exception parsing IPv4 route, AddrMaskPair parse error

bigsprout

Hi,

I am trying to connect to a private network through a VPN server all hosted on AWS. I have no problems using TunnelBlick on my Macbook but getting these errors when I tried to connect via OpenVPN Connect on my Windows machine.

exception parsing IPv4 route: [route] [128348A16E9F345DE029385D044D619A6.us-east-1.eks.amazonaws.com] [255.255.255.255] : addr_pair_mask_parse_error: AddrMaskPair parse error 'route': 128348A16E9F345DE029385D044D619A6.us-east-1.eks.amazonaws.com/255.255.255.255 : ip_exception: error parsing route IP address 128348A16E9F345DE029385D044D619A6.gr7.us-east-1.eks.amazonaws.com' : Invalid argument

With the same ovpn config file on Tunnelblick using MacOS, it works just fine.

I figured it has to do with the DNS resolution so I tried to make a temp fix by changing the server.conf file to push the IP address instead from:

push "route 128348A16E9F345DE029385D044D619A6.gr7.eu-west-1.eks.amazonaws.com 255.255.255.255"
push "route xx.xx.xx.xx 255.255.255.255"

However after making the changes, the VPN client is still trying to add 128348A16E9F345DE029385D044D619A6.gr7.eu-west-1.eks.amazonaws.com to route and getting the same errors.

The server is successfully pushing the DNS servers.

my ovpn config file:

client
dev tun
proto udp
remote <server-ip> 443
resolv-retry 10
nobind

persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
auth SHA256
key-direction 1
verb 3
compress lz4-v2

allow-pull-fqdn

Using Windows 10 with OpenVPN Connect v3

Would really appreciate if someone could point me to the right direction to fix this issue. Thanks

EDIT below:
The error message is gone after I temporary replace all 3 x.eks.amazon with their IP address but still unable to connect to internal resource.
Route tables look the same except for tunnelblick there is one extra line of:

Internet:
Destination        Gateway            Flags           Netif Expire
...   
10.200.0.31        10.200.0.31        UH              utun3

10.200.0.31 is the virtual IP assigned by the server.

Below are the config and log files.

server-log-tunnelblick

Sat Dec 11 02:23:14 2021 us=662831 MULTI: multi_create_instance called
Sat Dec 11 02:23:14 2021 us=662925 x.x.x.x-public-ip:26656 Re-using SSL/TLS context
Sat Dec 11 02:23:14 2021 us=662941 x.x.x.x-public-ip:26656 LZ4v2 compression initializing
Sat Dec 11 02:23:14 2021 us=663016 x.x.x.x-public-ip:26656 Control Channel MTU parms [ L:1622 D:1172 EF:78 EB:0 ET:0 EL:3 ]
Sat Dec 11 02:23:14 2021 us=663029 x.x.x.x-public-ip:26656 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Sat Dec 11 02:23:14 2021 us=663061 x.x.x.x-public-ip:26656 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-server'
Sat Dec 11 02:23:14 2021 us=663069 x.x.x.x-public-ip:26656 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-client'
Sat Dec 11 02:23:14 2021 us=663095 x.x.x.x-public-ip:26656 TLS: Initial packet from [AF_INET]x.x.x.x-public-ip:26656, sid=57e430e9 afd13826
Sat Dec 11 02:23:14 2021 us=766637 x.x.x.x-public-ip:26656 VERIFY OK: depth=1, CN=CNNameReplaced
Sat Dec 11 02:23:14 2021 us=766787 x.x.x.x-public-ip:26656 VERIFY OK: depth=0, CN=tunnelblick-client
Sat Dec 11 02:23:14 2021 us=767010 x.x.x.x-public-ip:26656 peer info: IV_VER=2.5.4
Sat Dec 11 02:23:14 2021 us=767031 x.x.x.x-public-ip:26656 peer info: IV_PLAT=mac
Sat Dec 11 02:23:14 2021 us=767039 x.x.x.x-public-ip:26656 peer info: IV_PROTO=6
Sat Dec 11 02:23:14 2021 us=767056 x.x.x.x-public-ip:26656 peer info: IV_NCP=2
Sat Dec 11 02:23:14 2021 us=767064 x.x.x.x-public-ip:26656 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:AES-256-CBC
Sat Dec 11 02:23:14 2021 us=767072 x.x.x.x-public-ip:26656 peer info: IV_LZ4=1
Sat Dec 11 02:23:14 2021 us=767078 x.x.x.x-public-ip:26656 peer info: IV_LZ4v2=1
Sat Dec 11 02:23:14 2021 us=767085 x.x.x.x-public-ip:26656 peer info: IV_LZO=1
Sat Dec 11 02:23:14 2021 us=767092 x.x.x.x-public-ip:26656 peer info: IV_COMP_STUB=1
Sat Dec 11 02:23:14 2021 us=767099 x.x.x.x-public-ip:26656 peer info: IV_COMP_STUBv2=1
Sat Dec 11 02:23:14 2021 us=767107 x.x.x.x-public-ip:26656 peer info: IV_TCPNL=1
Sat Dec 11 02:23:14 2021 us=767114 x.x.x.x-public-ip:26656 peer info: IV_GUI_VER="net.tunnelblick.tunnelblick_5770_3.8.7a__build_5770)"
Sat Dec 11 02:23:14 2021 us=802924 x.x.x.x-public-ip:26656 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Sat Dec 11 02:23:14 2021 us=802984 x.x.x.x-public-ip:26656 [tunnelblick-client] Peer Connection Initiated with [AF_INET]x.x.x.x-public-ip:26656
Sat Dec 11 02:23:14 2021 us=803093 MULTI: new connection by client 'tb-client' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Sat Dec 11 02:23:14 2021 us=803112 MULTI_sva: pool returned IPv4=10.200.0.31, IPv6=(Not enabled)
Sat Dec 11 02:23:14 2021 us=803142 MULTI: Learn: 10.200.0.31 -> tunnelblick-client/x.x.x.x-public-ip:26656
Sat Dec 11 02:23:14 2021 us=803150 MULTI: primary virtual IP for tunnelblick-client/x.x.x.x-public-ip:26656: 10.200.0.31
Sat Dec 11 02:23:15 2021 us=995121 tunnelblick-client/x.x.x.x-public-ip:26656 PUSH: Received control message: 'PUSH_REQUEST'
Sat Dec 11 02:23:15 2021 us=995214 tunnelblick-client/x.x.x.x-public-ip:26656 SENT CONTROL [tunnelblick-client]: 'PUSH_REPLY,route 10.1.0.0 255.255.0.0,route 10.7.0.0 255.255.0.0,route 10.8.0.0 255.255.0.0,route 10.2.0.0 255.255.0.0,route 10.3.0.0 255.255.0.0,route x.x.x.x 255.255.255.255,route 10.4.0.0 255.255.0.0,route x.x.x.x 255.255.255.255,route x.x.x.x 255.255.255.255,route x.x.x.x 255.255.255.255,dhcp-option DNS 10.1.0.2,route-gateway 10.200.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.200.0.31 255.255.255.0,peer-id 4,cipher AES-256-GCM' (status=1)
Sat Dec 11 02:23:15 2021 us=995246 tunnelblick-client/x.x.x.x-public-ip:26656 Data Channel: using negotiated cipher 'AES-256-GCM'
Sat Dec 11 02:23:15 2021 us=995267 tunnelblick-client/x.x.x.x-public-ip:26656 Data Channel MTU parms [ L:1550 D:1450 EF:50 EB:406 ET:0 EL:3 ]
Sat Dec 11 02:23:15 2021 us=995364 tunnelblick-client/x.x.x.x-public-ip:26656 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sat Dec 11 02:23:15 2021 us=995380 tunnelblick-client/x.x.x.x-public-ip:26656 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

server-log-openvpn-connect-windows

Sat Dec 11 02:46:49 2021 us=517174 MULTI: multi_create_instance called
Sat Dec 11 02:46:49 2021 us=517275 x.x.x.x-public-ip:27007 Re-using SSL/TLS context
Sat Dec 11 02:46:49 2021 us=517291 x.x.x.x-public-ip:27007 LZ4v2 compression initializing
Sat Dec 11 02:46:49 2021 us=517365 x.x.x.x-public-ip:27007 Control Channel MTU parms [ L:1622 D:1172 EF:78 EB:0 ET:0 EL:3 ]
Sat Dec 11 02:46:49 2021 us=517395 x.x.x.x-public-ip:27007 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Sat Dec 11 02:46:49 2021 us=517429 x.x.x.x-public-ip:27007 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-server'
Sat Dec 11 02:46:49 2021 us=517438 x.x.x.x-public-ip:27007 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-client'
Sat Dec 11 02:46:49 2021 us=517463 x.x.x.x-public-ip:27007 TLS: Initial packet from [AF_INET]x.x.x.x-public-ip:27007, sid=182cff6e b3571a10
Sat Dec 11 02:46:49 2021 us=593168 x.x.x.x-public-ip:27007 VERIFY OK: depth=1, CN=CNNameReplaced
Sat Dec 11 02:46:49 2021 us=593317 x.x.x.x-public-ip:27007 VERIFY OK: depth=0, CN=openvpn-windows-client
Sat Dec 11 02:46:49 2021 us=593544 x.x.x.x-public-ip:27007 peer info: IV_VER=2.5.4
Sat Dec 11 02:46:49 2021 us=593564 x.x.x.x-public-ip:27007 peer info: IV_PLAT=win
Sat Dec 11 02:46:49 2021 us=593572 x.x.x.x-public-ip:27007 peer info: IV_PROTO=6
Sat Dec 11 02:46:49 2021 us=593579 x.x.x.x-public-ip:27007 peer info: IV_NCP=2
Sat Dec 11 02:46:49 2021 us=593587 x.x.x.x-public-ip:27007 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:AES-256-CBC
Sat Dec 11 02:46:49 2021 us=593594 x.x.x.x-public-ip:27007 peer info: IV_LZ4=1
Sat Dec 11 02:46:49 2021 us=593601 x.x.x.x-public-ip:27007 peer info: IV_LZ4v2=1
Sat Dec 11 02:46:49 2021 us=593611 x.x.x.x-public-ip:27007 peer info: IV_LZO=1
Sat Dec 11 02:46:49 2021 us=593618 x.x.x.x-public-ip:27007 peer info: IV_COMP_STUB=1
Sat Dec 11 02:46:49 2021 us=593625 x.x.x.x-public-ip:27007 peer info: IV_COMP_STUBv2=1
Sat Dec 11 02:46:49 2021 us=593632 x.x.x.x-public-ip:27007 peer info: IV_TCPNL=1
Sat Dec 11 02:46:49 2021 us=593639 x.x.x.x-public-ip:27007 peer info: IV_GUI_VER=OpenVPN_GUI_11
Sat Dec 11 02:46:49 2021 us=593647 x.x.x.x-public-ip:27007 peer info: IV_SSO=openurl,crtext
Sat Dec 11 02:46:49 2021 us=629621 x.x.x.x-public-ip:27007 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Sat Dec 11 02:46:49 2021 us=629698 x.x.x.x-public-ip:27007 [openvpn-windows-client] Peer Connection Initiated with [AF_INET]x.x.x.x-public-ip:27007
Sat Dec 11 02:46:49 2021 us=629822 MULTI: new connection by client 'openvpn-windows-client' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Sat Dec 11 02:46:49 2021 us=629842 MULTI_sva: pool returned IPv4=10.200.0.36, IPv6=(Not enabled)
Sat Dec 11 02:46:49 2021 us=629872 MULTI: Learn: 10.200.0.36 -> openvpn-windows-client/x.x.x.x-public-ip:27007
Sat Dec 11 02:46:49 2021 us=629881 MULTI: primary virtual IP for openvpn-windows-client/x.x.x.x-public-ip:27007: 10.200.0.36
Sat Dec 11 02:46:50 2021 us=697344 openvpn-windows-client/x.x.x.x-public-ip:27007 PUSH: Received control message: 'PUSH_REQUEST'
Sat Dec 11 02:46:50 2021 us=697438 openvpn-windows-client/x.x.x.x-public-ip:27007 SENT CONTROL [openvpn-windows-client]: 'PUSH_REPLY,route 10.1.0.0 255.255.0.0,route 10.7.0.0 255.255.0.0,route 10.8.0.0 255.255.0.0,route 10.2.0.0 255.255.0.0,route 10.3.0.0 255.255.0.0,route 35.197.150.103 255.255.255.255,route 10.4.0.0 255.255.0.0,route 35.197.150.103 255.255.255.255,route 54.73.137.198 255.255.255.255,route 63.35.3.198 255.255.255.255,dhcp-option DNS 10.1.0.2,route-gateway 10.200.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.200.0.36 255.255.255.0,peer-id 3,cipher AES-256-GCM' (status=1)
Sat Dec 11 02:46:50 2021 us=697452 openvpn-windows-client/x.x.x.x-public-ip:27007 Data Channel: using negotiated cipher 'AES-256-GCM'
Sat Dec 11 02:46:50 2021 us=697473 openvpn-windows-client/x.x.x.x-public-ip:27007 Data Channel MTU parms [ L:1550 D:1450 EF:50 EB:406 ET:0 EL:3 ]
Sat Dec 11 02:46:50 2021 us=697540 openvpn-windows-client/x.x.x.x-public-ip:27007 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sat Dec 11 02:46:50 2021 us=697551 openvpn-windows-client/x.x.x.x-public-ip:27007 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sat Dec 11 02:46:50 2021 us=839908 openvpn-windows-client/x.x.x.x-public-ip:27007 MULTI: bad source address from client [::], packet dropped

port 443
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
crl-verify crl.pem
dh dh2048.pem
server 10.200.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
keepalive 10 120
tls-auth ta.key 0
auth SHA256
cipher AES-256-CBC
compress lz4-v2
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
verb 4
explicit-exit-notify 1
topology subnet
push "route 10.1.0.0 255.255.0.0"
push "route 10.7.0.0 255.255.0.0"
push "route 10.8.0.0 255.255.0.0"
push "route 10.2.0.0 255.255.0.0"
push "route 10.3.0.0 255.255.0.0"
push "route x.x.x.x 255.255.255.255"
push "route 10.4.0.0 255.255.0.0"

push "route x.gr7.us-east-1.eks.amazonaws.com 255.255.255.255"
push "route x.gr7.us-east-1.eks.amazonaws.com 255.255.255.255"
push "route x.gr7.eu-west-1.eks.amazonaws.com 255.255.255.255"

push "dhcp-option DNS 10.1.0.2"
user nobody
group nogroup

port 443
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
crl-verify crl.pem
dh dh2048.pem
server 10.200.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
keepalive 10 120
tls-auth ta.key 0
auth SHA256
cipher AES-256-CBC
compress lz4-v2
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
verb 4
explicit-exit-notify 1
topology subnet
push "route 10.1.0.0 255.255.0.0"
push "route 10.7.0.0 255.255.0.0"
push "route 10.8.0.0 255.255.0.0"

push "route 10.2.0.0 255.255.0.0"
push "route 10.3.0.0 255.255.0.0"
push "route x.x.x.x 255.255.255.255"
push "route 10.4.0.0 255.255.0.0"

# replaced xx.aks.amazon.com with ip
push "route x.x.x.x 255.255.255.255"
push "route x.x.x.x 255.255.255.255"
push "route x.x.x.x 255.255.255.255"

push "dhcp-option DNS 10.1.0.2"
user nobody
group nogroup
log-append /var/log/openvpn/openvpn.log

client
dev tun
proto udp
remote x.x.x.x 443
resolv-retry 10
nobind

persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
auth SHA256
key-direction 1
verb 4
compress lz4-v2

allow-pull-fqdn

tunnelblick client log

*Tunnelblick: macOS 12.0.1 (21A559); Tunnelblick 3.8.7a (build 5770); Admin user
git commit 7df4363a5980ab8be88a6a3aaeee028f36813607
The Tunnelblick.app process is not being translated (arm64)
System Integrity Protection is enabled
Model: MacBookPro18,3

Configuration filename_ovpn

"Sanitized" condensed configuration file for /Users/junzhongloo/Library/Application Support/Tunnelblick/Configurations/filename_ovpn.tblk:

client
dev tun
proto udp
remote x.x.x.x 443
resolv-retry 10
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
auth SHA256
key-direction 1
verb 3
compress lz4-v2
allow-pull-fqdn
<ca>
[Security-related line(s) omitted]
</ca>
<cert>
[Security-related line(s) omitted]
</cert>
<key>
[Security-related line(s) omitted]
</key>
<tls-auth>
[Security-related line(s) omitted]
</tls-auth>


================================================================================

Files in filename_ovpn.tblk:
      Contents/Resources/config.ovpn

================================================================================

Tunnelblick Kext Policy Data:



================================================================================

Configuration preferences:

-notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0
-lastConnectionSucceeded = 1

================================================================================

Wildcard preferences:

-notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0

================================================================================

Program preferences:

launchAtNextLogin = 1
tunnelblickVersionHistory = (
    "3.8.7a (build 5770)"
)
statusDisplayNumber = 0
lastLaunchTime = 660860337.4005229
doNotShowSplashScreen = 1
lastLanguageAtLaunchWasRTL = 0
connectionWindowDisplayCriteria = showWhenConnecting
maxLogDisplaySize = 102400
lastConnectedDisplayName = filename_ovpn
keyboardShortcutIndex = 1
updateCheckAutomatically = 1
NSWindow Frame ConnectingWindow = 591 545 389 217 0 0 1512 944 
detailsWindowFrameVersion = 5770
detailsWindowFrame = {{105, 104}, {1007, 559}}
detailsWindowLeftFrame = {{0, 0}, {183.5, 439}}
detailsWindowViewIndex = 0
detailsWindowConfigurationsTabIdentifier = log
leftNavSelectedDisplayName = filename_ovpn
haveDealtWithOldTunTapPreferences = 1
haveDealtWithAlwaysShowLoginWindow = 1
haveDealtWithOldLoginItem = 1
haveDealtWithAfterDisconnect = 1
SUEnableAutomaticChecks = 1
SUScheduledCheckInterval = 86400
SULastCheckTime = 2021-12-10 20:18:58 +0000
SUHasLaunchedBefore = 1

================================================================================

Forced preferences:

(None)

================================================================================

Deployed forced preferences:

(None)

================================================================================

Tunnelblick Log:

2021-12-11 15:23:13.354797 *Tunnelblick: macOS 12.0.1 (21A559); Tunnelblick 3.8.7a (build 5770)
2021-12-11 15:23:13.953134 *Tunnelblick: Attempting connection with filename_ovpn using shadow copy; Set nameserver = 769; monitoring connection
2021-12-11 15:23:13.953580 *Tunnelblick: openvpnstart startfilename_ovpn.tblk5663976901034652464-ptADGNWradsgnw2.5.4-openssl-1.1.1l <password>
2021-12-11 15:23:13.973862 *Tunnelblick: openvpnstart starting OpenVPN
2021-12-11 15:23:14.267567 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
2021-12-11 15:23:14.267732 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2021-12-11 15:23:14.267913 OpenVPN 2.5.4 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Nov 29 2021
2021-12-11 15:23:14.267928 library versions: OpenSSL 1.1.1l  24 Aug 2021, LZO 2.10
2021-12-11 15:23:14.268799 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:56639
2021-12-11 15:23:14.268814 Need hold release from management interface, waiting...
2021-12-11 15:23:14.579331 *Tunnelblick: openvpnstart log:
     OpenVPN started successfully.
     Command used to start OpenVPN (one argument per displayed line):
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.5.4-openssl-1.1.1l/openvpn
          --daemon
          --log /Library/Application Support/Tunnelblick/Logs/-SUsers-Sjunzhongloo-SLibrary-SApplication Support-STunnelblick-SConfigurations-Sfilename_ovpn.tblk-SContents-SResources-Sconfig.ovpn.769_0_1_0_34652464.56639.openvpn.log
          --cd /Library/Application Support/Tunnelblick/Users/junzhongloo/filename_ovpn.tblk/Contents/Resources
          --machine-readable-output
          --setenv IV_GUI_VER "net.tunnelblick.tunnelblick 5770 3.8.7a (build 5770)"
          --verb 3
          --config /Library/Application Support/Tunnelblick/Users/junzhongloo/filename_ovpn.tblk/Contents/Resources/config.ovpn
          --setenv TUNNELBLICK_CONFIG_FOLDER /Library/Application Support/Tunnelblick/Users/junzhongloo/filename_ovpn.tblk/Contents/Resources
          --verb 3
          --cd /Library/Application Support/Tunnelblick/Users/junzhongloo/filename_ovpn.tblk/Contents/Resources
          --management 127.0.0.1 56639 /Library/Application Support/Tunnelblick/Mips/filename_ovpn.tblk.mip
          --management-query-passwords
          --management-hold
          --script-security 2
          --route-up /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
          --down /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
2021-12-11 15:23:14.602586 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:56639
2021-12-11 15:23:14.611301 MANAGEMENT: CMD 'pid'
2021-12-11 15:23:14.611420 MANAGEMENT: CMD 'auth-retry interact'
2021-12-11 15:23:14.611480 MANAGEMENT: CMD 'state on'
2021-12-11 15:23:14.611527 MANAGEMENT: CMD 'state'
2021-12-11 15:23:14.611603 MANAGEMENT: CMD 'bytecount 1'
2021-12-11 15:23:14.612407 *Tunnelblick: Established communication with OpenVPN
2021-12-11 15:23:14.614609 *Tunnelblick: >INFO:OpenVPN Management Interface Version 3 -- type 'help' for more info
2021-12-11 15:23:14.616108 MANAGEMENT: CMD 'hold release'
2021-12-11 15:23:14.616350 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2021-12-11 15:23:14.619034 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
2021-12-11 15:23:14.619107 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
2021-12-11 15:23:14.619239 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:443
2021-12-11 15:23:14.620563 Socket Buffers: R=[786896->786896] S=[9216->9216]
2021-12-11 15:23:14.620596 UDP link local: (not bound)
2021-12-11 15:23:14.620657 UDP link remote: [AF_INET]x.x.x.x:443
2021-12-11 15:23:14.620699 MANAGEMENT: >STATE:1639189394,WAIT,,,,,,
2021-12-11 15:23:14.657205 MANAGEMENT: >STATE:1639189394,AUTH,,,,,,
2021-12-11 15:23:14.662159 TLS: Initial packet from [AF_INET]x.x.x.x:443, sid=2e5f7170 1cd5df12
2021-12-11 15:23:14.701769 VERIFY OK: depth=1, CN=CNNameReplaced
2021-12-11 15:23:14.705804 VERIFY KU OK
2021-12-11 15:23:14.705885 Validating certificate extended key usage
2021-12-11 15:23:14.705902 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2021-12-11 15:23:14.705918 VERIFY EKU OK
2021-12-11 15:23:14.705932 VERIFY OK: depth=0, CN=server
2021-12-11 15:23:14.762953 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
2021-12-11 15:23:14.764115 [server] Peer Connection Initiated with [AF_INET]x.x.x.x:443
2021-12-11 15:23:15.935486 MANAGEMENT: >STATE:1639189395,GET_CONFIG,,,,,,
2021-12-11 15:23:15.935741 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2021-12-11 15:23:15.991746 PUSH: Received control message: 'PUSH_REPLY,route 10.1.0.0 255.255.0.0,route 10.7.0.0 255.255.0.0,route 10.8.0.0 255.255.0.0,route 10.2.0.0 255.255.0.0,route 10.3.0.0 255.255.0.0,route x.x.x.x 255.255.255.255,route 10.4.0.0 255.255.0.0,route x.x.x.x 255.255.255.255,route x.x.x.x2 255.255.255.255,route x.x.x.x3 255.255.255.255,dhcp-option DNS 10.1.0.2,route-gateway 10.200.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.200.0.31 255.255.255.0,peer-id 4,cipher AES-256-GCM'
2021-12-11 15:23:16.003018 OPTIONS IMPORT: timers and/or timeouts modified
2021-12-11 15:23:16.003147 OPTIONS IMPORT: --ifconfig/up options modified
2021-12-11 15:23:16.003164 OPTIONS IMPORT: route options modified
2021-12-11 15:23:16.003177 OPTIONS IMPORT: route-related options modified
2021-12-11 15:23:16.003189 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2021-12-11 15:23:16.003202 OPTIONS IMPORT: peer-id set
2021-12-11 15:23:16.003216 OPTIONS IMPORT: adjusting link_mtu to 1625
2021-12-11 15:23:16.003229 OPTIONS IMPORT: data channel crypto options modified
2021-12-11 15:23:16.003295 Data Channel: using negotiated cipher 'AES-256-GCM'
2021-12-11 15:23:16.003422 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-12-11 15:23:16.003435 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-12-11 15:23:16.008024 Opened utun device utun3
2021-12-11 15:23:16.008132 MANAGEMENT: >STATE:1639189396,ASSIGN_IP,,10.200.0.31,,,,
2021-12-11 15:23:16.008157 /sbin/ifconfig utun3 delete
                           ioctl (SIOCDIFADDR): Can't assign requested address
2021-12-11 15:23:16.033566 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2021-12-11 15:23:16.033621 /sbin/ifconfig utun3 10.200.0.31 10.200.0.31 netmask 255.255.255.0 mtu 1500 up
2021-12-11 15:23:16.041064 /sbin/route add -net 10.200.0.0 10.200.0.31 255.255.255.0
                           add net 10.200.0.0: gateway 10.200.0.31
2021-12-11 15:23:16.046708 MANAGEMENT: >STATE:1639189396,ADD_ROUTES,,,,,,
2021-12-11 15:23:16.046817 /sbin/route add -net 10.1.0.0 10.200.0.1 255.255.0.0
                           add net 10.1.0.0: gateway 10.200.0.1
2021-12-11 15:23:16.055498 /sbin/route add -net 10.7.0.0 10.200.0.1 255.255.0.0
                           add net 10.7.0.0: gateway 10.200.0.1
2021-12-11 15:23:16.058375 /sbin/route add -net 10.8.0.0 10.200.0.1 255.255.0.0
                           add net 10.8.0.0: gateway 10.200.0.1
2021-12-11 15:23:16.060800 /sbin/route add -net 10.2.0.0 10.200.0.1 255.255.0.0
                           add net 10.2.0.0: gateway 10.200.0.1
2021-12-11 15:23:16.063412 /sbin/route add -net 10.3.0.0 10.200.0.1 255.255.0.0
                           add net 10.3.0.0: gateway 10.200.0.1
2021-12-11 15:23:16.065631 /sbin/route add -net x.x.x.x 10.200.0.1 255.255.255.255
                           add net x.x.x.x: gateway 10.200.0.1
2021-12-11 15:23:16.067782 /sbin/route add -net 10.4.0.0 10.200.0.1 255.255.0.0
                           add net 10.4.0.0: gateway 10.200.0.1
2021-12-11 15:23:16.070146 /sbin/route add -net x.x.x.x 10.200.0.1 255.255.255.255
                           route: writing to routing socket: File exists
                           add net x.x.x.x: gateway 10.200.0.1: File exists
2021-12-11 15:23:16.072345 /sbin/route add -net x.x.x.x2 10.200.0.1 255.255.255.255
                           add net x.x.x.x2: gateway 10.200.0.1
2021-12-11 15:23:16.074401 /sbin/route add -net x.x.x.x3 10.200.0.1 255.255.255.255
                           add net x.x.x.x3: gateway 10.200.0.1
                           15:23:16 *Tunnelblick:  **********************************************
                           15:23:16 *Tunnelblick:  Start of output from client.up.tunnelblick.sh
                           15:23:18 *Tunnelblick:  Retrieved from OpenVPN: name server(s) [ 10.1.0.2 ], search domain(s) [ ] and SMB server(s) [ ] and using default domain name [ openvpn ]
                           15:23:18 *Tunnelblick:  Not aggregating ServerAddresses because running on macOS 10.6 or higher
                           15:23:18 *Tunnelblick:  Setting search domains to 'openvpn' because the search domains were not set manually (or are allowed to be changed) and 'Prepend domain name to search domains' was not selected
                           15:23:19 *Tunnelblick:  Saved the DNS and SMB configurations so they can be restored
                           15:23:19 *Tunnelblick:  Changed DNS ServerAddresses setting from '208.67.222.222 208.67.220.220' to '10.1.0.2'
                           15:23:19 *Tunnelblick:  Changed DNS SearchDomains setting from 'Home' to 'openvpn'
                           15:23:19 *Tunnelblick:  Changed DNS DomainName setting from '' to 'openvpn'
                           15:23:19 *Tunnelblick:  Did not change SMB NetBIOSName setting of ''
                           15:23:19 *Tunnelblick:  Did not change SMB Workgroup setting of ''
                           15:23:19 *Tunnelblick:  Did not change SMB WINSAddresses setting of ''
                           15:23:19 *Tunnelblick:  DNS servers '10.1.0.2' will be used for DNS queries when the VPN is active
                           15:23:19 *Tunnelblick:  NOTE: The DNS servers do not include any free public DNS servers known to Tunnelblick. This may cause DNS queries to fail or be intercepted or falsified even if they are directed through the VPN. Specify only known public DNS servers or DNS servers located on the VPN network to avoid such problems.
                           15:23:19 *Tunnelblick:  Flushed the DNS cache via dscacheutil
                           15:23:19 *Tunnelblick:  /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil
                           15:23:19 *Tunnelblick:  Notified mDNSResponder that the DNS cache was flushed
                           15:23:19 *Tunnelblick:  Not notifying mDNSResponderHelper that the DNS cache was flushed because it is not running
                           15:23:19 *Tunnelblick:  Setting up to monitor system configuration with process-network-changes
                           15:23:19 *Tunnelblick:  End of output from client.up.tunnelblick.sh
                           15:23:19 *Tunnelblick:  **********************************************
2021-12-11 15:23:19.539096 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2021-12-11 15:23:19.539103 Initialization Sequence Completed
2021-12-11 15:23:19.539116 MANAGEMENT: >STATE:1639189399,CONNECTED,SUCCESS,10.200.0.31,x.x.x.x,443,,
2021-12-11 15:23:20.766113 *Tunnelblick: DNS address 10.1.0.2 is being routed through the VPN
2021-12-11 15:23:26.499022 *Tunnelblick: This computer's apparent public IP address (x.x.x.x-public-ip) was unchanged after the connection was made

================================================================================

Down log:

15:21:16 *Tunnelblick:  **********************************************
15:21:16 *Tunnelblick:  Start of output from client.down.tunnelblick.sh
15:21:16 *Tunnelblick:  Cancelled monitoring system configuration changes
15:21:16 *Tunnelblick:  Restored State:DNS
15:21:16 *Tunnelblick:  Restored Setup:DNS
15:21:16 *Tunnelblick:  Removed State:SMB
15:21:16 *Tunnelblick:  Restored DNS and SMB settings
15:21:16 *Tunnelblick:  Flushed the DNS cache with dscacheutil -flushcache
15:21:16 *Tunnelblick:  Notified mDNSResponder that the DNS cache was flushed
15:21:16 *Tunnelblick:  End of output from client.down.tunnelblick.sh
15:21:16 *Tunnelblick:  **********************************************

================================================================================

Previous down log:

14:55:54 *Tunnelblick:  **********************************************
14:55:54 *Tunnelblick:  Start of output from client.down.tunnelblick.sh
14:55:54 *Tunnelblick:  Cancelled monitoring system configuration changes
14:55:54 *Tunnelblick:  Restored State:DNS
14:55:54 *Tunnelblick:  Restored Setup:DNS
14:55:54 *Tunnelblick:  Removed State:SMB
14:55:54 *Tunnelblick:  Restored DNS and SMB settings
14:55:54 *Tunnelblick:  Flushed the DNS cache with dscacheutil -flushcache
14:55:54 *Tunnelblick:  Notified mDNSResponder that the DNS cache was flushed
14:55:54 *Tunnelblick:  End of output from client.down.tunnelblick.sh
14:55:54 *Tunnelblick:  **********************************************

...

openvpn connect 2.5.4 log

2021-12-11 15:46:48 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
2021-12-11 15:46:48 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2021-12-11 15:46:48 OpenVPN 2.5.4 Windows-MSVC [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Oct 20 2021
2021-12-11 15:46:48 Windows version 10.0 (Windows 10 or greater) 64bit
2021-12-11 15:46:48 library versions: OpenSSL 1.1.1l  24 Aug 2021, LZO 2.10
2021-12-11 15:46:48 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
2021-12-11 15:46:48 Need hold release from management interface, waiting...
2021-12-11 15:46:49 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
2021-12-11 15:46:49 MANAGEMENT: CMD 'state on'
2021-12-11 15:46:49 MANAGEMENT: CMD 'log all on'
2021-12-11 15:46:49 MANAGEMENT: CMD 'echo all on'
2021-12-11 15:46:49 MANAGEMENT: CMD 'bytecount 5'
2021-12-11 15:46:49 MANAGEMENT: CMD 'hold off'
2021-12-11 15:46:49 MANAGEMENT: CMD 'hold release'
2021-12-11 15:46:49 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
2021-12-11 15:46:49 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
2021-12-11 15:46:49 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x-server-ip:443
2021-12-11 15:46:49 Socket Buffers: R=[65536->65536] S=[65536->65536]
2021-12-11 15:46:49 UDP link local: (not bound)
2021-12-11 15:46:49 UDP link remote: [AF_INET]x.x.x.x-server-ip:443
2021-12-11 15:46:49 MANAGEMENT: >STATE:1639190809,WAIT,,,,,,
2021-12-11 15:46:49 MANAGEMENT: >STATE:1639190809,AUTH,,,,,,
2021-12-11 15:46:49 TLS: Initial packet from [AF_INET]x.x.x.x-server-ip:443, sid=1439b10a a6f74e7e
2021-12-11 15:46:49 VERIFY OK: depth=1, CN=OnFinality
2021-12-11 15:46:49 VERIFY KU OK
2021-12-11 15:46:49 Validating certificate extended key usage
2021-12-11 15:46:49 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2021-12-11 15:46:49 VERIFY EKU OK
2021-12-11 15:46:49 VERIFY OK: depth=0, CN=server
2021-12-11 15:46:49 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
2021-12-11 15:46:49 [server] Peer Connection Initiated with [AF_INET]x.x.x.x-server-ip:443
2021-12-11 15:46:50 MANAGEMENT: >STATE:1639190810,GET_CONFIG,,,,,,
2021-12-11 15:46:50 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2021-12-11 15:46:50 PUSH: Received control message: 'PUSH_REPLY,route 10.1.0.0 255.255.0.0,route 10.7.0.0 255.255.0.0,route 10.8.0.0 255.255.0.0,route 10.2.0.0 255.255.0.0,route 10.3.0.0 255.255.0.0,route x.x.x.x-ip-1 255.255.255.255,route 10.4.0.0 255.255.0.0,route x.x.x.x-ip-1 255.255.255.255,route x.x.x.x-ip-2 255.255.255.255,route x.x.x.x-ip-3 255.255.255.255,dhcp-option DNS 10.1.0.2,route-gateway 10.200.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.200.0.36 255.255.255.0,peer-id 3,cipher AES-256-GCM'
2021-12-11 15:46:50 OPTIONS IMPORT: timers and/or timeouts modified
2021-12-11 15:46:50 OPTIONS IMPORT: --ifconfig/up options modified
2021-12-11 15:46:50 OPTIONS IMPORT: route options modified
2021-12-11 15:46:50 OPTIONS IMPORT: route-related options modified
2021-12-11 15:46:50 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2021-12-11 15:46:50 OPTIONS IMPORT: peer-id set
2021-12-11 15:46:50 OPTIONS IMPORT: adjusting link_mtu to 1625
2021-12-11 15:46:50 OPTIONS IMPORT: data channel crypto options modified
2021-12-11 15:46:50 Data Channel: using negotiated cipher 'AES-256-GCM'
2021-12-11 15:46:50 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-12-11 15:46:50 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-12-11 15:46:50 interactive service msg_channel=600
2021-12-11 15:46:50 open_tun
2021-12-11 15:46:50 tap-windows6 device [OpenVPN TAP-Windows6] opened
2021-12-11 15:46:50 TAP-Windows Driver Version 9.24 
2021-12-11 15:46:50 Set TAP-Windows TUN subnet mode network/local/netmask = 10.200.0.0/10.200.0.36/255.255.255.0 [SUCCEEDED]
2021-12-11 15:46:50 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.200.0.36/255.255.255.0 on interface {interface-edited} [DHCP-serv: 10.200.0.254, lease-time: 31536000]
2021-12-11 15:46:50 Successful ARP Flush on interface [110] {interface-edited}
2021-12-11 15:46:50 MANAGEMENT: >STATE:1639190810,ASSIGN_IP,,10.200.0.36,,,,
2021-12-11 15:46:50 IPv4 MTU set to 1500 on interface 110 using service
2021-12-11 15:46:55 TEST ROUTES: 10/10 succeeded len=10 ret=1 a=0 u/d=up
2021-12-11 15:46:55 MANAGEMENT: >STATE:1639190815,ADD_ROUTES,,,,,,
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD 10.1.0.0 MASK 255.255.0.0 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD 10.7.0.0 MASK 255.255.0.0 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.0.0 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD 10.2.0.0 MASK 255.255.0.0 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD 10.3.0.0 MASK 255.255.0.0 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD x.x.x.x-ip-1 MASK 255.255.255.255 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD 10.4.0.0 MASK 255.255.0.0 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD x.x.x.x-ip-1 MASK 255.255.255.255 10.200.0.1
2021-12-11 15:46:55 ROUTE: route addition failed using service: The object already exists.   [status=5010 if_index=110]
2021-12-11 15:46:55 Route addition via service failed
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD x.x.x.x-ip-2 MASK 255.255.255.255 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD x.x.x.x-ip-3 MASK 255.255.255.255 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2021-12-11 15:46:55 Initialization Sequence Completed
2021-12-11 15:46:55 MANAGEMENT: >STATE:1639190815,CONNECTED,SUCCESS,10.200.0.36,x.x.x.x-server-ip,443,,2021-12-11 15:46:48 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
2021-12-11 15:46:48 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2021-12-11 15:46:48 OpenVPN 2.5.4 Windows-MSVC [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Oct 20 2021
2021-12-11 15:46:48 Windows version 10.0 (Windows 10 or greater) 64bit
2021-12-11 15:46:48 library versions: OpenSSL 1.1.1l  24 Aug 2021, LZO 2.10
2021-12-11 15:46:48 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
2021-12-11 15:46:48 Need hold release from management interface, waiting...
2021-12-11 15:46:49 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
2021-12-11 15:46:49 MANAGEMENT: CMD 'state on'
2021-12-11 15:46:49 MANAGEMENT: CMD 'log all on'
2021-12-11 15:46:49 MANAGEMENT: CMD 'echo all on'
2021-12-11 15:46:49 MANAGEMENT: CMD 'bytecount 5'
2021-12-11 15:46:49 MANAGEMENT: CMD 'hold off'
2021-12-11 15:46:49 MANAGEMENT: CMD 'hold release'
2021-12-11 15:46:49 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
2021-12-11 15:46:49 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
2021-12-11 15:46:49 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x-server-ip:443
2021-12-11 15:46:49 Socket Buffers: R=[65536->65536] S=[65536->65536]
2021-12-11 15:46:49 UDP link local: (not bound)
2021-12-11 15:46:49 UDP link remote: [AF_INET]x.x.x.x-server-ip:443
2021-12-11 15:46:49 MANAGEMENT: >STATE:1639190809,WAIT,,,,,,
2021-12-11 15:46:49 MANAGEMENT: >STATE:1639190809,AUTH,,,,,,
2021-12-11 15:46:49 TLS: Initial packet from [AF_INET]x.x.x.x-server-ip:443, sid=1439b10a a6f74e7e
2021-12-11 15:46:49 VERIFY OK: depth=1, CN=OnFinality
2021-12-11 15:46:49 VERIFY KU OK
2021-12-11 15:46:49 Validating certificate extended key usage
2021-12-11 15:46:49 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2021-12-11 15:46:49 VERIFY EKU OK
2021-12-11 15:46:49 VERIFY OK: depth=0, CN=server
2021-12-11 15:46:49 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
2021-12-11 15:46:49 [server] Peer Connection Initiated with [AF_INET]x.x.x.x-server-ip:443
2021-12-11 15:46:50 MANAGEMENT: >STATE:1639190810,GET_CONFIG,,,,,,
2021-12-11 15:46:50 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2021-12-11 15:46:50 PUSH: Received control message: 'PUSH_REPLY,route 10.1.0.0 255.255.0.0,route 10.7.0.0 255.255.0.0,route 10.8.0.0 255.255.0.0,route 10.2.0.0 255.255.0.0,route 10.3.0.0 255.255.0.0,route x.x.x.x-ip-1 255.255.255.255,route 10.4.0.0 255.255.0.0,route x.x.x.x-ip-1 255.255.255.255,route x.x.x.x-ip-2 255.255.255.255,route x.x.x.x-ip-3 255.255.255.255,dhcp-option DNS 10.1.0.2,route-gateway 10.200.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.200.0.36 255.255.255.0,peer-id 3,cipher AES-256-GCM'
2021-12-11 15:46:50 OPTIONS IMPORT: timers and/or timeouts modified
2021-12-11 15:46:50 OPTIONS IMPORT: --ifconfig/up options modified
2021-12-11 15:46:50 OPTIONS IMPORT: route options modified
2021-12-11 15:46:50 OPTIONS IMPORT: route-related options modified
2021-12-11 15:46:50 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2021-12-11 15:46:50 OPTIONS IMPORT: peer-id set
2021-12-11 15:46:50 OPTIONS IMPORT: adjusting link_mtu to 1625
2021-12-11 15:46:50 OPTIONS IMPORT: data channel crypto options modified
2021-12-11 15:46:50 Data Channel: using negotiated cipher 'AES-256-GCM'
2021-12-11 15:46:50 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-12-11 15:46:50 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-12-11 15:46:50 interactive service msg_channel=600
2021-12-11 15:46:50 open_tun
2021-12-11 15:46:50 tap-windows6 device [OpenVPN TAP-Windows6] opened
2021-12-11 15:46:50 TAP-Windows Driver Version 9.24 
2021-12-11 15:46:50 Set TAP-Windows TUN subnet mode network/local/netmask = 10.200.0.0/10.200.0.36/255.255.255.0 [SUCCEEDED]
2021-12-11 15:46:50 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.200.0.36/255.255.255.0 on interface {interface-edited} [DHCP-serv: 10.200.0.254, lease-time: 31536000]
2021-12-11 15:46:50 Successful ARP Flush on interface [110] {interface-edited}
2021-12-11 15:46:50 MANAGEMENT: >STATE:1639190810,ASSIGN_IP,,10.200.0.36,,,,
2021-12-11 15:46:50 IPv4 MTU set to 1500 on interface 110 using service
2021-12-11 15:46:55 TEST ROUTES: 10/10 succeeded len=10 ret=1 a=0 u/d=up
2021-12-11 15:46:55 MANAGEMENT: >STATE:1639190815,ADD_ROUTES,,,,,,
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD 10.1.0.0 MASK 255.255.0.0 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD 10.7.0.0 MASK 255.255.0.0 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.0.0 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD 10.2.0.0 MASK 255.255.0.0 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD 10.3.0.0 MASK 255.255.0.0 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD x.x.x.x-ip-1 MASK 255.255.255.255 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD 10.4.0.0 MASK 255.255.0.0 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD x.x.x.x-ip-1 MASK 255.255.255.255 10.200.0.1
2021-12-11 15:46:55 ROUTE: route addition failed using service: The object already exists.   [status=5010 if_index=110]
2021-12-11 15:46:55 Route addition via service failed
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD x.x.x.x-ip-2 MASK 255.255.255.255 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 C:\WINDOWS\system32\route.exe ADD x.x.x.x-ip-3 MASK 255.255.255.255 10.200.0.1
2021-12-11 15:46:55 Route addition via service succeeded
2021-12-11 15:46:55 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2021-12-11 15:46:55 Initialization Sequence Completed
2021-12-11 15:46:55 MANAGEMENT: >STATE:1639190815,CONNECTED,SUCCESS,10.200.0.36,x.x.x.x-server-ip,443,,

TinCanTech

bigsprout wrote

allow-pull-fqdn <= remove this

Press all the buttons and things go wrong ..

bigsprout

TinCanTech wrote

bigsprout wrote

allow-pull-fqdn <= remove this

Press all the buttons and things go wrong ..

Hey TinCanTech,

I removed allow-pull-fqdn from the ovpn config file but still same problem 🙁

TinCanTech

please check your configs and logs as per this: https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963

bigsprout

TinCanTech wrote please check your configs and logs as per this: https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963

Edited opening post with config and logs files. Thanks for pointing that out

TinCanTech

bigsprout wrote opening post with config and logs files

And the issue is gone ..