Issue with routing to serverside LAN?

sapster77

Hi all,

Thank you for looking at this, most likely, benign problem.
My OpenVPN client can not access serverside LAN. The OpenVPN connection is fine, subsequent internet access is fine and I can access the OpenVPN server (a NAS), but no other entities on the serverside LAN. I have tried all kinds of routing commands without luck. They can't be pinged or accessed in any way.

Network topology:
Local subnet 192.168.1.0/24
Gateway (router): 192.168.1.1
OpenVPN server: 192.168.1.25
VPN subnet: 10.8.0.0/24

I also tried:
push "route 192.168.1.0 255.255.255.0 192.168.1.1"
push "route 10.8.0.0 255.255.255.0 10.8.0.1"

and all combinations thereof.
ip forwarding is enabled.

I realize that the docs state:
"Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines)." (which it is in my case).

But my router does not allow me to setup static routes, so I am hoping there is another way?
All suggestions are very very welcome as I am starting to pull my hair out 😃

Logs and configurations below:
Server.conf

proto udp
port 1194
dev openvpn-server
dev-type tun
ca /etc/certificates/CA/ownCA.crt
cert /etc/certificates/ownCrt.crt
key /etc/certificates/ownCrt.key
dh /data/dhparam.pem
crl-verify /etc/certificates/CA/ownCA.crl
server 10.8.0.0 255.255.255.0
user nobody
group nogroup
status /var/log/openvpn/openvpn-status.log
log-append  /var/log/openvpn/openvpn.log
verb 4
persist-tun
persist-key
remote-cert-tls client
topology subnet
cipher AES-256-GCM
auth SHA256
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-crypt>
duplicate-cn
push "route 192.168.1.0 255.255.255.0"
push "route 10.8.0.0 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"
client-to-client

Server logs

Peter/192.168.1.1:1194 VERIFY OK: depth=1, CN=CA
Peter/192.168.1.1:1194 VERIFY KU OK
Peter/192.168.1.1:1194 Validating certificate extended key usage
Peter/192.168.1.1:1194 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Peter/192.168.1.1:1194 VERIFY EKU OK
Peter/192.168.1.1:1194 VERIFY OK: depth=0, C=??, ST=??, L=??, O=OVPN, OU=Security, CN=Peter, emailAddress=??@vpn.vpn
Peter/192.168.1.1:1194 peer info: IV_VER=2.5.5
Peter/192.168.1.1:1194 peer info: IV_PLAT=mac
Peter/192.168.1.1:1194 peer info: IV_PROTO=6
Peter/192.168.1.1:1194 peer info: IV_NCP=2
Peter/192.168.1.1:1194 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM
Peter/192.168.1.1:1194 peer info: IV_LZ4=1
Peter/192.168.1.1:1194 peer info: IV_LZ4v2=1
Peter/192.168.1.1:1194 peer info: IV_LZO=1
Peter/192.168.1.1:1194 peer info: IV_COMP_STUB=1
Peter/192.168.1.1:1194 peer info: IV_COMP_STUBv2=1
Peter/192.168.1.1:1194 peer info: IV_TCPNL=1
Peter/192.168.1.1:1194 peer info: IV_GUI_VER="net.tunnelblick.tunnelblick_5790_3.8.8beta03__build_5790)"
Peter/192.168.1.1:1194 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Peter/192.168.1.1:1194 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Peter/192.168.1.1:1194 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 4096 bit RSA
Peter/192.168.1.1:1194 PUSH: Received control message: 'PUSH_REQUEST'
Peter/192.168.1.1:1194 SENT CONTROL [Peter]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 10.8.0.0 255.255.255.0,dhcp-option DNS 8.8.8.8,route-gateway 10.8.0.1,topology subnet,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
77.241.136.29:12307 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
77.241.136.29:12307 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
77.241.136.29:12307 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
77.241.136.29:12307 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
77.241.136.29:12307 TLS: Initial packet from [AF_INET]77.241.136.29:12307, sid=88b47132 1893009c
77.241.136.29:12307 VERIFY OK: depth=1, CN=CA
77.241.136.29:12307 VERIFY KU OK
77.241.136.29:12307 Validating certificate extended key usage
77.241.136.29:12307 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
77.241.136.29:12307 VERIFY EKU OK
77.241.136.29:12307 VERIFY OK: depth=0, C=??, ST=??, L=??, O=OVPN, OU=Security, CN=Peter, emailAddress=??@vpn.vpn
77.241.136.29:12307 peer info: IV_VER=2.5.5
77.241.136.29:12307 peer info: IV_PLAT=mac
77.241.136.29:12307 peer info: IV_PROTO=6
77.241.136.29:12307 peer info: IV_NCP=2
77.241.136.29:12307 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM
77.241.136.29:12307 peer info: IV_LZ4=1
77.241.136.29:12307 peer info: IV_LZ4v2=1
77.241.136.29:12307 peer info: IV_LZO=1
77.241.136.29:12307 peer info: IV_COMP_STUB=1
77.241.136.29:12307 peer info: IV_COMP_STUBv2=1
77.241.136.29:12307 peer info: IV_TCPNL=1
77.241.136.29:12307 peer info: IV_GUI_VER="net.tunnelblick.tunnelblick_5790_3.8.8beta03__build_5790)"
77.241.136.29:12307 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 4096 bit RSA
77.241.136.29:12307 [Peter] Peer Connection Initiated with [AF_INET]77.241.136.29:12307
Peter/77.241.136.29:12307 MULTI_sva: pool returned IPv4=10.8.0.3, IPv6=(Not enabled)
Peter/77.241.136.29:12307 MULTI: Learn: 10.8.0.3 -> Peter/77.241.136.29:12307
Peter/77.241.136.29:12307 MULTI: primary virtual IP for Peter/77.241.136.29:12307: 10.8.0.3
Peter/77.241.136.29:12307 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Peter/77.241.136.29:12307 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Peter/77.241.136.29:12307 SENT CONTROL [Peter]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 10.8.0.0 255.255.255.0,dhcp-option DNS 8.8.8.8,route-gateway 10.8.0.1,topology subnet,ifconfig 10.8.0.3 255.255.255.0,peer-id 1,cipher AES-256-GCM' (status=1)
Peter/77.241.136.29:12307 PUSH: Received control message: 'PUSH_REQUEST'

client conf:

client
dev tun
proto udp
port 1194
remote xxx.xxx.xxx.xxx 1194
persist-key
persist-tun
float
pull

<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

</ca>
<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----

</key>
verb 4
remote-cert-tls server
auth SHA256
cipher AES-256-GCM
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-crypt>

client logs:

2022-03-04 20:45:21.557714 *Tunnelblick: macOS 12.2.1 (21D62); Tunnelblick 3.8.8beta03 (build 5790); prior version 3.8.8beta02 (build 5780)
2022-03-04 20:45:22.035026 *Tunnelblick: Waiting for network to become available 
2022-03-04 20:45:26.176404 *Tunnelblick: Attempting connection with PeterTrueNAS using shadow copy; Set nameserver = 1025; monitoring connection
2022-03-04 20:45:26.177797 *Tunnelblick: openvpnstart start PeterTrueNAS.tblk 55801 1025 0 1 0 34652464 -ptADGNWradsgnw 2.5.5-openssl-1.1.1m <password>
2022-03-04 20:45:26.214719 *Tunnelblick: openvpnstart starting OpenVPN
2022-03-04 20:45:26.899620 Current Parameter Settings:
2022-03-04 20:45:26.899711   config = '/Library/Application Support/Tunnelblick/Users/petervejling/PeterTrueNAS.tblk/Contents/Resources/config.ovpn'
2022-03-04 20:45:26.899732   mode = 0
2022-03-04 20:45:26.899748   show_ciphers = DISABLED
2022-03-04 20:45:26.899763   show_digests = DISABLED
2022-03-04 20:45:26.899777   show_engines = DISABLED
2022-03-04 20:45:26.899796   genkey = DISABLED
2022-03-04 20:45:26.899812   genkey_filename = '[UNDEF]'
2022-03-04 20:45:26.899827   key_pass_file = '[UNDEF]'
2022-03-04 20:45:26.899841   show_tls_ciphers = DISABLED
2022-03-04 20:45:26.899855   connect_retry_max = 0
2022-03-04 20:45:26.899870 Connection profiles [0]:
2022-03-04 20:45:26.899888   proto = udp
2022-03-04 20:45:26.899904   local = '[UNDEF]'
2022-03-04 20:45:26.899919   local_port = '1194'
2022-03-04 20:45:26.899933   remote = 'xxxxx'
2022-03-04 20:45:26.899948   remote_port = '1194'
2022-03-04 20:45:26.899962   remote_float = ENABLED
2022-03-04 20:45:26.899977   bind_defined = DISABLED
2022-03-04 20:45:26.899991   bind_local = ENABLED
2022-03-04 20:45:26.900005   bind_ipv6_only = DISABLED
2022-03-04 20:45:26.900019   connect_retry_seconds = 5
2022-03-04 20:45:26.900033   connect_timeout = 120
2022-03-04 20:45:26.900048   xormethod = 0
2022-03-04 20:45:26.900062   xormask = ''
2022-03-04 20:45:26.900077   xormasklen = 0
2022-03-04 20:45:26.900091   socks_proxy_server = '[UNDEF]'
2022-03-04 20:45:26.900105   socks_proxy_port = '[UNDEF]'
2022-03-04 20:45:26.900120   tun_mtu = 1500
2022-03-04 20:45:26.900142   tun_mtu_defined = ENABLED
2022-03-04 20:45:26.900158   link_mtu = 1500
2022-03-04 20:45:26.900173   link_mtu_defined = DISABLED
2022-03-04 20:45:26.900187   tun_mtu_extra = 0
2022-03-04 20:45:26.900201   tun_mtu_extra_defined = DISABLED
2022-03-04 20:45:26.900216   mtu_discover_type = -1
2022-03-04 20:45:26.900230   fragment = 0
2022-03-04 20:45:26.900244   mssfix = 1450
2022-03-04 20:45:26.900258   explicit_exit_notification = 0
2022-03-04 20:45:26.900273   tls_auth_file = '[UNDEF]'
2022-03-04 20:45:26.900287   key_direction = not set
2022-03-04 20:45:26.900302   tls_crypt_file = '[INLINE]'
2022-03-04 20:45:26.900316   tls_crypt_v2_file = '[UNDEF]'
2022-03-04 20:45:26.900330 Connection profiles END
2022-03-04 20:45:26.900344   remote_random = DISABLED
2022-03-04 20:45:26.900359   ipchange = '[UNDEF]'
2022-03-04 20:45:26.900373   dev = 'tun'
2022-03-04 20:45:26.900387   dev_type = '[UNDEF]'
2022-03-04 20:45:26.900402   dev_node = '[UNDEF]'
2022-03-04 20:45:26.900416   lladdr = '[UNDEF]'
2022-03-04 20:45:26.900430   topology = 1
2022-03-04 20:45:26.900445   ifconfig_local = '[UNDEF]'
2022-03-04 20:45:26.900459   ifconfig_remote_netmask = '[UNDEF]'
2022-03-04 20:45:26.900473   ifconfig_noexec = DISABLED
2022-03-04 20:45:26.900487   ifconfig_nowarn = DISABLED
2022-03-04 20:45:26.900503   ifconfig_ipv6_local = '[UNDEF]'
2022-03-04 20:45:26.900517   ifconfig_ipv6_netbits = 0
2022-03-04 20:45:26.900531   ifconfig_ipv6_remote = '[UNDEF]'
2022-03-04 20:45:26.900546   shaper = 0
2022-03-04 20:45:26.900560   mtu_test = 0
2022-03-04 20:45:26.900574   mlock = DISABLED
2022-03-04 20:45:26.900588   keepalive_ping = 0
2022-03-04 20:45:26.900603   keepalive_timeout = 0
2022-03-04 20:45:26.900617   inactivity_timeout = 0
2022-03-04 20:45:26.900631   ping_send_timeout = 0
2022-03-04 20:45:26.900646   ping_rec_timeout = 0
2022-03-04 20:45:26.900660   ping_rec_timeout_action = 0
2022-03-04 20:45:26.900674   ping_timer_remote = DISABLED
2022-03-04 20:45:26.900688   remap_sigusr1 = 0
2022-03-04 20:45:26.900703   persist_tun = ENABLED
2022-03-04 20:45:26.900717   persist_local_ip = DISABLED
2022-03-04 20:45:26.900731   persist_remote_ip = DISABLED
2022-03-04 20:45:26.900745   persist_key = ENABLED
2022-03-04 20:45:26.900759   passtos = DISABLED
2022-03-04 20:45:26.900774   resolve_retry_seconds = 1000000000
2022-03-04 20:45:26.900788   resolve_in_advance = DISABLED
2022-03-04 20:45:26.900811   username = '[UNDEF]'
2022-03-04 20:45:26.900827   groupname = '[UNDEF]'
2022-03-04 20:45:26.900842   chroot_dir = '[UNDEF]'
2022-03-04 20:45:26.900873   cd_dir = '/Library/Application Support/Tunnelblick/Users/petervejling/PeterTrueNAS.tblk/Contents/Resources'
2022-03-04 20:45:26.900885   writepid = '[UNDEF]'
2022-03-04 20:45:26.900900   up_script = '[UNDEF]'
2022-03-04 20:45:26.900911   down_script = '/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw'
2022-03-04 20:45:26.900923   down_pre = DISABLED
2022-03-04 20:45:26.900934   up_restart = DISABLED
2022-03-04 20:45:26.900944   up_delay = DISABLED
2022-03-04 20:45:26.900955   daemon = ENABLED
2022-03-04 20:45:26.900965   inetd = 0
2022-03-04 20:45:26.900976   log = ENABLED
2022-03-04 20:45:26.900986   suppress_timestamps = DISABLED
2022-03-04 20:45:26.900997   machine_readable_output = ENABLED
2022-03-04 20:45:26.901008   nice = 0
2022-03-04 20:45:26.901018   verbosity = 4
2022-03-04 20:45:26.901029   mute = 0
2022-03-04 20:45:26.901039   status_file = '[UNDEF]'
2022-03-04 20:45:26.901050   status_file_version = 1
2022-03-04 20:45:26.901060   status_file_update_freq = 60
2022-03-04 20:45:26.901071   occ = ENABLED
2022-03-04 20:45:26.901081   rcvbuf = 0
2022-03-04 20:45:26.901096   sndbuf = 0
2022-03-04 20:45:26.901107   sockflags = 0
2022-03-04 20:45:26.901118   fast_io = DISABLED
2022-03-04 20:45:26.901129   comp.alg = 0
2022-03-04 20:45:26.901139   comp.flags = 0
2022-03-04 20:45:26.901150   route_script = '/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw'
2022-03-04 20:45:26.901161   route_default_gateway = '[UNDEF]'
2022-03-04 20:45:26.901171   route_default_metric = 0
2022-03-04 20:45:26.901182   route_noexec = DISABLED
2022-03-04 20:45:26.901193   route_delay = 0
2022-03-04 20:45:26.901203   route_delay_window = 30
2022-03-04 20:45:26.901214   route_delay_defined = DISABLED
2022-03-04 20:45:26.901224   route_nopull = DISABLED
2022-03-04 20:45:26.901235   route_gateway_via_dhcp = DISABLED
2022-03-04 20:45:26.901245   allow_pull_fqdn = DISABLED
2022-03-04 20:45:26.901256   management_addr = '127.0.0.1'
2022-03-04 20:45:26.901267   management_port = '55801'
2022-03-04 20:45:26.901278   management_user_pass = '/Library/Application Support/Tunnelblick/Mips/PeterTrueNAS.tblk.mip'
2022-03-04 20:45:26.901288   management_log_history_cache = 250
2022-03-04 20:45:26.901299   management_echo_buffer_size = 100
2022-03-04 20:45:26.901310   management_write_peer_info_file = '[UNDEF]'
2022-03-04 20:45:26.901320   management_client_user = '[UNDEF]'
2022-03-04 20:45:26.901331   management_client_group = '[UNDEF]'
2022-03-04 20:45:26.901342   management_flags = 6
2022-03-04 20:45:26.901352   shared_secret_file = '[UNDEF]'
2022-03-04 20:45:26.901363   key_direction = not set
2022-03-04 20:45:26.901374   ciphername = 'AES-256-GCM'
2022-03-04 20:45:26.901384   ncp_enabled = ENABLED
2022-03-04 20:45:26.901395   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
2022-03-04 20:45:26.901406   authname = 'SHA256'
2022-03-04 20:45:26.901416   prng_hash = 'SHA1'
2022-03-04 20:45:26.901427   prng_nonce_secret_len = 16
2022-03-04 20:45:26.901438   keysize = 0
2022-03-04 20:45:26.901448   engine = DISABLED
2022-03-04 20:45:26.901459   replay = ENABLED
2022-03-04 20:45:26.901470   mute_replay_warnings = DISABLED
2022-03-04 20:45:26.901480   replay_window = 64
2022-03-04 20:45:26.901491   replay_time = 15
2022-03-04 20:45:26.901502   packet_id_file = '[UNDEF]'
2022-03-04 20:45:26.901512   test_crypto = DISABLED
2022-03-04 20:45:26.901523   tls_server = DISABLED
2022-03-04 20:45:26.901534   tls_client = ENABLED
2022-03-04 20:45:26.901544   ca_file = '[INLINE]'
2022-03-04 20:45:26.901555   ca_path = '[UNDEF]'
2022-03-04 20:45:26.901566   dh_file = '[UNDEF]'
2022-03-04 20:45:26.901576   cert_file = '[INLINE]'
2022-03-04 20:45:26.901587   extra_certs_file = '[UNDEF]'
2022-03-04 20:45:26.901598   priv_key_file = '[INLINE]'
2022-03-04 20:45:26.901609   pkcs12_file = '[UNDEF]'
2022-03-04 20:45:26.901619   cipher_list = '[UNDEF]'
2022-03-04 20:45:26.901630   cipher_list_tls13 = '[UNDEF]'
2022-03-04 20:45:26.901657   tls_cert_profile = '[UNDEF]'
2022-03-04 20:45:26.901669   tls_verify = '[UNDEF]'
2022-03-04 20:45:26.901679   tls_export_cert = '[UNDEF]'
2022-03-04 20:45:26.901690   verify_x509_type = 0
2022-03-04 20:45:26.901704   verify_x509_name = '[UNDEF]'
2022-03-04 20:45:26.901715   crl_file = '[UNDEF]'
2022-03-04 20:45:26.901726   ns_cert_type = 0
2022-03-04 20:45:26.901737   remote_cert_ku[i] = 65535
2022-03-04 20:45:26.901747   remote_cert_ku[i] = 0
2022-03-04 20:45:26.901758   remote_cert_ku[i] = 0
2022-03-04 20:45:26.901769   remote_cert_ku[i] = 0
2022-03-04 20:45:26.901779   remote_cert_ku[i] = 0
2022-03-04 20:45:26.901790   remote_cert_ku[i] = 0
2022-03-04 20:45:26.901800   remote_cert_ku[i] = 0
2022-03-04 20:45:26.901811   remote_cert_ku[i] = 0
2022-03-04 20:45:26.901822   remote_cert_ku[i] = 0
2022-03-04 20:45:26.901832   remote_cert_ku[i] = 0
2022-03-04 20:45:26.901843   remote_cert_ku[i] = 0
2022-03-04 20:45:26.901853   remote_cert_ku[i] = 0
2022-03-04 20:45:26.901864   remote_cert_ku[i] = 0
2022-03-04 20:45:26.901875   remote_cert_ku[i] = 0
2022-03-04 20:45:26.901885   remote_cert_ku[i] = 0
2022-03-04 20:45:26.901896   remote_cert_ku[i] = 0
2022-03-04 20:45:26.901907   remote_cert_eku = 'TLS Web Server Authentication'
2022-03-04 20:45:26.901918   ssl_flags = 0
2022-03-04 20:45:26.901929   tls_timeout = 2
2022-03-04 20:45:26.901940   renegotiate_bytes = -1
2022-03-04 20:45:26.901951   renegotiate_packets = 0
2022-03-04 20:45:26.901961   renegotiate_seconds = 3600
2022-03-04 20:45:26.901972   handshake_window = 60
2022-03-04 20:45:26.901983   transition_window = 3600
2022-03-04 20:45:26.901994   single_session = DISABLED
2022-03-04 20:45:26.902005   push_peer_info = DISABLED
2022-03-04 20:45:26.902015   tls_exit = DISABLED
2022-03-04 20:45:26.902026   tls_crypt_v2_metadata = '[UNDEF]'
2022-03-04 20:45:26.902037   pkcs11_protected_authentication = DISABLED
2022-03-04 20:45:26.902047   pkcs11_protected_authentication = DISABLED
2022-03-04 20:45:26.902058   pkcs11_protected_authentication = DISABLED
2022-03-04 20:45:26.902069   pkcs11_protected_authentication = DISABLED
2022-03-04 20:45:26.902079   pkcs11_protected_authentication = DISABLED
2022-03-04 20:45:26.902094   pkcs11_protected_authentication = DISABLED
2022-03-04 20:45:26.902109   pkcs11_protected_authentication = DISABLED
2022-03-04 20:45:26.902126   pkcs11_protected_authentication = DISABLED
2022-03-04 20:45:26.902145   pkcs11_protected_authentication = DISABLED
2022-03-04 20:45:26.902175   pkcs11_protected_authentication = DISABLED
2022-03-04 20:45:26.902196   pkcs11_protected_authentication = DISABLED
2022-03-04 20:45:26.902216   pkcs11_protected_authentication = DISABLED
2022-03-04 20:45:26.902235   pkcs11_protected_authentication = DISABLED
2022-03-04 20:45:26.902254   pkcs11_protected_authentication = DISABLED
2022-03-04 20:45:26.902272   pkcs11_protected_authentication = DISABLED
2022-03-04 20:45:26.902292   pkcs11_protected_authentication = DISABLED
2022-03-04 20:45:26.902312   pkcs11_private_mode = 00000000
2022-03-04 20:45:26.902330   pkcs11_private_mode = 00000000
2022-03-04 20:45:26.902350   pkcs11_private_mode = 00000000
2022-03-04 20:45:26.902370   pkcs11_private_mode = 00000000
2022-03-04 20:45:26.902390   pkcs11_private_mode = 00000000
2022-03-04 20:45:26.902410   pkcs11_private_mode = 00000000
2022-03-04 20:45:26.902430   pkcs11_private_mode = 00000000
2022-03-04 20:45:26.902448   pkcs11_private_mode = 00000000
2022-03-04 20:45:26.902467   pkcs11_private_mode = 00000000
2022-03-04 20:45:26.902485   pkcs11_private_mode = 00000000
2022-03-04 20:45:26.902505   pkcs11_private_mode = 00000000
2022-03-04 20:45:26.902524   pkcs11_private_mode = 00000000
2022-03-04 20:45:26.902543   pkcs11_private_mode = 00000000
2022-03-04 20:45:26.902563   pkcs11_private_mode = 00000000
2022-03-04 20:45:26.902582   pkcs11_private_mode = 00000000
2022-03-04 20:45:26.902600   pkcs11_private_mode = 00000000
2022-03-04 20:45:26.902619   pkcs11_cert_private = DISABLED
2022-03-04 20:45:26.902646   pkcs11_cert_private = DISABLED
2022-03-04 20:45:26.902666   pkcs11_cert_private = DISABLED
2022-03-04 20:45:26.902719   pkcs11_cert_private = DISABLED
2022-03-04 20:45:26.902739   pkcs11_cert_private = DISABLED
2022-03-04 20:45:26.902778   pkcs11_cert_private = DISABLED
2022-03-04 20:45:26.902800   pkcs11_cert_private = DISABLED
2022-03-04 20:45:26.902819   pkcs11_cert_private = DISABLED
2022-03-04 20:45:26.902838   pkcs11_cert_private = DISABLED
2022-03-04 20:45:26.902855   pkcs11_cert_private = DISABLED
2022-03-04 20:45:26.902874   pkcs11_cert_private = DISABLED
2022-03-04 20:45:26.902893   pkcs11_cert_private = DISABLED
2022-03-04 20:45:26.902913   pkcs11_cert_private = DISABLED
2022-03-04 20:45:26.902930   pkcs11_cert_private = DISABLED
2022-03-04 20:45:26.902946   pkcs11_cert_private = DISABLED
2022-03-04 20:45:26.902962   pkcs11_cert_private = DISABLED
2022-03-04 20:45:26.902978   pkcs11_pin_cache_period = -1
2022-03-04 20:45:26.902995   pkcs11_id = '[UNDEF]'
2022-03-04 20:45:26.903011   pkcs11_id_management = DISABLED
2022-03-04 20:45:26.903030   server_network = 0.0.0.0
2022-03-04 20:45:26.903049   server_netmask = 0.0.0.0
2022-03-04 20:45:26.903066   server_network_ipv6 = ::
2022-03-04 20:45:26.903082   server_netbits_ipv6 = 0
2022-03-04 20:45:26.903100   server_bridge_ip = 0.0.0.0
2022-03-04 20:45:26.903117   server_bridge_netmask = 0.0.0.0
2022-03-04 20:45:26.903135   server_bridge_pool_start = 0.0.0.0
2022-03-04 20:45:26.903153   server_bridge_pool_end = 0.0.0.0
2022-03-04 20:45:26.903169   ifconfig_pool_defined = DISABLED
2022-03-04 20:45:26.903187   ifconfig_pool_start = 0.0.0.0
2022-03-04 20:45:26.903204   ifconfig_pool_end = 0.0.0.0
2022-03-04 20:45:26.903222   ifconfig_pool_netmask = 0.0.0.0
2022-03-04 20:45:26.903238   ifconfig_pool_persist_filename = '[UNDEF]'
2022-03-04 20:45:26.903255   ifconfig_pool_persist_refresh_freq = 600
2022-03-04 20:45:26.903271   ifconfig_ipv6_pool_defined = DISABLED
2022-03-04 20:45:26.903289   ifconfig_ipv6_pool_base = ::
2022-03-04 20:45:26.903305   ifconfig_ipv6_pool_netbits = 0
2022-03-04 20:45:26.903322   n_bcast_buf = 256
2022-03-04 20:45:26.903338   tcp_queue_limit = 64
2022-03-04 20:45:26.903356   real_hash_size = 256
2022-03-04 20:45:26.903376   virtual_hash_size = 256
2022-03-04 20:45:26.903393   client_connect_script = '[UNDEF]'
2022-03-04 20:45:26.903410   learn_address_script = '[UNDEF]'
2022-03-04 20:45:26.903426   client_disconnect_script = '[UNDEF]'
2022-03-04 20:45:26.903443   client_config_dir = '[UNDEF]'
2022-03-04 20:45:26.903459   ccd_exclusive = DISABLED
2022-03-04 20:45:26.903476   tmp_dir = '/var/folders/fj/5gr83mlx4kq70kxf9ks6lzl00000gn/T/'
2022-03-04 20:45:26.903492   push_ifconfig_defined = DISABLED
2022-03-04 20:45:26.903510   push_ifconfig_local = 0.0.0.0
2022-03-04 20:45:26.903528   push_ifconfig_remote_netmask = 0.0.0.0
2022-03-04 20:45:26.903544   push_ifconfig_ipv6_defined = DISABLED
2022-03-04 20:45:26.903562   push_ifconfig_ipv6_local = ::/0
2022-03-04 20:45:26.903579   push_ifconfig_ipv6_remote = ::
2022-03-04 20:45:26.903595   enable_c2c = DISABLED
2022-03-04 20:45:26.903611   duplicate_cn = DISABLED
2022-03-04 20:45:26.903628   cf_max = 0
2022-03-04 20:45:26.903644   cf_per = 0
2022-03-04 20:45:26.903660   max_clients = 1024
2022-03-04 20:45:26.903676   max_routes_per_client = 256
2022-03-04 20:45:26.903693   auth_user_pass_verify_script = '[UNDEF]'
2022-03-04 20:45:26.903709   auth_user_pass_verify_script_via_file = DISABLED
2022-03-04 20:45:26.903727   auth_token_generate = DISABLED
2022-03-04 20:45:26.903748   auth_token_lifetime = 0
2022-03-04 20:45:26.903768   auth_token_secret_file = '[UNDEF]'
2022-03-04 20:45:26.903788   port_share_host = '[UNDEF]'
2022-03-04 20:45:26.903807   port_share_port = '[UNDEF]'
2022-03-04 20:45:26.903827   vlan_tagging = DISABLED
2022-03-04 20:45:26.903846   vlan_accept = all
2022-03-04 20:45:26.903866   vlan_pvid = 1
2022-03-04 20:45:26.903884   client = ENABLED
2022-03-04 20:45:26.903901   pull = ENABLED
2022-03-04 20:45:26.903917   auth_user_pass_file = '[UNDEF]'
2022-03-04 20:45:26.903935 OpenVPN 2.5.5 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Dec 23 2021
2022-03-04 20:45:26.904002 library versions: OpenSSL 1.1.1m  14 Dec 2021, LZO 2.10
2022-03-04 20:45:26.910763 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:55801
2022-03-04 20:45:26.910860 Need hold release from management interface, waiting...
2022-03-04 20:45:27.443599 *Tunnelblick: openvpnstart log:
     OpenVPN started successfully.
     Command used to start OpenVPN (one argument per displayed line):
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.5.5-openssl-1.1.1m/openvpn
          --daemon
          --log /Library/Application Support/Tunnelblick/Logs/-SUsers-Spetervejling-SLibrary-SApplication Support-STunnelblick-SConfigurations-SPeterTrueNAS.tblk-SContents-SResources-Sconfig.ovpn.1025_0_1_0_34652464.55801.openvpn.log
          --cd /Library/Application Support/Tunnelblick/Users/petervejling/PeterTrueNAS.tblk/Contents/Resources
          --machine-readable-output
          --setenv IV_GUI_VER "net.tunnelblick.tunnelblick 5790 3.8.8beta03 (build 5790)"
          --verb 4
          --config /Library/Application Support/Tunnelblick/Users/petervejling/PeterTrueNAS.tblk/Contents/Resources/config.ovpn
          --setenv TUNNELBLICK_CONFIG_FOLDER /Library/Application Support/Tunnelblick/Users/petervejling/PeterTrueNAS.tblk/Contents/Resources
          --verb 4
          --cd /Library/Application Support/Tunnelblick/Users/petervejling/PeterTrueNAS.tblk/Contents/Resources
          --management 127.0.0.1 55801 /Library/Application Support/Tunnelblick/Mips/PeterTrueNAS.tblk.mip
          --management-query-passwords
          --management-hold
          --script-security 2
          --route-up /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
          --down /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
2022-03-04 20:45:27.459580 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:55801
2022-03-04 20:45:27.466468 MANAGEMENT: CMD 'pid'
2022-03-04 20:45:27.466585 MANAGEMENT: CMD 'auth-retry interact'
2022-03-04 20:45:27.466664 MANAGEMENT: CMD 'state on'
2022-03-04 20:45:27.466742 MANAGEMENT: CMD 'state'
2022-03-04 20:45:27.466887 MANAGEMENT: CMD 'bytecount 1'
2022-03-04 20:45:27.475628 *Tunnelblick: Established communication with OpenVPN
2022-03-04 20:45:27.477729 *Tunnelblick: >INFO:OpenVPN Management Interface Version 3 -- type 'help' for more info
2022-03-04 20:45:27.480035 MANAGEMENT: CMD 'hold release'
2022-03-04 20:45:27.480459 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2022-03-04 20:45:27.493773 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-03-04 20:45:27.493864 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-03-04 20:45:27.493901 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-03-04 20:45:27.493939 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-03-04 20:45:27.494126 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
2022-03-04 20:45:27.501237 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
2022-03-04 20:45:27.501387 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1549,tun-mtu 1500,proto UDPv4,cipher AES-256-GCM,auth [null-digest],keysize 256,key-method 2,tls-client'
2022-03-04 20:45:27.501429 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1549,tun-mtu 1500,proto UDPv4,cipher AES-256-GCM,auth [null-digest],keysize 256,key-method 2,tls-server'
2022-03-04 20:45:27.501476 TCP/UDP: Preserving recently used remote address: [AF_INET]xxx.xxx.xxx.xx:1194
2022-03-04 20:45:27.501621 Socket Buffers: R=[786896->786896] S=[9216->9216]
2022-03-04 20:45:27.501703 UDP link local (bound): [AF_INET][undef]:1194
2022-03-04 20:45:27.501744 UDP link remote: [AF_INET]xxx.xxx.xxx.xx:1194
2022-03-04 20:45:27.501874 MANAGEMENT: >STATE:1646423127,WAIT,,,,,,
2022-03-04 20:45:27.542826 MANAGEMENT: >STATE:1646423127,AUTH,,,,,,
2022-03-04 20:45:27.542918 TLS: Initial packet from [AF_INET]xxx.xxx.xxx.xx:1194, sid=d800c1cb e21e6cdc
2022-03-04 20:45:27.621594 VERIFY OK: depth=1, CN=CA
2022-03-04 20:45:27.622342 VERIFY KU OK
2022-03-04 20:45:27.622377 Validating certificate extended key usage
2022-03-04 20:45:27.622398 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2022-03-04 20:45:27.622416 VERIFY EKU OK
2022-03-04 20:45:27.622433 VERIFY OK: depth=0, C=??, ST=??, L=??, O=OVPN, OU=Security, CN=Server, emailAddress=servercert@vpn.vpn
2022-03-04 20:45:27.716500 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 4096 bit RSA, signature: RSA-SHA256
2022-03-04 20:45:27.716602 [Server] Peer Connection Initiated with [AF_INET]xxx.xxx.xxx.xx:1194
2022-03-04 20:45:27.751307 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 10.8.0.0 255.255.255.0,dhcp-option DNS 8.8.8.8,route-gateway 10.8.0.1,topology subnet,ifconfig 10.8.0.4 255.255.255.0,peer-id 2,cipher AES-256-GCM'
2022-03-04 20:45:27.751447 OPTIONS IMPORT: --ifconfig/up options modified
2022-03-04 20:45:27.751471 OPTIONS IMPORT: route options modified
2022-03-04 20:45:27.751488 OPTIONS IMPORT: route-related options modified
2022-03-04 20:45:27.751505 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2022-03-04 20:45:27.751521 OPTIONS IMPORT: peer-id set
2022-03-04 20:45:27.751537 OPTIONS IMPORT: adjusting link_mtu to 1624
2022-03-04 20:45:27.751554 OPTIONS IMPORT: data channel crypto options modified
2022-03-04 20:45:27.751650 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2022-03-04 20:45:27.751681 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2022-03-04 20:45:27.752635 Opened utun device utun5
2022-03-04 20:45:27.753015 do_ifconfig, ipv4=1, ipv6=0
2022-03-04 20:45:27.753059 MANAGEMENT: >STATE:1646423127,ASSIGN_IP,,10.8.0.4,,,,
2022-03-04 20:45:27.753100 /sbin/ifconfig utun5 delete
                           ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2022-03-04 20:45:27.775957 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2022-03-04 20:45:27.776116 /sbin/ifconfig utun5 10.8.0.4 10.8.0.4 netmask 255.255.255.0 mtu 1500 up
2022-03-04 20:45:27.790509 /sbin/route add -net 10.8.0.0 10.8.0.4 255.255.255.0
                           add net 10.8.0.0: gateway 10.8.0.4
2022-03-04 20:45:27.804351 MANAGEMENT: >STATE:1646423127,ADD_ROUTES,,,,,,
2022-03-04 20:45:27.804471 /sbin/route add -net 192.168.1.0 10.8.0.1 255.255.255.0
                           add net 192.168.1.0: gateway 10.8.0.1
2022-03-04 20:45:27.819075 /sbin/route add -net 10.8.0.0 10.8.0.1 255.255.255.0
                           route: writing to routing socket: File exists
                           add net 10.8.0.0: gateway 10.8.0.1: File exists
                           20:45:27 *Tunnelblick:  **********************************************
                           20:45:27 *Tunnelblick:  Start of output from client.up.tunnelblick.sh
                           20:45:30 *Tunnelblick:  Retrieved from OpenVPN: name server(s) [ 8.8.8.8 ], search domain(s) [ ] and SMB server(s) [ ] and using default domain name [ openvpn ]
                           20:45:31 *Tunnelblick:  WARNING: Ignoring ServerAddresses '8.8.8.8' because ServerAddresses was set manually and '-allowChangesToManuallySetNetworkSettings' was not specified
                           20:45:31 *Tunnelblick:  Not replacing search domains 'openvpn' with 'openvpn' because the search domains were set manually, '-allowChangesToManuallySetNetworkSettings' was not selected, and 'Prepend domain name to search domains' was not selected
                           20:45:33 *Tunnelblick:  Saved the DNS and SMB configurations so they can be restored
                           20:45:33 *Tunnelblick:  Did not change DNS ServerAddresses setting of '192.168.1.23 8.8.8.8' (but re-set it)
                           20:45:33 *Tunnelblick:  Did not change DNS SearchDomains setting of 'openvpn' (but re-set it)
                           20:45:33 *Tunnelblick:  Changed DNS DomainName setting from '' to 'openvpn'
                           20:45:33 *Tunnelblick:  Did not change SMB NetBIOSName setting of ''
                           20:45:33 *Tunnelblick:  Did not change SMB Workgroup setting of ''
                           20:45:33 *Tunnelblick:  Did not change SMB WINSAddresses setting of ''
                           20:45:33 *Tunnelblick:  DNS servers '192.168.1.23 8.8.8.8' were set manually
                           20:45:33 *Tunnelblick:  DNS servers '192.168.1.23 8.8.8.8' will be used for DNS queries when the VPN is active
                           20:45:33 *Tunnelblick:  NOTE: The DNS servers include one or more free public DNS servers known to Tunnelblick and one or more DNS servers not known to Tunnelblick. If used, the DNS servers not known to Tunnelblick may cause DNS queries to fail or be intercepted or falsified even if they are directed through the VPN. Specify only known public DNS servers or DNS servers located on the VPN network to avoid such problems.
                           20:45:33 *Tunnelblick:  Flushed the DNS cache via dscacheutil
                           20:45:34 *Tunnelblick:  /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil
                           20:45:34 *Tunnelblick:  Notified mDNSResponder that the DNS cache was flushed
                           20:45:34 *Tunnelblick:  Not notifying mDNSResponderHelper that the DNS cache was flushed because it is not running
                           20:45:34 *Tunnelblick:  Setting up to monitor system configuration with process-network-changes
                           20:45:34 *Tunnelblick:  End of output from client.up.tunnelblick.sh
                           20:45:34 *Tunnelblick:  **********************************************
2022-03-04 20:45:34.215374 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2022-03-04 20:45:34.215454 Initialization Sequence Completed
2022-03-04 20:45:34.215538 MANAGEMENT: >STATE:1646423134,CONNECTED,SUCCESS,10.8.0.4,xxx.xxx.xxx.xx,1194,,
2022-03-04 20:45:35.470037 *Tunnelblick: DNS address 192.168.1.23 is being routed through the VPN
2022-03-04 20:45:35.617513 *Tunnelblick: Routing info stdout:
   route to: 8.8.8.8
destination: 8.8.8.8
    gateway: 172.20.10.1
  interface: en1
      flags: <UP,GATEWAY,HOST,DONE,WASCLONED,IFSCOPE,IFREF,GLOBAL>
 recvpipe  sendpipe  ssthresh  rtt,msec    rttvar  hopcount      mtu     expire
       0         0         0         0         0         0      1500         0 
stderr:

2022-03-04 20:45:35.632303 *Tunnelblick: Warning: DNS server Address 8.8.8.8 is a known public DNS server but is not being routed through the VPN

Thank you all for any assistance!

Cheers Peter

Pippin

But my router does not allow me to setup static routes, so I am hoping there is another way?

Read here:
https://community.openvpn.net/openvpn/wiki/NatHack

sapster77

Thank you! I will try that out shortly.
Since I only need to reach a couple of clients on the local LAN, is there a way to just add a route to them in order for them to accessible from the openVPN client?

sapster77

Worked perfectly!
Thank you:-)
Are these Iptables persisted through a reboot, or do I need to include them in a startup script?

Pippin

Since I only need to reach a couple of clients on the local LAN, is there a way to just add a route to them in order for them to accessible from the openVPN client?

The traffic from the VPN client(s) is coming into the LAN from your server (NAS).
That traffic carries the source address of the VPN IP of the VPN client.
So on the local LAN client(s), adding a route for network 10.8.0.0/24 pointing to NAS IP (gateway in this case) should do it.

A thing to consider is to change your LAN subnet:
https://community.openvpn.net/openvpn/wiki/AvoidRoutingConflicts

Pippin

Are these Iptables persisted through a reboot, or do I need to include them in a startup script?

You would have to find out reading your NAS docs, it's off topic here.

You can off course try it in Off Topic board but you will probably have more luck via your NAS vendor support forum.

sapster77

The traffic from the VPN client(s) is coming into the LAN from your server (NAS).
That traffic carries the source address of the VPN IP of the VPN client.
So on the local LAN client(s), adding a route for network 10.8.0.0/24 pointing to NAS IP (gateway in this case) should do it.

That worked too😊
And yes, I am aware that my subnet is no good…i will change it.

With regard to persisting the iptable setup i will look that up on the trueNAS scale forums

You have been a great help. Thank you!

Pippin

You're welcome.