[Openvpn-users] openvpn 2.3.6 on Mac OS

2014-12-19 Thread Jan Just Keijser
hi all, one of my colleagues is running into a strange problem with openvpn 2.3.6 on Mac OS: the routes pushed by the server all are rejected with the message option 'route' cannot be used in this context ([PUSH-OPTIONS]) the same config works on Linux, Windows and other Mac OS (Tunnelblick)

Re: [Openvpn-users] ssh over OpenVPN incredibly stable

2014-12-19 Thread Jan Just Keijser
Hi, On 17/12/14 04:26, Daniel Miller wrote: > Slightly off-topic - but... > > I've noticed that my "normal" or direct ssh connections from my home > (Windoze) to my office (Linux) can be subject to instability - > particularly if I simply leave PuTTY connected and idle for a while at > some point

Re: [Openvpn-users] reneg-sec problem when using a token for client certificates

2014-12-19 Thread Jan Just Keijser
Hi, On 16/12/14 11:34, egabr_2...@yahoo.it wrote: > Hi, > > I'm trying to configure an openvpn client on Linux to use certificates stored > on a sc-hsm usb token; everything seemed to work fine, but then I noticed a > blocking problem when the reneg-sec period expires. > When the token PIN is in

Re: [Openvpn-users] openvpn 2.3.6 on Mac OS

2014-12-19 Thread Jonathan K. Bullard
On Fri, Dec 19, 2014 at 6:28 AM, Jan Just Keijser wrote: > > hi all, > > one of my colleagues is running into a strange problem with openvpn > 2.3.6 on Mac OS: > the routes pushed by the server all are rejected with the message > >option 'route' cannot be used in this context ([PUSH-OPTIONS])

Re: [Openvpn-users] openvpn 2.3.6 on Mac OS

2014-12-19 Thread Jan Just Keijser
Hi Jonathan, On 19/12/14 13:23, Jonathan K. Bullard wrote: > On Fri, Dec 19, 2014 at 6:28 AM, Jan Just Keijser wrote: >> hi all, >> >> one of my colleagues is running into a strange problem with openvpn >> 2.3.6 on Mac OS: >> the routes pushed by the server all are rejected with the message >> >>

Re: [Openvpn-users] ssh over OpenVPN incredibly stable

2014-12-19 Thread Pavel Bychikhin
Jan Just, According to my experience, for OpenVPN UDP isn't better than TCP in case of bad connection with excessive packet loss. TCP has more sophisticated mechanisms than OpenVPN's --ping and --ping-restart. But the ability of OpenVPN to mask out the disconnect is really remarkable. On 19.12.2

Re: [Openvpn-users] openvpn 2.3.6 on Mac OS

2014-12-19 Thread Jonathan K. Bullard
On Fri, Dec 19, 2014 at 7:34 AM, Jan Just Keijser wrote: > Actually, he's running the Tunnelblick version of OpenVPN; the actual > command line used was > /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.6/openvpn > config.ovpn > > (I'm not sure whether the --config was missing

Re: [Openvpn-users] openvpn 2.3.6 on Mac OS

2014-12-19 Thread Gert Doering
Hi, On Fri, Dec 19, 2014 at 12:28:33PM +0100, Jan Just Keijser wrote: >option 'route' cannot be used in this context ([PUSH-OPTIONS]) That error message usually implies "--route-nopull" has been used... Now why that would show up with "the same config" on MacOS, but not on other platforms, I

Re: [Openvpn-users] openvpn 2.3.6 on Mac OS

2014-12-19 Thread Gert Doering
Hi, On Fri, Dec 19, 2014 at 07:53:24AM -0500, Jonathan K. Bullard wrote: > > (I'm not sure whether the --config was missing from the output he sent me) > > Tunnelblick launches OpenVPN and includes the "--config" option (I > always assumed that was required) If there is a *single* command line a

Re: [Openvpn-users] openvpn 2.3.6 on Mac OS

2014-12-19 Thread debbie10t
Hi JJK Not sure if this is related but your client is trying to assign a /32 netmask to the TUN device ... > Fri Dec 19 10:17:51 2014 us=696584 /sbin/ifconfig utun0 10.200.0.34 > 10.200.0.33 mtu 1500 netmask 255.255.255.255 up which out to be a /30 (255.255.255.252) netmask --

Re: [Openvpn-users] openvpn 2.3.6 on Mac OS

2014-12-19 Thread Gert Doering
Hi, On Fri, Dec 19, 2014 at 01:51:08PM -, debbie...@gmail.com wrote: > Not sure if this is related but your client is trying to assign a /32 > netmask > to the TUN device ... > > > Fri Dec 19 10:17:51 2014 us=696584 /sbin/ifconfig utun0 10.200.0.34 > > 10.200.0.33 mtu 1500 netmask 255.255.25

Re: [Openvpn-users] openvpn 2.3.6 on Mac OS

2014-12-19 Thread Jan Just Keijser
Hi Gert, On 19/12/14 14:17, Gert Doering wrote: > Hi, > > On Fri, Dec 19, 2014 at 12:28:33PM +0100, Jan Just Keijser wrote: >> option 'route' cannot be used in this context ([PUSH-OPTIONS]) > That error message usually implies "--route-nopull" has been used... > > Now why that would show up wi

Re: [Openvpn-users] openvpn 2.3.6 on Mac OS

2014-12-19 Thread debbie10t
Gert, maybe this is my mis-understanding and is specific to operating system: >From my Windows client log in net30 topology, note the netmask is set as /30: Notified TAP-Windows driver to set a DHCP IP/netmask of 10.38.113.101/255.255.255.252 on interface {06A59D3A-19BC-4387-AA95-7BD31C4DE7F5

Re: [Openvpn-users] openvpn 2.3.6 on Mac OS

2014-12-19 Thread Jan Just Keijser
On 19/12/14 15:19, Jan Just Keijser wrote: > Hi Gert, > > On 19/12/14 14:17, Gert Doering wrote: >> Hi, >> >> On Fri, Dec 19, 2014 at 12:28:33PM +0100, Jan Just Keijser wrote: >>> option 'route' cannot be used in this context ([PUSH-OPTIONS]) >> That error message usually implies "--route-nopul

Re: [Openvpn-users] ssh over OpenVPN incredibly stable

2014-12-19 Thread Gert Doering
Hi, On Fri, Dec 19, 2014 at 02:46:23PM +0200, Pavel Bychikhin wrote: > According to my experience, for OpenVPN UDP isn't better than TCP in > case of bad connection with excessive packet loss. TCP has more > sophisticated mechanisms than OpenVPN's --ping and --ping-restart. > But the ability of

Re: [Openvpn-users] openvpn 2.3.6 on Mac OS

2014-12-19 Thread Gert Doering
Hi, On Fri, Dec 19, 2014 at 03:15:14PM -, debbie...@gmail.com wrote: > maybe this is my mis-understanding and is specific to operating system: > > From my Windows client log in net30 topology, note the netmask is set as > /30: *Windows* doesn't have *tun* adapters. This is why we have the