Tunnelblick Shared and "connect when computer starts" GUI thinks it's disconnected

[Eric Crist]

Hello,

I have a Mac running Big Sur 11.5.2 with Tunnelblick 3.8.6a with a shared VPN configuration that is configured to start when the computer boots, disconnect when computer sleeps, reconnect when computer wakes up, and for safe measure, reconnect when user switches in.  We have disconnect when user switches out unchecked.

The VPN works fine, really.  The problem I'm seeing is the GUI for tunnelblick thinks the VPN is disconnected, but it is actually connected.  I'm able to pass traffic just fine both ways across the VPN, but the icon is grey and it shows as disconnected.  Going to the configuration and looking at the logs, however, shows activity.

Pretty sure this is a bug.

[Tunnelblick developer]

Thanks for your report. You're correct – it must be a bug, by definition!

What happens if you Quit Tunnelblick and then launch it again? Does it then see the VPN as connected?

[Eric Crist]

I waited to do anything until I got a response here, in case the situation was unusual.

If I quit Tunnelblick and reopen the application, it detects the VPN is connected.

I'm guessing this is a wake from sleep timing issue?

[Tunnelblick developer]

Well, it was unusual.

It does sound like a wake from sleep issue, and it might or might not be be timing-sensitive. It would be great if you could play around with it and see exactly what triggers it – maybe just going to sleep and waking up. Of course you may not be able to reproduce it.

[Eric Crist]

This is pretty easy to reproduce, actually.  Every time I close the lid of the laptop and reopen it, the VPN does reconnect, bu the tunnelblick client fails to see that, even though the log viewer within the application sees the updated log messages.  Logging out to the login screen also keeps the VPN up, and logging back in as a user shows the VPN as connected.

Related, I've seen only one instance of when the VPN connected at boot (FileVault, so faux login screen with login pass-thru) but the Tunnelblick client popped up an error message that the VPN failed to connect.

[Eric Crist]

I found another instance where these appears to occur.

I'm in process of debugging a new --client-connect script.  I had the Mac next to me, fired up the connection after editing the script.  I had an error in the script that caused it to exit 1, disconnecting the client.  I shifted to the other machine, updated the script, and went back to the Mac.  Tunnelblick showed disconnected, but the process in the background actually was successfully connected.

I closed Tunnelblick, reopened it, and it showed as connected.  Then it popped up an error about unknown openvpn processes and gave me the option to kill them.

Maybe this shared config stuff isn't heavily used, so I'm exercising relatively unused code paths.  Sorry about that, but I hope I can help flush out some bugs.  :)

[Eric Crist]

Is this the appropriate place to report this bug, then?  Should I pose this elsewhere?

[Tunnelblick developer]

No, this is the place. I'm busy and haven't been able to investigate further.

It isn't the shared configuration that is unusual, it's the "connect when computer starts" setting.

[Eric Crist]

Hello,

Have you had any time to look into this?  Anything I can do to provide debug data or logs?

[Miguel Cholbi Collados]

Hello,

same here, but for me this "If I quit Tunnelblick and reopen the application, it detects the VPN is connected." doesn't work. 

If I quit Tunnerblick and reopen it I get the following two messages:

But as mentioned, the VPN connection is running and working in the background, it's just the GUI that doesn't detect it.

Thank you!

[Eric Crist]

I'm now running Tunnelblick 3.8.7a (build 5770) and when this occurs, I get two popup windows if I quick Tunnelblick and reopen it.  Note, I've confirmed via `ps auxwww | grep openvpn` that the OpenVPN connection is actually up.  These dialogs pop up, I click through them, then Tunnelblick appears to recognize that the connection is running.

[Eric Crist]

I can't see images after they're posted, maybe attachments will work better?

[Tunnelblick developer]

"Connect when computer starts" is problematic. It is such a rarely used (and usually not very useful) setting that I haven't gotten around to looking into the problems in detail. 

However, it looks like one problem is that sometimes when Tunnelblick is launched it is unable to communicate with the running OpenVPN process. So Tunnelblick

1. Complains about an unknown OpenVPN process; and
   
2. Complains that a VPN that is expected to be connected is not connected.

I have no idea why the "could not fetch IP address before connecting" warning appears, though.