Hello,
as you can see when you check my user name, I am somehow lost between the OSI layers. 😉
I have got our little companies network set up as 10.0.0.0/255.255.255.0 network and our home network as 10.116.0.0/255.255.255.0.
In meantime I would have used 10.[116|22].0.0/255.255.0.0, but I didn't know better these days.
As we have very weak phone lines on both our buildings, we opted for a LTE Fritz!BOX solution on both sides. Now with pandemic home office and all 4-6 of us working from home the lines don't make it obviously. Hence, I wanted to set up to only route the needed traffic between the two networks and the rest directly out to the internet...
Our current configuration worked so far, and I only added
push "route 10.0.0.0 255.255.255.0" on the server side. But to no avail.
Just as additional explanation: Back when I set up the VPN I get
push "dhcp-option DNS 10.0.0.25" and
push "dhcp-option DOMAIN-SEARCH mfg.otaya.cc" to work. Hence I wrote a connected.sh and post-disconnect.sh skript to do the job.
I got following error's in the Tunnelblick log:
1605608436.748107 1 [vpn.otaya.cc] Peer Connection Initiated with [AF_INET]217.76.162.152:1194
1605608437.963848 28000003 MANAGEMENT: >STATE:1605608437,GET_CONFIG,,,,,,
1605608437.963966 22000003 SENT CONTROL [vpn.otaya.cc]: 'PUSH_REQUEST' (status=1)
1605608438.040040 22000003 PUSH: Received control message: 'PUSH_REPLY,block-outside-dns,dhcp-option DNS 10.0.0.25,dhcp-option DNS 10.0.0.26,dhcp-option DOMAIN-SEARCH mfg.otaya.cc,dhcp-option DOMAIN mfg.otaya.cc,route 10.8.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5,peer-id 2,cipher AES-256-GCM'
1605608438.040125 b008021 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:1: block-outside-dns (2.4.9)
1605608438.040153 b008021 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
1605608438.040174 b008021 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
1605608438.040193 b008021 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
1605608438.040210 b008021 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
1605608438.040225 b008021 Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS])
1605608438.040262 22000003 OPTIONS IMPORT: timers and/or timeouts modified
1605608438.040276 22000003 OPTIONS IMPORT: --ifconfig/up options modified
1605608438.040287 22000003 OPTIONS IMPORT: peer-id set
1605608438.040299 22000003 OPTIONS IMPORT: adjusting link_mtu to 1624
After commenting out
push "block-outside-dns", the log looks like this:
2020-11-17 12:17:49.613026 *Tunnelblick: macOS 10.14.6 (18G6020); Tunnelblick 3.8.4 (build 5600); prior version 3.8.3a (build 5521)
2020-11-17 12:17:50.062830 *Tunnelblick: Attempting connection with OTAYA OpenVPN OTAYA-Andi-MBP-2015 using shadow copy; Set nameserver = 769; monitoring connection
2020-11-17 12:17:50.063043 *Tunnelblick: openvpnstart start OTAYA\ OpenVPN\ OTAYA-Andi-MBP-2015.tblk 52189 769 0 1 0 1098032 -ptADGNWradsgnw 2.4.9-openssl-1.1.1h
2020-11-17 12:17:50.088489 *Tunnelblick: openvpnstart starting OpenVPN
2020-11-17 12:17:50.309011 OpenVPN 2.4.9 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Nov 9 2020
2020-11-17 12:17:50.309102 library versions: OpenSSL 1.1.1h 22 Sep 2020, LZO 2.10
2020-11-17 12:17:50.310803 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:52189
2020-11-17 12:17:50.310840 Need hold release from management interface, waiting...
2020-11-17 12:17:50.685783 *Tunnelblick: openvpnstart log:
OpenVPN started successfully.
Command used to start OpenVPN (one argument per displayed line):
/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.9-openssl-1.1.1h/openvpn
--daemon
--log /Library/Application Support/Tunnelblick/Logs/-SUsers-Sandi-SLibrary-SApplication Support-STunnelblick-SConfigurations-SOTAYA OpenVPN OTAYA--Andi--MBP--2015.tblk-SContents-SResources-Sconfig.ovpn.769_0_1_0_1098032.52189.openvpn.log
--cd /Library/Application Support/Tunnelblick/Users/andi/OTAYA OpenVPN OTAYA-Andi-MBP-2015.tblk/Contents/Resources
--machine-readable-output
--setenv IV_GUI_VER "net.tunnelblick.tunnelblick 5600 3.8.4 (build 5600)"
--verb 3
--config /Library/Application Support/Tunnelblick/Users/andi/OTAYA OpenVPN OTAYA-Andi-MBP-2015.tblk/Contents/Resources/config.ovpn
--setenv TUNNELBLICK_CONFIG_FOLDER /Library/Application Support/Tunnelblick/Users/andi/OTAYA OpenVPN OTAYA-Andi-MBP-2015.tblk/Contents/Resources
--verb 3
--cd /Library/Application Support/Tunnelblick/Users/andi/OTAYA OpenVPN OTAYA-Andi-MBP-2015.tblk/Contents/Resources
--management 127.0.0.1 52189 /Library/Application Support/Tunnelblick/jhdndjejdkpofjakdkkmkagcgklelephehikbggc.mip
--management-query-passwords
--management-hold
--script-security 2
--route-up /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
--down /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
2020-11-17 12:17:50.689220 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:52189
2020-11-17 12:17:50.695913 MANAGEMENT: CMD 'pid'
2020-11-17 12:17:50.695976 MANAGEMENT: CMD 'auth-retry interact'
2020-11-17 12:17:50.695998 MANAGEMENT: CMD 'state on'
2020-11-17 12:17:50.696015 MANAGEMENT: CMD 'state'
2020-11-17 12:17:50.696038 MANAGEMENT: CMD 'bytecount 1'
2020-11-17 12:17:50.696181 *Tunnelblick: Established communication with OpenVPN
2020-11-17 12:17:50.696965 *Tunnelblick: >INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info
2020-11-17 12:17:50.698550 MANAGEMENT: CMD 'hold release'
2020-11-17 12:17:50.698718 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2020-11-17 12:17:50.701652 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2020-11-17 12:17:50.701676 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2020-11-17 12:17:50.701776 MANAGEMENT: >STATE:1605611870,RESOLVE,,,,,,
2020-11-17 12:17:50.782925 TCP/UDP: Preserving recently used remote address: [AF_INET]217.76.162.152:1194
2020-11-17 12:17:50.782982 Socket Buffers: R=[786896->786896] S=[9216->9216]
2020-11-17 12:17:50.782995 UDP link local: (not bound)
2020-11-17 12:17:50.783006 UDP link remote: [AF_INET]217.76.162.152:1194
2020-11-17 12:17:50.783031 MANAGEMENT: >STATE:1605611870,WAIT,,,,,,
2020-11-17 12:17:50.881968 MANAGEMENT: >STATE:1605611870,AUTH,,,,,,
2020-11-17 12:17:50.882007 TLS: Initial packet from [AF_INET]217.76.162.152:1194, sid=e73d96ad 3b41f920
2020-11-17 12:17:50.992618 VERIFY KU OK
2020-11-17 12:17:50.992677 Validating certificate extended key usage
2020-11-17 12:17:50.992703 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2020-11-17 12:17:50.992712 VERIFY EKU OK
2020-11-17 12:17:50.992724 VERIFY OK: depth=0, CN=vpn.otaya.cc
2020-11-17 12:17:51.116172 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
2020-11-17 12:17:51.116238 [vpn.otaya.cc] Peer Connection Initiated with [AF_INET]217.76.162.152:1194
2020-11-17 12:17:52.372068 MANAGEMENT: >STATE:1605611872,GET_CONFIG,,,,,,
2020-11-17 12:17:52.372197 SENT CONTROL [vpn.otaya.cc]: 'PUSH_REQUEST' (status=1)
2020-11-17 12:17:52.433066 PUSH: Received control message: 'PUSH_REPLY,route 10.0.0.0 255.255.255.0,dhcp-option DNS 10.0.0.25,dhcp-option DNS 10.0.0.26,dhcp-option DOMAIN-SEARCH mfg.otaya.cc,dhcp-option DOMAIN mfg.otaya.cc,route 10.8.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM'
2020-11-17 12:17:52.433179 OPTIONS IMPORT: timers and/or timeouts modified
2020-11-17 12:17:52.433190 OPTIONS IMPORT: --ifconfig/up options modified
2020-11-17 12:17:52.433196 OPTIONS IMPORT: route options modified
2020-11-17 12:17:52.433202 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2020-11-17 12:17:52.433209 OPTIONS IMPORT: peer-id set
2020-11-17 12:17:52.433215 OPTIONS IMPORT: adjusting link_mtu to 1624
2020-11-17 12:17:52.433221 OPTIONS IMPORT: data channel crypto options modified
2020-11-17 12:17:52.433228 Data Channel: using negotiated cipher 'AES-256-GCM'
2020-11-17 12:17:52.433300 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2020-11-17 12:17:52.433309 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2020-11-17 12:17:52.433500 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2020-11-17 12:17:52.433581 Opened utun device utun1
2020-11-17 12:17:52.433601 MANAGEMENT: >STATE:1605611872,ASSIGN_IP,,10.8.0.6,,,,
2020-11-17 12:17:52.433612 /sbin/ifconfig utun1 delete
ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2020-11-17 12:17:52.440208 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2020-11-17 12:17:52.440276 /sbin/ifconfig utun1 10.8.0.6 10.8.0.5 mtu 1500 netmask 255.255.255.255 up
2020-11-17 12:17:52.443817 /sbin/route add -net 217.76.162.152 10.116.0.1 255.255.255.255
add net 217.76.162.152: gateway 10.116.0.1
2020-11-17 12:17:52.447553 /sbin/route add -net 0.0.0.0 10.8.0.5 128.0.0.0
add net 0.0.0.0: gateway 10.8.0.5
2020-11-17 12:17:52.449866 /sbin/route add -net 128.0.0.0 10.8.0.5 128.0.0.0
add net 128.0.0.0: gateway 10.8.0.5
2020-11-17 12:17:52.452140 MANAGEMENT: >STATE:1605611872,ADD_ROUTES,,,,,,
2020-11-17 12:17:52.452174 /sbin/route add -net 10.0.0.0 10.8.0.5 255.255.255.0
add net 10.0.0.0: gateway 10.8.0.5
2020-11-17 12:17:52.454890 /sbin/route add -net 10.8.0.1 10.8.0.5 255.255.255.255
add net 10.8.0.1: gateway 10.8.0.5
12:17:52 *Tunnelblick: **********************************************
12:17:52 *Tunnelblick: Start of output from client.up.tunnelblick.sh
12:17:54 *Tunnelblick: Disabled IPv6 for 'MT65xx Preloader'
12:17:54 *Tunnelblick: Disabled IPv6 for 'USB Serial'
12:17:54 *Tunnelblick: Retrieved from OpenVPN: name server(s) [ 10.0.0.25 10.0.0.26 ], domain name [ mfg.otaya.cc ], search domain(s) [ mfg.otaya.cc ], and SMB server(s) [ ]
12:17:54 *Tunnelblick: Not aggregating ServerAddresses because running on macOS 10.6 or higher
12:17:54 *Tunnelblick: Prepending 'mfg.otaya.cc' to search domains '' because the search domains were not set manually (or are allowed to be changed) but were set via OpenVPN and 'Prepend domain name to search domains' was not selected
12:17:56 *Tunnelblick: Saved the DNS and SMB configurations so they can be restored
12:17:56 *Tunnelblick: Changed DNS ServerAddresses setting from '10.116.0.1' to '10.0.0.25 10.0.0.26'
12:17:56 *Tunnelblick: Changed DNS SearchDomains setting from '' to 'mfg.otaya.cc'
12:17:56 *Tunnelblick: Changed DNS DomainName setting from 'fritz.box' to 'mfg.otaya.cc'
12:17:56 *Tunnelblick: Did not change SMB NetBIOSName setting of 'ASW002'
12:17:56 *Tunnelblick: Did not change SMB Workgroup setting of 'MFG'
12:17:56 *Tunnelblick: Did not change SMB WINSAddresses setting of ''
12:17:56 *Tunnelblick: DNS servers '10.0.0.25 10.0.0.26' will be used for DNS queries when the VPN is active
12:17:56 *Tunnelblick: NOTE: The DNS servers do not include any free public DNS servers known to Tunnelblick. This may cause DNS queries to fail or be intercepted or falsified even if they are directed through the VPN. Specify only known public DNS servers or DNS servers located on the VPN network to avoid such problems.
12:17:56 *Tunnelblick: Flushed the DNS cache via dscacheutil
12:17:56 *Tunnelblick: /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil
12:17:56 *Tunnelblick: Notified mDNSResponder that the DNS cache was flushed
12:17:56 *Tunnelblick: Not notifying mDNSResponderHelper that the DNS cache was flushed because it is not running
12:17:56 *Tunnelblick: Setting up to monitor system configuration with process-network-changes
12:17:56 *Tunnelblick: End of output from client.up.tunnelblick.sh
12:17:56 *Tunnelblick: **********************************************
2020-11-17 12:17:56.833723 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2020-11-17 12:17:56.833756 Initialization Sequence Completed
2020-11-17 12:17:56.833833 MANAGEMENT: >STATE:1605611876,CONNECTED,SUCCESS,10.8.0.6,217.76.162.152,1194,,
2020-11-17 12:17:57.694397 *Tunnelblick: The 'connected.sh' script succeeded
2020-11-17 12:21:51.379427 write UDP: Can't assign requested address (code=49)
2020-11-17 12:21:51.420104 write UDP: Can't assign requested address (code=49)
......
again and again
......
2020-11-17 12:21:55.577437 write UDP: Can't assign requested address (code=49)
2020-11-17 12:21:55.585713 write UDP: Can't assign requested address (code=49)
2020-11-17 12:21:56.692292 *Tunnelblick: process-network-changes: DomainName changed from
*mfg.otaya.cc
* to (pre-VPN)
*fritz.box
2020-11-17 12:21:56.711298 *Tunnelblick: process-network-changes: Restoring DomainName to post-VPN value
2020-11-17 12:22:26.812319 write UDP: Can't assign requested address (code=49)
2020-11-17 12:22:26.853710 write UDP: Can't assign requested address (code=49)
......
again and again
......
2020-11-17 12:22:31.824791 write UDP: Can't assign requested address (code=49)
2020-11-17 12:22:31.828274 write UDP: Can't assign requested address (code=49)
Executing connected.sh in /Library/Application Support/Tunnelblick/Users/andi/OTAYA OpenVPN OTAYA-Andi-MBP-2015.tblk/Contents/Resources...
connected.sh returned with status 0
stdout from connected.sh: Active NETWORKSERVICE: Wi-Fi
OpenVPN Connected to Otaya Schanzelgasse over the network service Wi-Fi
Set up successfully all current services
2020-11-17 12:17:58.293277 *Tunnelblick: DNS address 10.0.0.25 is being routed through the VPN
2020-11-17 12:17:58.387045 *Tunnelblick: DNS address 10.0.0.26 is being routed through the VPN
My Server config:
server 10.8.0.0 255.255.255.0
verb 3
key /etc/openvpn/pki/private/vpn.otaya.cc.key
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/issued/vpn.otaya.cc.crt
dh /etc/openvpn/pki/dh.pem
tls-auth /etc/openvpn/pki/ta.key
key-direction 0
keepalive 10 60
persist-key
persist-tun
proto udp
# Rely on Docker to do port mapping, internally always 1194
port 1194
dev tun0
status /tmp/openvpn-status.log
user nobody
group nogroup
### Route Configurations Below
# route 192.168.254.0 255.255.255.0
### Push Configurations Below
# push "block-outside-dns"
push "route 10.0.0.0 255.255.255.0"
push "dhcp-option DNS 10.0.0.25"
push "dhcp-option DNS 10.0.0.26"
push "dhcp-option DOMAIN-SEARCH mfg.otaya.cc"
push "dhcp-option DOMAIN mfg.otaya.cc"
And my client config:
client
nobind
dev tun
verb 4
remote-cert-tls server
remote vpn.otaya.cc 1194 udp
<key>
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
</key>
<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>
<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>
key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>
redirect-gateway def1
But the whole traffic still gets route over the VPN when it's not needed:
$ traceroute example.com
traceroute to example.com (93.184.216.34), 64 hops max, 52 byte packets
1 10.8.0.1 (10.8.0.1) 63.722 ms 133.788 ms 69.281 ms
2 172.17.0.1 (172.17.0.1) 61.052 ms 62.868 ms 111.794 ms
3 10.0.0.1 (10.0.0.1) 95.642 ms 82.893 ms 79.017 ms
4 217-76-160-1.static.highway.a1.net (217.76.160.1) 91.358 ms 131.231 ms 81.301 ms
5 195.3.70.170 (195.3.70.170) 126.430 ms 103.149 ms 99.805 ms
6 195.3.70.169 (195.3.70.169) 110.666 ms 102.957 ms 94.646 ms
7 lg1-9071.as8447.a1.net (195.3.64.14) 95.839 ms 104.225 ms 122.253 ms
8 ae75.bar3.vienna1.level3.net (212.73.203.13) 110.885 ms 99.091 ms 100.788 ms
9 * ae-2-3602.ear2.washington12.level3.net (4.69.140.121) 240.214 ms^C
... and so on ...
Oh, and the OpenVPN server is running in a docker container. Hence, there is the
172.17.0.1 hop in the traceroute.
I think I am close, but can't get closer. Thanks for any help!
