I'm trying to connect to my Raspberry Pi's OpenVPN server from my laptop (using my phone as a WiFi hotspot for testing purposes). When the Pi is connected to my WiFi network it all works exactly as expected. When I connect the Pi instead to my router via an ethernet cable, it fails. I'm able to get a VPN connection up, but it has no Internet access and no access to other local network resources.
The Pi does have Internet access and I can ssh into it successfully. The only thing that's failing is the VPN.
The server was set up using PiVPN.
Below are the logs from my client in each case:
WiFi:
*Tunnelblick: OS X 10.13.6; Tunnelblick 3.7.6a (build 5080); prior version 3.7.0 (build 4790)
2018-08-10 21:24:41 *Tunnelblick: Attempting connection with <my-computer-name> using shadow copy; Set nameserver = 769; monitoring connection
2018-08-10 21:24:41 *Tunnelblick: openvpnstart start <my-computer-name>.tblk 61895 769 0 1 0 1065264 -ptADGNWradsgnw 2.4.6-openssl-1.0.2o
2018-08-10 21:24:41 *Tunnelblick: openvpnstart log:
OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.6-openssl-1.0.2o/openvpn
--daemon
--log
/Library/Application Support/Tunnelblick/Logs/-SUsers-S<My-Computer-Name>-SLibrary-SApplication Support-STunnelblick-SConfigurations-S<my-computer-name>.tblk-SContents-SResources-Sconfig.ovpn.769_0_1_0_1065264.61895.openvpn.log
--cd
/Library/Application Support/Tunnelblick/Users/<My-Computer-Name>/<my-computer-name>.tblk/Contents/Resources
--setenv
IV_GUI_VER
"net.tunnelblick.tunnelblick 5080 3.7.6a (build 5080)"
--verb
3
--config
/Library/Application Support/Tunnelblick/Users/<My-Computer-Name>/<my-computer-name>.tblk/Contents/Resources/config.ovpn
--verb
3
--cd
/Library/Application Support/Tunnelblick/Users/<My-Computer-Name>/<my-computer-name>.tblk/Contents/Resources
--management
127.0.0.1
61895
/Library/Application Support/Tunnelblick/mbnjgnahkeddknghomneeiahhhcebfpgeochlimo.mip
--management-query-passwords
--management-hold
--script-security
2
--up
/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
--down
/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
2018-08-10 21:24:41 *Tunnelblick: openvpnstart starting OpenVPN
2018-08-10 21:24:41 *Tunnelblick: Established communication with OpenVPN
2018-08-10 21:24:41 OpenVPN 2.4.6 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Jun 25 2018
2018-08-10 21:24:41 library versions: OpenSSL 1.0.2o 27 Mar 2018, LZO 2.10
2018-08-10 21:24:41 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:61895
2018-08-10 21:24:41 Need hold release from management interface, waiting...
2018-08-10 21:24:41 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:61895
2018-08-10 21:24:41 MANAGEMENT: CMD 'pid'
2018-08-10 21:24:41 MANAGEMENT: CMD 'state on'
2018-08-10 21:24:41 MANAGEMENT: CMD 'state'
2018-08-10 21:24:41 MANAGEMENT: CMD 'bytecount 1'
2018-08-10 21:24:41 MANAGEMENT: CMD 'hold release'
2018-08-10 21:24:41 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2018-08-10 21:24:48 MANAGEMENT: CMD 'password [...]'
2018-08-10 21:24:48 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2018-08-10 21:24:48 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2018-08-10 21:24:48 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2018-08-10 21:24:48 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2018-08-10 21:24:48 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2018-08-10 21:24:48 MANAGEMENT: >STATE:1533900288,RESOLVE,,,,,,
2018-08-10 21:24:48 TCP/UDP: Preserving recently used remote address: [AF_INET]<my-public-ip>:<my-vpn-port>
2018-08-10 21:24:48 Socket Buffers: R=[196724->196724] S=[9216->9216]
2018-08-10 21:24:48 UDP link local: (not bound)
2018-08-10 21:24:48 UDP link remote: [AF_INET]<my-public-ip>:<my-vpn-port>
2018-08-10 21:24:48 MANAGEMENT: >STATE:1533900288,WAIT,,,,,,
2018-08-10 21:24:48 MANAGEMENT: >STATE:1533900288,AUTH,,,,,,
2018-08-10 21:24:48 TLS: Initial packet from [AF_INET]<my-public-ip>:<my-vpn-port>, sid=21789fd3 c91fb7ab
2018-08-10 21:24:49 VERIFY OK: depth=1, CN=ChangeMe
2018-08-10 21:24:49 VERIFY KU OK
2018-08-10 21:24:49 Validating certificate extended key usage
2018-08-10 21:24:49 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2018-08-10 21:24:49 VERIFY EKU OK
2018-08-10 21:24:49 VERIFY X509NAME OK: CN=server_FrnEVkL2dylxAfUt
2018-08-10 21:24:49 VERIFY OK: depth=0, CN=server_FrnEVkL2dylxAfUt
2018-08-10 21:24:49 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
2018-08-10 21:24:49 [server_FrnEVkL2dylxAfUt] Peer Connection Initiated with [AF_INET]<my-public-ip>:<my-vpn-port>
2018-08-10 21:24:50 MANAGEMENT: >STATE:1533900290,GET_CONFIG,,,,,,
2018-08-10 21:24:50 SENT CONTROL [server_FrnEVkL2dylxAfUt]: 'PUSH_REQUEST' (status=1)
2018-08-10 21:24:51 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM'
2018-08-10 21:24:51 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:3: block-outside-dns (2.4.6)
2018-08-10 21:24:51 OPTIONS IMPORT: timers and/or timeouts modified
2018-08-10 21:24:51 OPTIONS IMPORT: --ifconfig/up options modified
2018-08-10 21:24:51 OPTIONS IMPORT: route options modified
2018-08-10 21:24:51 OPTIONS IMPORT: route-related options modified
2018-08-10 21:24:51 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2018-08-10 21:24:51 OPTIONS IMPORT: peer-id set
2018-08-10 21:24:51 OPTIONS IMPORT: adjusting link_mtu to 1625
2018-08-10 21:24:51 OPTIONS IMPORT: data channel crypto options modified
2018-08-10 21:24:51 Data Channel: using negotiated cipher 'AES-256-GCM'
2018-08-10 21:24:51 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2018-08-10 21:24:51 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2018-08-10 21:24:51 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2018-08-10 21:24:51 Opened utun device utun1
2018-08-10 21:24:51 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
2018-08-10 21:24:51 MANAGEMENT: >STATE:1533900291,ASSIGN_IP,,10.8.0.2,,,,
2018-08-10 21:24:51 /sbin/ifconfig utun1 delete
ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2018-08-10 21:24:51 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2018-08-10 21:24:51 /sbin/ifconfig utun1 10.8.0.2 10.8.0.2 netmask 255.255.255.0 mtu 1500 up
2018-08-10 21:24:51 /sbin/route add -net 10.8.0.0 10.8.0.2 255.255.255.0
add net 10.8.0.0: gateway 10.8.0.2
2018-08-10 21:24:51 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw utun1 1500 1553 10.8.0.2 255.255.255.0 init
**********************************************
Start of output from client.up.tunnelblick.sh
Disabled IPv6 for 'Arduino Uno 2'
Disabled IPv6 for 'Arduino Uno'
Disabled IPv6 for 'FT232R USB UART'
Disabled IPv6 for 'Ethernet'
Disabled IPv6 for 'FireWire'
Disabled IPv6 for 'Wi-Fi'
Disabled IPv6 for 'Bluetooth PAN'
Disabled IPv6 for 'Thunderbolt Bridge'
Retrieved from OpenVPN: name server(s) [ 8.8.8.8 8.8.4.4 ], search domain(s) [ ] and SMB server(s) [ ] and using default domain name [ openvpn ]
WARNING: Ignoring ServerAddresses '8.8.8.8 8.8.4.4' because ServerAddresses was set manually and '-allowChangesToManuallySetNetworkSettings' was not specified
Setting search domains to 'openvpn' because running under OS X 10.6 or higher and the search domains were not set manually (or are allowed to be changed) and 'Prepend domain name to search domains' was not selected
Saved the DNS and SMB configurations so they can be restored
Did not change DNS ServerAddresses setting of '8.8.8.8 8.8.4.4' (but re-set it)
Changed DNS SearchDomains setting from '' to 'openvpn'
Changed DNS DomainName setting from '' to 'openvpn'
Did not change SMB NetBIOSName setting of ''
Did not change SMB Workgroup setting of ''
Did not change SMB WINSAddresses setting of ''
DNS servers '8.8.8.8 8.8.4.4' were set manually
DNS servers '8.8.8.8 8.8.4.4' will be used for DNS queries when the VPN is active
The DNS servers include only free public DNS servers known to Tunnelblick.
Flushed the DNS cache via dscacheutil
/usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil
Notified mDNSResponder that the DNS cache was flushed
Setting up to monitor system configuration with process-network-changes
End of output from client.up.tunnelblick.sh
**********************************************
2018-08-10 21:24:56 /sbin/route add -net <my-public-ip> 192.168.43.1 255.255.255.255
2018-08-10 21:24:56 *Tunnelblick: No 'connected.sh' script to execute
add net <my-public-ip>: gateway 192.168.43.1
2018-08-10 21:24:56 /sbin/route add -net 0.0.0.0 10.8.0.1 128.0.0.0
add net 0.0.0.0: gateway 10.8.0.1
2018-08-10 21:24:56 /sbin/route add -net 128.0.0.0 10.8.0.1 128.0.0.0
add net 128.0.0.0: gateway 10.8.0.1
2018-08-10 21:24:56 Initialization Sequence Completed
2018-08-10 21:24:56 MANAGEMENT: >STATE:1533900296,CONNECTED,SUCCESS,10.8.0.2,<my-public-ip>,<my-vpn-port>,,
2018-08-10 21:25:00 *Tunnelblick process-network-changes: A system configuration change was ignored
2018-08-10 21:25:04 *Tunnelblick: This computer's apparent public IP address changed from <my-client's-ip> before connection to <my-public-ip> after connection
Eth:
*Tunnelblick: OS X 10.13.6; Tunnelblick 3.7.6a (build 5080); prior version 3.7.0 (build 4790)
2018-08-10 21:30:25 *Tunnelblick: Attempting connection with <my-computer-name> using shadow copy; Set nameserver = 769; monitoring connection
2018-08-10 21:30:25 *Tunnelblick: openvpnstart start <my-computer-name>.tblk 63901 769 0 1 0 1065264 -ptADGNWradsgnw 2.4.6-openssl-1.0.2o
2018-08-10 21:30:26 *Tunnelblick: openvpnstart log:
OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.6-openssl-1.0.2o/openvpn
--daemon
--log
/Library/Application Support/Tunnelblick/Logs/-SUsers-S<My-Computer-Name>-SLibrary-SApplication Support-STunnelblick-SConfigurations-S<my-computer-name>.tblk-SContents-SResources-Sconfig.ovpn.769_0_1_0_1065264.63901.openvpn.log
--cd
/Library/Application Support/Tunnelblick/Users/<My-Computer-Name>/<my-computer-name>.tblk/Contents/Resources
--setenv
IV_GUI_VER
"net.tunnelblick.tunnelblick 5080 3.7.6a (build 5080)"
--verb
3
--config
/Library/Application Support/Tunnelblick/Users/<My-Computer-Name>/<my-computer-name>.tblk/Contents/Resources/config.ovpn
--verb
3
--cd
/Library/Application Support/Tunnelblick/Users/<My-Computer-Name>/<my-computer-name>.tblk/Contents/Resources
--management
127.0.0.1
63901
/Library/Application Support/Tunnelblick/mbnjgnahkeddknghomneeiahhhcebfpgeochlimo.mip
--management-query-passwords
--management-hold
--script-security
2
--up
/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
--down
/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
2018-08-10 21:30:26 *Tunnelblick: Established communication with OpenVPN
2018-08-10 21:30:26 OpenVPN 2.4.6 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Jun 25 2018
2018-08-10 21:30:26 library versions: OpenSSL 1.0.2o 27 Mar 2018, LZO 2.10
2018-08-10 21:30:26 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:63901
2018-08-10 21:30:26 Need hold release from management interface, waiting...
2018-08-10 21:30:26 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:63901
2018-08-10 21:30:26 MANAGEMENT: CMD 'pid'
2018-08-10 21:30:26 MANAGEMENT: CMD 'state on'
2018-08-10 21:30:26 MANAGEMENT: CMD 'state'
2018-08-10 21:30:26 MANAGEMENT: CMD 'bytecount 1'
2018-08-10 21:30:26 MANAGEMENT: CMD 'hold release'
2018-08-10 21:30:26 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2018-08-10 21:30:33 MANAGEMENT: CMD 'password [...]'
2018-08-10 21:30:33 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2018-08-10 21:30:33 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2018-08-10 21:30:33 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2018-08-10 21:30:33 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2018-08-10 21:30:33 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2018-08-10 21:30:33 MANAGEMENT: >STATE:1533900633,RESOLVE,,,,,,
2018-08-10 21:30:33 TCP/UDP: Preserving recently used remote address: [AF_INET]<my-public-ip>:<my-vpn-port>
2018-08-10 21:30:33 Socket Buffers: R=[196724->196724] S=[9216->9216]
2018-08-10 21:30:33 UDP link local: (not bound)
2018-08-10 21:30:33 UDP link remote: [AF_INET]<my-public-ip>:<my-vpn-port>
2018-08-10 21:30:33 MANAGEMENT: >STATE:1533900633,WAIT,,,,,,
2018-08-10 21:30:33 MANAGEMENT: >STATE:1533900633,AUTH,,,,,,
2018-08-10 21:30:33 TLS: Initial packet from [AF_INET]<my-public-ip>:<my-vpn-port>, sid=5ed0e3f5 35e4d7fb
2018-08-10 21:30:34 VERIFY OK: depth=1, CN=ChangeMe
2018-08-10 21:30:34 VERIFY KU OK
2018-08-10 21:30:34 Validating certificate extended key usage
2018-08-10 21:30:34 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2018-08-10 21:30:34 VERIFY EKU OK
2018-08-10 21:30:34 VERIFY X509NAME OK: CN=server_FrnEVkL2dylxAfUt
2018-08-10 21:30:34 VERIFY OK: depth=0, CN=server_FrnEVkL2dylxAfUt
2018-08-10 21:30:34 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
2018-08-10 21:30:34 [server_FrnEVkL2dylxAfUt] Peer Connection Initiated with [AF_INET]<my-public-ip>:<my-vpn-port>
2018-08-10 21:30:35 MANAGEMENT: >STATE:1533900635,GET_CONFIG,,,,,,
2018-08-10 21:30:35 SENT CONTROL [server_FrnEVkL2dylxAfUt]: 'PUSH_REQUEST' (status=1)
2018-08-10 21:30:35 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM'
2018-08-10 21:30:35 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:3: block-outside-dns (2.4.6)
2018-08-10 21:30:35 OPTIONS IMPORT: timers and/or timeouts modified
2018-08-10 21:30:35 OPTIONS IMPORT: --ifconfig/up options modified
2018-08-10 21:30:35 OPTIONS IMPORT: route options modified
2018-08-10 21:30:35 OPTIONS IMPORT: route-related options modified
2018-08-10 21:30:35 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2018-08-10 21:30:35 OPTIONS IMPORT: peer-id set
2018-08-10 21:30:35 OPTIONS IMPORT: adjusting link_mtu to 1625
2018-08-10 21:30:35 OPTIONS IMPORT: data channel crypto options modified
2018-08-10 21:30:35 Data Channel: using negotiated cipher 'AES-256-GCM'
2018-08-10 21:30:35 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2018-08-10 21:30:35 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2018-08-10 21:30:35 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2018-08-10 21:30:35 Opened utun device utun1
2018-08-10 21:30:35 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
2018-08-10 21:30:35 MANAGEMENT: >STATE:1533900635,ASSIGN_IP,,10.8.0.2,,,,
2018-08-10 21:30:35 /sbin/ifconfig utun1 delete
ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2018-08-10 21:30:35 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2018-08-10 21:30:35 /sbin/ifconfig utun1 10.8.0.2 10.8.0.2 netmask 255.255.255.0 mtu 1500 up
2018-08-10 21:30:35 /sbin/route add -net 10.8.0.0 10.8.0.2 255.255.255.0
add net 10.8.0.0: gateway 10.8.0.2
2018-08-10 21:30:35 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw utun1 1500 1553 10.8.0.2 255.255.255.0 init
**********************************************
Start of output from client.up.tunnelblick.sh
Disabled IPv6 for 'Arduino Uno 2'
Disabled IPv6 for 'Arduino Uno'
Disabled IPv6 for 'FT232R USB UART'
Disabled IPv6 for 'Ethernet'
Disabled IPv6 for 'FireWire'
Disabled IPv6 for 'Wi-Fi'
Disabled IPv6 for 'Bluetooth PAN'
Disabled IPv6 for 'Thunderbolt Bridge'
Retrieved from OpenVPN: name server(s) [ 8.8.8.8 8.8.4.4 ], search domain(s) [ ] and SMB server(s) [ ] and using default domain name [ openvpn ]
WARNING: Ignoring ServerAddresses '8.8.8.8 8.8.4.4' because ServerAddresses was set manually and '-allowChangesToManuallySetNetworkSettings' was not specified
Setting search domains to 'openvpn' because running under OS X 10.6 or higher and the search domains were not set manually (or are allowed to be changed) and 'Prepend domain name to search domains' was not selected
Saved the DNS and SMB configurations so they can be restored
Did not change DNS ServerAddresses setting of '8.8.8.8 8.8.4.4' (but re-set it)
Changed DNS SearchDomains setting from '' to 'openvpn'
Changed DNS DomainName setting from '' to 'openvpn'
Did not change SMB NetBIOSName setting of ''
Did not change SMB Workgroup setting of ''
Did not change SMB WINSAddresses setting of ''
DNS servers '8.8.8.8 8.8.4.4' were set manually
DNS servers '8.8.8.8 8.8.4.4' will be used for DNS queries when the VPN is active
The DNS servers include only free public DNS servers known to Tunnelblick.
Flushed the DNS cache via dscacheutil
/usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil
Notified mDNSResponder that the DNS cache was flushed
Setting up to monitor system configuration with process-network-changes
End of output from client.up.tunnelblick.sh
**********************************************
2018-08-10 21:30:40 /sbin/route add -net <my-public-ip> 192.168.43.1 255.255.255.255
add net <my-public-ip>: gateway 192.168.43.1
2018-08-10 21:30:40 /sbin/route add -net 0.0.0.0 10.8.0.1 128.0.0.0
add net 0.0.0.0: gateway 10.8.0.1
2018-08-10 21:30:40 /sbin/route add -net 128.0.0.0 10.8.0.1 128.0.0.0
add net 128.0.0.0: gateway 10.8.0.1
2018-08-10 21:30:40 Initialization Sequence Completed
2018-08-10 21:30:40 MANAGEMENT: >STATE:1533900640,CONNECTED,SUCCESS,10.8.0.2,<my-public-ip>,<my-vpn-port>,,
2018-08-10 21:30:41 *Tunnelblick: No 'connected.sh' script to execute
