:1572816047,TCP_CONNECT,,,,,,
2019-11-03 21:20:48.715896 TCP connection established with [AF_INET][x.x.x.x]:80
2019-11-03 21:20:48.715983 TCP_CLIENT link local: (not bound)
2019-11-03 21:20:48.715996 TCP_CLIENT link remote: [AF_INET][x.x.x.x]:80
2019-11-03 21:20:48.716033 MANAGEMENT: >STATE:1572816048,WAIT,,,,,,
2019-11-03 21:20:48.720627 MANAGEMENT: >STATE:1572816048,AUTH,,,,,,
2019-11-03 21:20:48.720680 TLS: Initial packet from [AF_INET][x.x.x.x]:80, sid=32f95c06 b9a78627
2019-11-03 21:20:49.044673 VERIFY OK: depth=1, CN=PiServer
2019-11-03 21:20:49.045442 VERIFY KU OK
2019-11-03 21:20:49.045977 Validating certificate extended key usage
2019-11-03 21:20:49.046072 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2019-11-03 21:20:49.046127 VERIFY EKU OK
2019-11-03 21:20:49.046146 VERIFY OK: depth=0, CN=PiServer
2019-11-03 21:20:49.191668 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1559', remote='link-mtu 1560'
2019-11-03 21:20:49.191780 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
2019-11-03 21:20:49.191868 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
2019-11-03 21:20:49.191964 [PiServer] Peer Connection Initiated with [AF_INET][x.x.x.x]:80
2019-11-03 21:20:50.516435 MANAGEMENT: >STATE:1572816050,GET_CONFIG,,,,,,
2019-11-03 21:20:50.516682 SENT CONTROL [PiServer]: 'PUSH_REQUEST' (status=1)
2019-11-03 21:20:50.861904 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 192.168.1.1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 192.168.1.0 255.255.255.0,compress lz4-v2,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM'
2019-11-03 21:20:50.862172 OPTIONS IMPORT: timers and/or timeouts modified
2019-11-03 21:20:50.862214 OPTIONS IMPORT: compression parms modified
2019-11-03 21:20:50.862238 LZ4v2 compression initializing
2019-11-03 21:20:50.862258 OPTIONS IMPORT: --ifconfig/up options modified
2019-11-03 21:20:50.862280 OPTIONS IMPORT: route options modified
2019-11-03 21:20:50.862301 OPTIONS IMPORT: route-related options modified
2019-11-03 21:20:50.862321 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2019-11-03 21:20:50.862343 OPTIONS IMPORT: peer-id set
2019-11-03 21:20:50.862366 OPTIONS IMPORT: adjusting link_mtu to 1626
2019-11-03 21:20:50.862389 OPTIONS IMPORT: data channel crypto options modified
2019-11-03 21:20:50.862414 Data Channel: using negotiated cipher 'AES-256-GCM'
2019-11-03 21:20:50.862547 Data Channel MTU parms [ L:1554 D:1450 EF:54 EB:406 ET:0 EL:3 ]
2019-11-03 21:20:50.862843 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2019-11-03 21:20:50.863324 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2019-11-03 21:20:50.863926 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2019-11-03 21:20:50.864015 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2019-11-03 21:20:50.864060 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2019-11-03 21:20:50.864098 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2019-11-03 21:20:50.864346 Opened utun device utun4
2019-11-03 21:20:50.864443 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
2019-11-03 21:20:50.864516 MANAGEMENT: >STATE:1572816050,ASSIGN_IP,,10.8.0.2,,,,
2019-11-03 21:20:50.864643 /sbin/ifconfig utun4 delete
                           ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2019-11-03 21:20:50.871263 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2019-11-03 21:20:50.871368 /sbin/ifconfig utun4 10.8.0.2 10.8.0.2 netmask 255.255.255.0 mtu 1500 up
2019-11-03 21:20:50.875236 /sbin/route add -net 10.8.0.0 10.8.0.2 255.255.255.0
                           add net 10.8.0.0: gateway 10.8.0.2
2019-11-03 21:20:50.879997 /sbin/route add -net [x.x.x.x] 192.168.1.1 255.255.255.255
                           add net [x.x.x.x]: gateway 192.168.1.1
2019-11-03 21:20:50.882248 /sbin/route add -net 0.0.0.0 10.8.0.1 128.0.0.0
                           add net 0.0.0.0: gateway 10.8.0.1
2019-11-03 21:20:50.884426 /sbin/route add -net 128.0.0.0 10.8.0.1 128.0.0.0
                           add net 128.0.0.0: gateway 10.8.0.1
2019-11-03 21:20:50.886918 MANAGEMENT: >STATE:1572816050,ADD_ROUTES,,,,,,
2019-11-03 21:20:50.887003 /sbin/route add -net 192.168.1.0 10.8.0.1 255.255.255.0
                           add net 192.168.1.0: gateway 10.8.0.1
                           21:20:50 *Tunnelblick:  **********************************************
                           21:20:50 *Tunnelblick:  Start of output from client.up.tunnelblick.sh
                           21:20:53 *Tunnelblick:  Disabled IPv6 for 'Hub Ethernet'
                           21:20:53 *Tunnelblick:  Disabled IPv6 for 'iPhone USB'
                           21:20:53 *Tunnelblick:  Disabled IPv6 for 'Wi-Fi'
                           21:20:53 *Tunnelblick:  Disabled IPv6 for 'Bluetooth PAN'
                           21:20:53 *Tunnelblick:  Retrieved from OpenVPN: name server(s) [ 192.168.1.1 8.8.8.8 8.8.4.4 ], search domain(s) [ ] and SMB server(s) [ ] and using default domain name [ openvpn ]
                           21:20:53 *Tunnelblick:  Not aggregating ServerAddresses because running on macOS 10.6 or higher
                           21:20:53 *Tunnelblick:  Setting search domains to 'openvpn' because the search domains were not set manually (or are allowed to be changed) and 'Prepend domain name to search domains' was not selected
                           21:20:54 *Tunnelblick:  Saved the DNS and SMB configurations so they can be restored
                           21:20:54 *Tunnelblick:  Changed DNS ServerAddresses setting from '192.168.1.1' to '192.168.1.1 8.8.8.8 8.8.4.4'
                           21:20:54 *Tunnelblick:  Changed DNS SearchDomains setting from '' to 'openvpn'
                           21:20:54 *Tunnelblick:  Changed DNS DomainName setting from 'lan' to 'openvpn'
                           21:20:54 *Tunnelblick:  Did not change SMB NetBIOSName setting of ''
                           21:20:54 *Tunnelblick:  Did not change SMB Workgroup setting of ''
                           21:20:54 *Tunnelblick:  Did not change SMB WINSAddresses setting of ''
                           21:20:54 *Tunnelblick:  DNS servers '192.168.1.1 8.8.8.8 8.8.4.4' will be used for DNS queries when the VPN is active
                           21:20:54 *Tunnelblick:  NOTE: The DNS servers include one or more free public DNS servers known to Tunnelblick and one or more DNS servers not known to Tunnelblick. If used, the DNS servers not known to Tunnelblick may cause DNS queries to fail or be intercepted or falsified even if they are directed through the VPN. Specify only known public DNS servers or DNS servers located on the VPN network to avoid such problems.
                           21:20:54 *Tunnelblick:  Flushed the DNS cache via dscacheutil
                           21:20:54 *Tunnelblick:  /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil
                           21:20:54 *Tunnelblick:  Notified mDNSResponder that the DNS cache was flushed
                           21:20:54 *Tunnelblick:  Not notifying mDNSResponderHelper that the DNS cache was flushed because it is not running
                           21:20:54 *Tunnelblick:  Setting up to monitor system configuration with process-network-changes
                           21:20:54 *Tunnelblick:  End of output from client.up.tunnelblick.sh
                           21:20:54 *Tunnelblick:  **********************************************
2019-11-03 21:20:54.871511 Initialization Sequence Completed
2019-11-03 21:20:54.871611 MANAGEMENT: >STATE:1572816054,CONNECTED,SUCCESS,10.8.0.2,[x.x.x.x],80,127.0.0.1,50935
2019-11-03 21:20:55.079163 *Tunnelblick: Warning: DNS server address 192.168.1.1 is not a public IP address and is not being routed through the VPN.


2019-11-03 21:20:55.185603 *Tunnelblick: DNS address 8.8.4.4 is being routed through the VPN
2019-11-03 21:20:55.290351 *Tunnelblick: DNS address 8.8.8.8 is being routed through the VPN
2019-11-03 21:20:59.258825 *Tunnelblick: process-network-changes: A system configuration change was ignored
2019-11-03 21:21:38.446302 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's name after connecting.

Thanks for the help

TinCanTech

JoshHeng wrote Other Server Config

iptables firewall flushed
/proc/sys/net/ipv4/ip_forward = 1

There should also be a NAT rule here ..

https://community.openvpn.net/openvpn/wiki/HOWTO

JoshHeng

TinCanTech wrote
JoshHeng wrote Other Server Config

iptables firewall flushed
/proc/sys/net/ipv4/ip_forward = 1
There should also be a NAT rule here ..

https://community.openvpn.net/openvpn/wiki/HOWTO

I've tried the following commands and they have no effect - I still cannot access external websites

sudo iptables -F
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

@tosky

Bonjour a tous je suis confronté à un problème de connexion depuis un bon bout de temps. En effet j'ai fait une configuration OpenVpn qui fonction bien en local mais je n'arrive pas à l'implémenter sur des sites distants. vraiment besoin d'aide.

TinCanTech

Do not push DNS 192.168.1.1

Also,

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

So change that for a start.