Spinning beach ball

Laura Valdes

unread,

May 19, 2014, 8:19:14 PM5/19/14

to tunnelbli...@googlegroups.com

Hi,

I have not found this problem discussed yet so hopefully I'm not repeating. I had been getting a "waiting for server response" and it finally was fixed seemingly on its own. However, now the icon appears as if it is active but if I move my cursor over it the beach ball spins continuously. I did manage to pull up this report. Can you help me fix this issue please? Below is a copy and paste of the log.

Thanks so much!

Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.2.1/openvpn ; exit;

OpenVPN 2.2.1 i386-apple-darwin10.8.0 [SSL] [LZO2] [PKCS11] [eurephia] built on May 2 2014

General Options:

--config file : Read configuration options from file.

--help : Show options.

--version : Show copyright and version information.

Tunnel Options:

--local host : Local host name or ip address. Implies --bind.

--remote host [port] : Remote host name or ip address.

--remote-random : If multiple --remote options specified, choose one randomly.

--remote-random-hostname : Add a random string to remote DNS name.

--mode m : Major mode, m = 'p2p' (default, point-to-point) or 'server'.

--proto p : Use protocol p for communicating with peer.

p = udp (default), tcp-server, or tcp-client

--proto-force p : only consider protocol p in list of connection profiles.

--connect-retry n : For --proto tcp-client, number of seconds to wait

between connection retries (default=5).

--connect-timeout n : For --proto tcp-client, connection timeout (in seconds).

--connect-retry-max n : Maximum connection attempt retries, default infinite.

--auto-proxy : Try to sense proxy settings (or lack thereof) automatically.

--show-proxy-settings : Show sensed proxy settings.

--http-proxy s p [up] [auth] : Connect to remote host

through an HTTP proxy at address s and port p.

If proxy authentication is required,

up is a file containing username/password on 2 lines, or

'stdin' to prompt from console. Add auth='ntlm' if

the proxy requires NTLM authentication.

--http-proxy s p 'auto[-nct]' : Like the above directive, but automatically

determine auth method and query for username/password

if needed. auto-nct disables weak proxy auth methods.

--http-proxy-retry : Retry indefinitely on HTTP proxy errors.

--http-proxy-timeout n : Proxy timeout in seconds, default=5.

--http-proxy-option type [parm] : Set extended HTTP proxy options.

Repeat to set multiple options.

VERSION version (default=1.0)

AGENT user-agent

--socks-proxy s [p] [up] : Connect to remote host through a Socks5 proxy at

address s and port p (default port = 1080).

If proxy authentication is required,

up is a file containing username/password on 2 lines, or

'stdin' to prompt for console.

--socks-proxy-retry : Retry indefinitely on Socks proxy errors.

--resolv-retry n: If hostname resolve fails for --remote, retry

resolve for n seconds before failing (disabled by default).

Set n="infinite" to retry indefinitely.

--float : Allow remote to change its IP address/port, such as through

DHCP (this is the default if --remote is not used).

--ipchange cmd : Execute shell command cmd on remote ip address initial

setting or change -- execute as: cmd ip-address port#

--port port : TCP/UDP port # for both local and remote.

--lport port : TCP/UDP port # for local (default=1194). Implies --bind.

--rport port : TCP/UDP port # for remote (default=1194).

--bind : Bind to local address and port. (This is the default unless

--proto tcp-client or --http-proxy or --socks-proxy is used).

--nobind : Do not bind to local address and port.

--dev tunX|tapX : tun/tap device (X can be omitted for dynamic device.

--dev-type dt : Which device type are we using? (dt = tun or tap) Use

this option only if the tun/tap device used with --dev

does not begin with "tun" or "tap".

--dev-node node : Explicitly set the device node rather than using

/dev/net/tun, /dev/tun, /dev/tap, etc.

--lladdr hw : Set the link layer address of the tap device.

--topology t : Set --dev tun topology: 'net30', 'p2p', or 'subnet'.

--tun-ipv6 : Build tun link capable of forwarding IPv6 traffic.

--ifconfig l rn : TUN: configure device to use IP address l as a local

endpoint and rn as a remote endpoint. l & rn should be

swapped on the other peer. l & rn must be private

addresses outside of the subnets used by either peer.

TAP: configure device to use IP address l as a local

endpoint and rn as a subnet mask.

--ifconfig-noexec : Don't actually execute ifconfig/netsh command, instead

pass --ifconfig parms by environment to scripts.

--ifconfig-nowarn : Don't warn if the --ifconfig option on this side of the

connection doesn't match the remote side.

--route network [netmask] [gateway] [metric] :

Add route to routing table after connection

is established. Multiple routes can be specified.

netmask default: 255.255.255.255

gateway default: taken from --route-gateway or --ifconfig

Specify default by leaving blank or setting to "nil".

--max-routes n : Specify the maximum number of routes that may be defined

or pulled from a server.

--route-gateway gw|'dhcp' : Specify a default gateway for use with --route.

--route-metric m : Specify a default metric for use with --route.

--route-delay n [w] : Delay n seconds after connection initiation before

adding routes (may be 0). If not specified, routes will

be added immediately after tun/tap open. On Windows, wait

up to w seconds for TUN/TAP adapter to come up.

--route-up cmd : Execute shell cmd after routes are added.

--route-noexec : Don't add routes automatically. Instead pass routes to

--route-up script using environmental variables.

--route-nopull : When used with --client or --pull, accept options pushed

by server EXCEPT for routes.

--allow-pull-fqdn : Allow client to pull DNS names from server for

--ifconfig, --route, and --route-gateway.

--redirect-gateway [flags]: Automatically execute routing

commands to redirect all outgoing IP traffic through the

VPN. Add 'local' flag if both OpenVPN servers are directly

connected via a common subnet, such as with WiFi.

Add 'def1' flag to set default route using using 0.0.0.0/1

and 128.0.0.0/1 rather than 0.0.0.0/0. Add 'bypass-dhcp'

flag to add a direct route to DHCP server, bypassing tunnel.

Add 'bypass-dns' flag to similarly bypass tunnel for DNS.

--redirect-private [flags]: Like --redirect-gateway, but omit actually changing

the default gateway. Useful when pushing private subnets.

--push-peer-info : (client only) push client info to server.

--setenv name value : Set a custom environmental variable to pass to script.

--setenv FORWARD_COMPATIBLE 1 : Relax config file syntax checking to allow

directives for future OpenVPN versions to be ignored.

--script-security level mode : mode='execve' (default) or 'system', level=

0 -- strictly no calling of external programs

1 -- (default) only call built-ins such as ifconfig

2 -- allow calling of built-ins and scripts

3 -- allow password to be passed to scripts via env

--shaper n : Restrict output to peer to n bytes per second.

--keepalive n m : Helper option for setting timeouts in server mode. Send

ping once every n seconds, restart if ping not received

for m seconds.

--inactive n [bytes] : Exit after n seconds of activity on tun/tap device

produces a combined in/out byte count < bytes.

--ping-exit n : Exit if n seconds pass without reception of remote ping.

--ping-restart n: Restart if n seconds pass without reception of remote ping.

--ping-timer-rem: Run the --ping-exit/--ping-restart timer only if we have a

remote address.

--ping n : Ping remote once every n seconds over TCP/UDP port.

--fast-io : (experimental) Optimize TUN/TAP/UDP writes.

--remap-usr1 s : On SIGUSR1 signals, remap signal (s='SIGHUP' or 'SIGTERM').

--persist-tun : Keep tun/tap device open across SIGUSR1 or --ping-restart.

--persist-remote-ip : Keep remote IP address across SIGUSR1 or --ping-restart.

--persist-local-ip : Keep local IP address across SIGUSR1 or --ping-restart.

--persist-key : Don't re-read key files across SIGUSR1 or --ping-restart.

--passtos : TOS passthrough (applies to IPv4 only).

--tun-mtu n : Take the tun/tap device MTU to be n and derive the

TCP/UDP MTU from it (default=1500).

--tun-mtu-extra n : Assume that tun/tap device might return as many

as n bytes more than the tun-mtu size on read

(default TUN=0 TAP=32).

--link-mtu n : Take the TCP/UDP device MTU to be n and derive the tun MTU

from it.

--mtu-disc type : Should we do Path MTU discovery on TCP/UDP channel?

'no' -- Never send DF (Don't Fragment) frames

'maybe' -- Use per-route hints

'yes' -- Always DF (Don't Fragment)

--mtu-test : Empirically measure and report MTU.

--fragment max : Enable internal datagram fragmentation so that no UDP

datagrams are sent which are larger than max bytes.

Adds 4 bytes of overhead per datagram.

--mssfix [n] : Set upper bound on TCP MSS, default = tun-mtu size

or --fragment max value, whichever is lower.

--sndbuf size : Set the TCP/UDP send buffer size.

--rcvbuf size : Set the TCP/UDP receive buffer size.

--txqueuelen n : Set the tun/tap TX queue length to n (Linux only).

--mlock : Disable Paging -- ensures key material and tunnel

data will never be written to disk.

--up cmd : Shell cmd to execute after successful tun device open.

Execute as: cmd tun/tap-dev tun-mtu link-mtu \

ifconfig-local-ip ifconfig-remote-ip

(pre --user or --group UID/GID change)

--up-delay : Delay tun/tap open and possible --up script execution

until after TCP/UDP connection establishment with peer.

--down cmd : Shell cmd to run after tun device close.

(post --user/--group UID/GID change and/or --chroot)

(script parameters are same as --up option)

--down-pre : Call --down cmd/script before TUN/TAP close.

--up-restart : Run up/down scripts for all restarts including those

caused by --ping-restart or SIGUSR1

--user user : Set UID to user after initialization.

--group group : Set GID to group after initialization.

--chroot dir : Chroot to this directory after initialization.

--cd dir : Change to this directory before initialization.

--daemon [name] : Become a daemon after initialization.

The optional 'name' parameter will be passed

as the program name to the system logger.

--syslog [name] : Output to syslog, but do not become a daemon.

See --daemon above for a description of the 'name' parm.

--inetd [name] ['wait'|'nowait'] : Run as an inetd or xinetd server.

See --daemon above for a description of the 'name' parm.

--log file : Output log to file which is created/truncated on open.

--log-append file : Append log to file, or create file if nonexistent.

--suppress-timestamps : Don't log timestamps to stdout/stderr.

--writepid file : Write main process ID to file.

--nice n : Change process priority (>0 = lower, <0 = higher).

--echo [parms ...] : Echo parameters to log output.

--verb n : Set output verbosity to n (default=1):

(Level 3 is recommended if you want a good summary

of what's happening without being swamped by output).

: 0 -- no output except fatal errors

: 1 -- startup info + connection initiated messages +

non-fatal encryption & net errors

: 2,3 -- show TLS negotiations & route info

: 4 -- show parameters

: 5 -- show 'RrWw' chars on console for each packet sent

and received from TCP/UDP (caps) or tun/tap (lc)

: 6 to 11 -- debug messages of increasing verbosity

--mute n : Log at most n consecutive messages in the same category.

--status file n : Write operational status to file every n seconds.

--status-version [n] : Choose the status file format version number.

Currently, n can be 1, 2, or 3 (default=1).

--disable-occ : Disable options consistency check between peers.

--gremlin mask : Special stress testing mode (for debugging only).

--comp-lzo : Use fast LZO compression -- may add up to 1 byte per

packet for uncompressible data.

--comp-noadapt : Don't use adaptive compression when --comp-lzo

is specified.

--management ip port [pass] : Enable a TCP server on ip:port to handle

management functions. pass is a password file

or 'stdin' to prompt from console.

To listen on a unix domain socket, specific the pathname

in place of ip and use 'unix' as the port number.

--management-client : Management interface will connect as a TCP client to

ip/port rather than listen as a TCP server.

--management-query-passwords : Query management channel for private key

and auth-user-pass passwords.

--management-hold : Start OpenVPN in a hibernating state, until a client

of the management interface explicitly starts it.

--management-signal : Issue SIGUSR1 when management disconnect event occurs.

--management-forget-disconnect : Forget passwords when management disconnect

event occurs.

--management-log-cache n : Cache n lines of log file history for usage

by the management channel.

--management-client-user u : When management interface is a unix socket, only

allow connections from user u.

--management-client-group g : When management interface is a unix socket, only

allow connections from group g.

--management-client-auth : gives management interface client the responsibility

to authenticate clients after their client certificate

has been verified.

--management-client-pf : management interface clients must specify a packet

filter file for each connecting client.

--plugin m [str]: Load plug-in module m passing str as an argument

to its initialization function.

Multi-Client Server options (when --mode server is used):

--server network netmask : Helper option to easily configure server mode.

--server-bridge [IP netmask pool-start-IP pool-end-IP] : Helper option to

easily configure ethernet bridging server mode.

--push "option" : Push a config file option back to the peer for remote

execution. Peer must specify --pull in its config file.

--push-reset : Don't inherit global push list for specific

client instance.

--ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets

to be dynamically allocated to connecting clients.

--ifconfig-pool-linear : Use individual addresses rather than /30 subnets

in tun mode. Not compatible with Windows clients.

--ifconfig-pool-persist file [seconds] : Persist/unpersist ifconfig-pool

data to file, at seconds intervals (default=600).

If seconds=0, file will be treated as read-only.

--ifconfig-push local remote-netmask : Push an ifconfig option to remote,

overrides --ifconfig-pool dynamic allocation.

Only valid in a client-specific config file.

--iroute network [netmask] : Route subnet to client.

Sets up internal routes only.

Only valid in a client-specific config file.

--disable : Client is disabled.

Only valid in a client-specific config file.

--client-cert-not-required : Don't require client certificate, client

will authenticate using username/password.

--username-as-common-name : For auth-user-pass authentication, use

the authenticated username as the common name,

rather than the common name from the client cert.

--auth-user-pass-verify cmd method: Query client for username/password and

run script cmd to verify. If method='via-env', pass

user/pass via environment, if method='via-file', pass

user/pass via temporary file.

--opt-verify : Clients that connect with options that are incompatible

with those of the server will be disconnected.

--auth-user-pass-optional : Allow connections by clients that don't

specify a username/password.

--no-name-remapping : Allow Common Name and X509 Subject to include

any printable character.

--client-to-client : Internally route client-to-client traffic.

--duplicate-cn : Allow multiple clients with the same common name to

concurrently connect.

--client-connect cmd : Run script cmd on client connection.

--client-disconnect cmd : Run script cmd on client disconnection.

--client-config-dir dir : Directory for custom client config files.

--ccd-exclusive : Refuse connection unless custom client config is found.

--tmp-dir dir : Temporary directory, used for --client-connect return file and plugin communication.

--hash-size r v : Set the size of the real address hash table to r and the

virtual address table to v.

--bcast-buffers n : Allocate n broadcast buffers.

--tcp-queue-limit n : Maximum number of queued TCP output packets.

--tcp-nodelay : Macro that sets TCP_NODELAY socket flag on the server

as well as pushes it to connecting clients.

--learn-address cmd : Run script cmd to validate client virtual addresses.

--connect-freq n s : Allow a maximum of n new connections per s seconds.

--max-clients n : Allow a maximum of n simultaneously connected clients.

--max-routes-per-client n : Allow a maximum of n internal routes per client.

--port-share host port : When run in TCP mode, proxy incoming HTTPS sessions

to a web server at host:port.

Client options (when connecting to a multi-client server):

--client : Helper option to easily configure client mode.

--auth-user-pass [up] : Authenticate with server using username/password.

up is a file containing username/password on 2 lines,

or omit to prompt from console.

--pull : Accept certain config file options from the peer as if they

were part of the local config file. Must be specified

when connecting to a '--mode server' remote host.

--auth-retry t : How to handle auth failures. Set t to

none (default), interact, or nointeract.

--server-poll-timeout n : when polling possible remote servers to connect to

in a round-robin fashion, spend no more than n seconds

waiting for a response before trying the next server.

--explicit-exit-notify [n] : On exit/restart, send exit signal to

server/remote. n = # of retries, default=1.

Data Channel Encryption Options (must be compatible between peers):

(These options are meaningful for both Static Key & TLS-mode)

--secret f [d] : Enable Static Key encryption mode (non-TLS).

Use shared secret file f, generate with --genkey.

The optional d parameter controls key directionality.

If d is specified, use separate keys for each

direction, set d=0 on one side of the connection,

and d=1 on the other side.

--auth alg : Authenticate packets with HMAC using message

digest algorithm alg (default=SHA1).

(usually adds 16 or 20 bytes per packet)

Set alg=none to disable authentication.

--cipher alg : Encrypt packets with cipher algorithm alg

(default=BF-CBC).

Set alg=none to disable encryption.

--prng alg [nsl] : For PRNG, use digest algorithm alg, and

nonce_secret_len=nsl. Set alg=none to disable PRNG.

--keysize n : Size of cipher key in bits (optional).

If unspecified, defaults to cipher-specific default.

--engine [name] : Enable OpenSSL hardware crypto engine functionality.

--no-replay : Disable replay protection.

--mute-replay-warnings : Silence the output of replay warnings to log file.

--replay-window n [t] : Use a replay protection sliding window of size n

and a time window of t seconds.

Default n=64 t=15

--no-iv : Disable cipher IV -- only allowed with CBC mode ciphers.

--replay-persist file : Persist replay-protection state across sessions

using file.

--test-crypto : Run a self-test of crypto features enabled.

For debugging only.

TLS Key Negotiation Options:

(These options are meaningful only for TLS-mode)

--tls-server : Enable TLS and assume server role during TLS handshake.

--tls-client : Enable TLS and assume client role during TLS handshake.

--key-method m : Data channel key exchange method. m should be a method

number, such as 1 (default), 2, etc.

--ca file : Certificate authority file in .pem format containing

root certificate.

--capath dir : A directory of trusted certificates (CAs and CRLs).

--dh file : File containing Diffie Hellman parameters

in .pem format (for --tls-server only).

Use "openssl dhparam -out dh1024.pem 1024" to generate.

--cert file : Local certificate in .pem format -- must be signed

by a Certificate Authority in --ca file.

--key file : Local private key in .pem format.

--pkcs12 file : PKCS#12 file containing local private key, local certificate

and optionally the root CA certificate.

--tls-cipher l : A list l of allowable TLS ciphers separated by : (optional).

: Use --show-tls to see a list of supported TLS ciphers.

--tls-timeout n : Packet retransmit timeout on TLS control channel

if no ACK from remote within n seconds (default=2).

--reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.

--reneg-pkts n : Renegotiate data chan. key after n packets sent and recvd.

--reneg-sec n : Renegotiate data chan. key after n seconds (default=3600).

--hand-window n : Data channel key exchange must finalize within n seconds

of handshake initiation by any peer (default=60).

--tran-window n : Transition window -- old key can live this many seconds

after new key renegotiation begins (default=3600).

--single-session: Allow only one session (reset state on restart).

--tls-exit : Exit on TLS negotiation failure.

--tls-auth f [d]: Add an additional layer of authentication on top of the TLS

control channel to protect against DoS attacks.

f (required) is a shared-secret passphrase file.

The optional d parameter controls key directionality,

see --secret option for more info.

--askpass [file]: Get PEM password from controlling tty before we daemonize.

--auth-nocache : Don't cache --askpass or --auth-user-pass passwords.

--crl-verify crl: Check peer certificate against a CRL.

--tls-verify cmd: Execute shell command cmd to verify the X509 name of a

pending TLS connection that has otherwise passed all other

tests of certification. cmd should return 0 to allow

TLS handshake to proceed, or 1 to fail. (cmd is

executed as 'cmd certificate_depth X509_NAME_oneline')

--tls-export-cert [directory] : Get peer cert in PEM format and store it

in an openvpn temporary file in [directory]. Peer cert is

stored before tls-verify script execution and deleted after.

--tls-remote x509name: Accept connections only from a host with X509 name

x509name. The remote host must also pass all other tests

of verification.

--ns-cert-type t: Require that peer certificate was signed with an explicit

nsCertType designation t = 'client' | 'server'.

--remote-cert-ku v ... : Require that the peer certificate was signed with

explicit key usage, you can specify more than one value.

value should be given in hex format.

--remote-cert-eku oid : Require that the peer certificate was signed with

explicit extended key usage. Extended key usage can be encoded

as an object identifier or OpenSSL string representation.

--remote-cert-tls t: Require that peer certificate was signed with explicit

key usage and extended key usage based on RFC3280 TLS rules.

t = 'client' | 'server'.

PKCS#11 Options:

--pkcs11-providers provider ... : PKCS#11 provider to load.

--pkcs11-protected-authentication [0|1] ... : Use PKCS#11 protected authentication

path. Set for each provider.

--pkcs11-private-mode hex ... : PKCS#11 private key mode mask.

0 : Try to determind automatically (default).

1 : Use Sign.

2 : Use SignRecover.

4 : Use Decrypt.

8 : Use Unwrap.

--pkcs11-cert-private [0|1] ... : Set if login should be performed before

certificate can be accessed. Set for each provider.

--pkcs11-pin-cache seconds : Number of seconds to cache PIN. The default is -1

cache until token is removed.

--pkcs11-id-management : Acquire identity from management interface.

--pkcs11-id serialized-id 'id' : Identity to use, get using standalone --show-pkcs11-ids

SSL Library information:

--show-ciphers : Show cipher algorithms to use with --cipher option.

--show-digests : Show message digest algorithms to use with --auth option.

--show-engines : Show hardware crypto accelerator engines (if available).

--show-tls : Show all TLS ciphers (TLS used only as a control channel).

Generate a random key (only for non-TLS static key encryption mode):

--genkey : Generate a random key to be used as a shared secret,

for use with the --secret option.

--secret file : Write key to file.

PKCS#11 standalone options:

--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.

--verb option can be added *BEFORE* this.

logout

[Process completed]

jkbull...gmail.com

unread,

May 19, 2014, 8:38:31 PM5/19/14

to tunnelbli...@googlegroups.com, isan...@gmail.com

Hi. I'm sorry you're having this problem.

There actually seem to be two problems:

The "Waiting for server response"; and
The "Spinning beach ball"

The first problem can be caused by many things: firewalls or misconfigured or malfunctioning network equipment or problems with the OpenVPN server. There isn't much that can be done to remotely diagnose this problem.

However, the spinning beach ball is something else. The only circumstances in which it normally happens is when Tunnelblick is waiting for you to input something (such as a password). In that case, you can cancel out of whatever window Tunnelblick is displaying and then you will be able to click on the Tunnelblick icon normally.

If, however, Tunnelblick is "stuck", and you can't do anything else, you can use the OS X "Activity Monitor" program to quit Tunnelblick. It is located in /Applications/Utilities:

Select the process named "Tunnelblick" and click the "Quit Process" button, then "Quit".

If that doesn't work, click the "Quit Process" button and click "Force Quit".

If there are any processes named "openvpn", select each one and click "Quit Process" and then "Quit" (or "Force Quit" if necessary)

The "log" you provided is simply the "help" message that OpenVPN prints when no arguments are given.

If you can quit Tunnelblick and then are able to launch it again, do not try to connect a VPN. Instead, open the "VPN Details…" window and post the result of the "Copy Diagnostic Info to Clipboard" button. That may include clues as to what caused the spinning beach ball in the first place.

If you can't get the Diagnostic Info (because you get the spinning beach ball as soon as you launch Tunnelblick), please completely uninstall Tunnelblick and then download and install the latest beta version of Tunnelblick.

If you still can't get it launched, there is probably something seriously wrong with your computer. You might try to "Repair Disk Permissions" and "Repair Disk" in Disk Utility and/or run system diagnostics.

...

Laura Valdes

unread,

May 19, 2014, 10:07:18 PM5/19/14

to tunnelbli...@googlegroups.com, isan...@gmail.com

Thank you for your reply!! I am going to try your suggestions and see if any of this will work. :)

...

Message has been deleted

Laura Valdes

unread,

May 19, 2014, 10:52:05 PM5/19/14

to tunnelbli...@googlegroups.com, isan...@gmail.com

Hi again,

It appears that it is no longer waiting for server, at least I don't see that coming up anywhere. How do I know if it is connected and working?

Thanks again!

On Monday, May 19, 2014 8:38:31 PM UTC-4, jkbull...gmail.com wrote:

...

jkbull...gmail.com

unread,

May 19, 2014, 11:09:18 PM5/19/14

to tunnelbli...@googlegroups.com, isan...@gmail.com

Place the pointer over the Tunnelblick icon and pause. A notification window with a black background should appear near the icon, showing you the status.

To know if it is "working":

Click the Tunnelblick icon, then click on "VPN Details…". A new window will appear.
Click to select the VPN configuration you want to use in the list on the left side of the window.
Click on the "Advanced" button. Another new window will appear.
Put a check to the left of "Check if the apparent public IP address changed after connecting".
Click on the "While Connected" tab.
Put a check to the left of "Route all traffic through the VPN"

Then connect. After the connection is made, Tunnelblick will check that the apparent public IP address of your computer has changed. If it has, a log entry will be made; if it hasn't, a warning window will pop up.

<p style="margin-bottom:0px;font-size:11px;line-height:n
...

Laura Valdes

unread,

May 20, 2014, 1:49:11 AM5/20/14

to tunnelbli...@googlegroups.com, isan...@gmail.com

Thank you again for all this help!! Okay so I followed all the steps you gave and as of now it is Waiting for server response 02:01 again. I am at a loss as to how to make this work... :(

<p style="margin-bottom:0px;font-size:11px;line-height
...

Laura Valdes

unread,

May 20, 2014, 1:53:58 AM5/20/14

to tunnelbli...@googlegroups.com, isan...@gmail.com

I see some error msgs in this log that say handshake failed or negotiation failed to occur in 60 seconds... How do I fix this though?

*Tunnelblick: OS X 10.9.2; Tunnelblick 3.4beta26 (build 3828); prior version 3.4beta20 (build 3727); Admin user

"Sanitized" configuration file for /Users/lauraavaldes-borsum/Library/Application Support/Tunnelblick/Configurations/Anonymiss.tblk:

# --------------------------------------------------------

# Air VPN | https://airvpn.org | Wednesday 19th of March 2014 05:37:56 AM

# OpenVPN Client Configuration

# AirVPN_America_UDP-443

# --------------------------------------------------------

client

dev tun

proto udp

remote america.vpn.airdns.org 443

resolv-retry infinite

nobind

ns-cert-type server

cipher AES-256-CBC

comp-lzo

verb 3

explicit-exit-notify 5

<ca>

[Security-related line(s) omitted]

</ca>

<cert>

[Security-related line(s) omitted]

</cert>

<key>

[Security-related line(s) omitted]

</key>

================================================================================

There are no unusual files in Anonymiss.tblk

================================================================================

Configuration preferences:

-doNotDisconnectOnFastUserSwitch = 1

-routeAllTrafficThroughVpn = 1

-loadTap = always

-loadTun = always

-notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0

-keepConnected = 1

-doNotDisconnectOnSleep = 0

-lastConnectionSucceeded = 0

-tunnelDownSoundName = Glass

-tunnelUpSoundName = Pop

================================================================================

Wildcard preferences:

-notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0

================================================================================

Program preferences:

notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0

askedUserIfOKToCheckThatIPAddressDidNotChangeAfterConnection = 1

tunnelblickVersionHistory = (

"3.4beta26 (build 3828)",

"3.4beta20 (build 3727)",

"3.3.0 (build 3518)",

"3.4beta20 (build 3727)",

"3.3.0 (build 3518)"

)

lastLaunchTime = 422256442.097244

showConnectedDurations = 1

connectionWindowDisplayCriteria = showWhenChanges

maxLogDisplaySize = 102400

lastConnectedDisplayName = Anonymiss

installationUID (not shown)

keyboardShortcutIndex = 1

updateAutomatically = 1

updateCheckAutomatically = 1

updateSendProfileInfo = 1

NSWindow Frame SettingsSheetWindow = 372 327 829 424 0 0 1280 778

NSWindow Frame ConnectingWindow = 443 443 389 187 0 0 1280 778

detailsWindowFrameVersion = 3828

detailsWindowFrame = {{321, 310}, {920, 468}}

detailsWindowLeftFrame = {{0, 0}, {164, 350}}

leftNavSelectedDisplayName = Anonymiss

haveDealtWithSparkle1dot5b6 = 1

haveDealtWithOldTunTapPreferences = 1

SUEnableAutomaticChecks = 1

SUFeedURL = https://www.tunnelblick.net/appcast-b.rss

SUScheduledCheckInterval = 86400

SUSendProfileInfo = 1

SUAutomaticallyUpdate = 1

SULastCheckTime = 2014-05-20 05:27:21 +0000

SULastProfileSubmissionDate = 2014-05-20 02:18:27 +0000

SUHasLaunchedBefore = 1

WebKitDefaultFontSize = 11

WebKitStandardFont = Lucida Grande

================================================================================

Tunnelblick Log:

2014-05-20 01:45:49 *Tunnelblick: OS X 10.9.2; Tunnelblick 3.4beta26 (build 3828); prior version 3.4beta20 (build 3727)

2014-05-20 01:45:49 *Tunnelblick: Attempting connection with Anonymiss using shadow copy; Set nameserver = 1; monitoring connection

2014-05-20 01:45:49 *Tunnelblick: openvpnstart start Anonymiss.tblk 1337 1 0 1 0 17203 -ptADGNWradsgnw 2.2.1

2014-05-20 01:45:50 *Tunnelblick: openvpnstart log:

Tunnelblick: Loading tap-signed.kext

Tunnelblick: Loading tun-signed.kext

Tunnelblick:

OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):

/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.2.1/openvpn

--daemon

--log

/Library/Application Support/Tunnelblick/Logs/-SUsers-Slauraavaldes--borsum-SLibrary-SApplication Support-STunnelblick-SConfigurations-SAnonymiss.tblk-SContents-SResources-Sconfig.ovpn.1_0_1_0_17203.1337.openvpn.log

--cd

/Library/Application Support/Tunnelblick/Users/lauraavaldes-borsum/Anonymiss.tblk/Contents/Resources

--config

/Library/Application Support/Tunnelblick/Users/lauraavaldes-borsum/Anonymiss.tblk/Contents/Resources/config.ovpn

--cd

/Library/Application Support/Tunnelblick/Users/lauraavaldes-borsum/Anonymiss.tblk/Contents/Resources

--management

127.0.0.1

1337

--management-query-passwords

--management-hold

--redirect-gateway

def1

--script-security

2

--up

/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw

--down

/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw

2014-05-20 01:45:49 *Tunnelblick: openvpnstart starting OpenVPN

2014-05-20 01:45:50 *Tunnelblick: Established communication with OpenVPN

2014-05-20 01:45:50 OpenVPN 2.2.1 i386-apple-darwin10.8.0 [SSL] [LZO2] [PKCS11] [eurephia] built on May 2 2014

2014-05-20 01:45:50 MANAGEMENT: TCP Socket listening on 127.0.0.1:1337

2014-05-20 01:45:50 Need hold release from management interface, waiting...

2014-05-20 01:45:50 MANAGEMENT: Client connected from 127.0.0.1:1337

2014-05-20 01:45:50 MANAGEMENT: CMD 'pid'

2014-05-20 01:45:50 MANAGEMENT: CMD 'state on'

2014-05-20 01:45:50 MANAGEMENT: CMD 'state'

2014-05-20 01:45:50 MANAGEMENT: CMD 'bytecount 1'

2014-05-20 01:45:50 MANAGEMENT: CMD 'hold release'

2014-05-20 01:45:50 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2014-05-20 01:45:50 LZO compression initialized

2014-05-20 01:45:50 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]

2014-05-20 01:45:50 Socket Buffers: R=[196724->65536] S=[9216->65536]

2014-05-20 01:45:50 MANAGEMENT: >STATE:1400564750,RESOLVE,,,

2014-05-20 01:45:50 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]

2014-05-20 01:45:50 Local Options hash (VER=V4): '22188c5b'

2014-05-20 01:45:50 Expected Remote Options hash (VER=V4): 'a8f55717'

2014-05-20 01:45:50 UDPv4 link local: [undef]

2014-05-20 01:45:50 UDPv4 link remote: 184.75.221.2:443

2014-05-20 01:45:50 MANAGEMENT: >STATE:1400564750,WAIT,,,

2014-05-20 01:46:50 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

2014-05-20 01:46:50 TLS Error: TLS handshake failed

2014-05-20 01:46:50 TCP/UDP: Closing socket

2014-05-20 01:46:50 SIGUSR1[soft,tls-error] received, process restarting

2014-05-20 01:46:50 MANAGEMENT: >STATE:1400564810,RECONNECTING,tls-error,,

2014-05-20 01:46:50 MANAGEMENT: CMD 'hold release'

2014-05-20 01:46:50 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2014-05-20 01:46:50 LZO compression initialized

2014-05-20 01:46:50 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]

2014-05-20 01:46:50 Socket Buffers: R=[196724->65536] S=[9216->65536]

2014-05-20 01:46:50 MANAGEMENT: >STATE:1400564810,RESOLVE,,,

2014-05-20 01:46:50 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]

2014-05-20 01:46:50 Local Options hash (VER=V4): '22188c5b'

2014-05-20 01:46:50 Expected Remote Options hash (VER=V4): 'a8f55717'

2014-05-20 01:46:50 UDPv4 link local: [undef]

2014-05-20 01:46:50 UDPv4 link remote: 184.75.221.2:443

2014-05-20 01:46:50 MANAGEMENT: >STATE:1400564810,WAIT,,,

2014-05-20 01:47:50 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

2014-05-20 01:47:50 TLS Error: TLS handshake failed

2014-05-20 01:47:50 TCP/UDP: Closing socket

2014-05-20 01:47:50 SIGUSR1[soft,tls-error] received, process restarting

2014-05-20 01:47:50 MANAGEMENT: >STATE:1400564870,RECONNECTING,tls-error,,

2014-05-20 01:47:50 MANAGEMENT: CMD 'hold release'

2014-05-20 01:47:50 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2014-05-20 01:47:50 LZO compression initialized

2014-05-20 01:47:50 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]

2014-05-20 01:47:50 Socket Buffers: R=[196724->65536] S=[9216->65536]

2014-05-20 01:47:50 MANAGEMENT: >STATE:1400564870,RESOLVE,,,

2014-05-20 01:47:50 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]

2014-05-20 01:47:50 Local Options hash (VER=V4): '22188c5b'

2014-05-20 01:47:50 Expected Remote Options hash (VER=V4): 'a8f55717'

2014-05-20 01:47:50 UDPv4 link local: [undef]

2014-05-20 01:47:50 UDPv4 link remote: 184.75.221.2:443

2014-05-20 01:47:50 MANAGEMENT: >STATE:1400564870,WAIT,,,

2014-05-20 01:48:50 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

2014-05-20 01:48:50 TLS Error: TLS handshake failed

2014-05-20 01:48:50 TCP/UDP: Closing socket

2014-05-20 01:48:50 SIGUSR1[soft,tls-error] received, process restarting

2014-05-20 01:48:50 MANAGEMENT: >STATE:1400564930,RECONNECTING,tls-error,,

2014-05-20 01:48:50 MANAGEMENT: CMD 'hold release'

2014-05-20 01:48:50 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2014-05-20 01:48:50 LZO compression initialized

2014-05-20 01:48:50 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]

2014-05-20 01:48:50 Socket Buffers: R=[196724->65536] S=[9216->65536]

2014-05-20 01:48:50 MANAGEMENT: >STATE:1400564930,RESOLVE,,,

2014-05-20 01:48:50 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]

2014-05-20 01:48:50 Local Options hash (VER=V4): '22188c5b'

2014-05-20 01:48:50 Expected Remote Options hash (VER=V4): 'a8f55717'

2014-05-20 01:48:50 UDPv4 link local: [undef]

2014-05-20 01:48:50 UDPv4 link remote: 184.75.221.2:443

2014-05-20 01:48:50 MANAGEMENT: >STATE:1400564930,WAIT,,,

2014-05-20 01:49:50 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

2014-05-20 01:49:50 TLS Error: TLS handshake failed

2014-05-20 01:49:50 TCP/UDP: Closing socket

2014-05-20 01:49:50 SIGUSR1[soft,tls-error] received, process restarting

2014-05-20 01:49:50 MANAGEMENT: >STATE:1400564990,RECONNECTING,tls-error,,

2014-05-20 01:49:50 MANAGEMENT: CMD 'hold release'

2014-05-20 01:49:50 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2014-05-20 01:49:50 LZO compression initialized

2014-05-20 01:49:50 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]

2014-05-20 01:49:50 Socket Buffers: R=[196724->65536] S=[9216->65536]

2014-05-20 01:49:50 MANAGEMENT: >STATE:1400564990,RESOLVE,,,

2014-05-20 01:49:50 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]

2014-05-20 01:49:50 Local Options hash (VER=V4): '22188c5b'

2014-05-20 01:49:50 Expected Remote Options hash (VER=V4): 'a8f55717'

2014-05-20 01:49:50 UDPv4 link local: [undef]

2014-05-20 01:49:50 UDPv4 link remote: 184.75.221.2:443

2014-05-20 01:49:50 MANAGEMENT: >STATE:1400564990,WAIT,,,

2014-05-20 01:50:50 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

2014-05-20 01:50:50 TLS Error: TLS handshake failed

2014-05-20 01:50:50 TCP/UDP: Closing socket

2014-05-20 01:50:50 SIGUSR1[soft,tls-error] received, process restarting

2014-05-20 01:50:50 MANAGEMENT: >STATE:1400565050,RECONNECTING,tls-error,,

2014-05-20 01:50:50 MANAGEMENT: CMD 'hold release'

2014-05-20 01:50:50 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2014-05-20 01:50:50 LZO compression initialized

2014-05-20 01:50:50 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]

2014-05-20 01:50:50 Socket Buffers: R=[196724->65536] S=[9216->65536]

2014-05-20 01:50:50 MANAGEMENT: >STATE:1400565050,RESOLVE,,,

2014-05-20 01:50:51 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]

2014-05-20 01:50:51 Local Options hash (VER=V4): '22188c5b'

2014-05-20 01:50:51 Expected Remote Options hash (VER=V4): 'a8f55717'

2014-05-20 01:50:51 UDPv4 link local: [undef]

2014-05-20 01:50:51 UDPv4 link remote: 184.75.221.2:443

2014-05-20 01:50:51 MANAGEMENT: >STATE:1400565051,WAIT,,,

================================================================================

Console Log:

2014-05-19 22:14:53 Tunnelblick[7377] SIGTERM (signal 15) received

2014-05-19 22:14:55 Tunnelblick[7377] deleteAppFromLoginItems: LSSharedFileListItemResolve returned status = -35 for itemRef = 0xFE03AE0; url is NULL

2014-05-19 22:14:55 Tunnelblick[7377] deleteAppFromLoginItems: LSSharedFileListItemResolve returned status = -1407 for itemRef = 0xFE03500; url is NULL

2014-05-19 22:15:09 Tunnelblick[7377] applicationShouldTerminate: termination because of Quit; delayed until 'shutdownTunnelblick' finishes

2014-05-19 22:18:23 Tunnelblick[13622] deleteAppFromLoginItems: LSSharedFileListItemResolve returned status = -35 for itemRef = 0x48F2E0; url is NULL

2014-05-19 22:18:23 Tunnelblick[13622] deleteAppFromLoginItems: LSSharedFileListItemResolve returned status = -1407 for itemRef = 0x484690; url is NULL

2014-05-19 22:18:26 Tunnelblick[13622] Set program update feedURL to https://www.tunnelblick.net/appcast-b.rss

2014-05-19 22:18:29 Tunnelblick[13622] DEBUG: Updater: systemVersion 10.9.2 satisfies minimumSystemVersion 10.4.0

2014-05-20 01:27:00 Tunnelblick[13622] deleteAppFromLoginItems: LSSharedFileListItemResolve returned status = -35 for itemRef = 0x7FCD610; url is NULL

2014-05-20 01:27:00 Tunnelblick[13622] deleteAppFromLoginItems: LSSharedFileListItemResolve returned status = -1407 for itemRef = 0x7FB4BC0; url is NULL

2014-05-20 01:27:02 Tunnelblick[13622] applicationShouldTerminate: termination because of Quit; delayed until 'shutdownTunnelblick' finishes

2014-05-20 01:27:07 Tunnelblick[13622] openvpnstart stderr from killall:

Tunnelblick: Timeout (5 seconds) waiting for openvpn process(es) to terminate

2014-05-20 01:27:08 Tunnelblick[13622] Finished shutting down Tunnelblick; allowing termination

2014-05-20 01:27:19 Tunnelblick[14226] deleteAppFromLoginItems: LSSharedFileListItemResolve returned status = -35 for itemRef = 0x32E550; url is NULL

2014-05-20 01:27:19 Tunnelblick[14226] deleteAppFromLoginItems: LSSharedFileListItemResolve returned status = -1407 for itemRef = 0x32F440; url is NULL

2014-05-20 01:27:21 Tunnelblick[14226] Set program update feedURL to https://www.tunnelblick.net/appcast-b.rss

2014-05-20 01:27:23 Tunnelblick[14226] DEBUG: Updater: systemVersion 10.9.2 satisfies minimumSystemVersion 10.4.0

2014-05-20 01:45:09 WindowServer[86] disable_update_timeout: UI updates were forcibly disabled by application "Tunnelblick" for over 1.00 seconds. Server has re-enabled them.

2014-05-20 01:45:09 WindowServer[86] common_reenable_update: UI updates were finally reenabled by application "Tunnelblick" after 1.48 seconds (server forcibly re-enabled them after 1.00 seconds)

================================================================================

Non-Apple kexts that are loaded:

Index Refs Address Size Wired Name (Version) <Linked Against>

483 0 0xffffff7f8204b000 0x6000 0x6000 net.tunnelblick.tap (1.0) <7 5 4 1>

484 0 0xffffff7f82051000 0x6000 0x6000 net.tunnelblick.tun (1.0) <7 5 4 1>

On Monday, May 19, 2014 11:09:18 PM UTC-4, jkbull...gmail.com wrote:

<p style="margin-bottom:0px;font-size:11px;line-height
...

Laura Valdes

unread,

May 20, 2014, 1:55:27 AM5/20/14

to tunnelbli...@googlegroups.com, isan...@gmail.com

Still waiting for server response at 09:02 now.

On Monday, May 19, 2014 11:09:18 PM UTC-4, jkbull...gmail.com wrote:

<p style="margin-bottom:0px;font-size:11px;line-height
...

jkbull...gmail.com

unread,

May 20, 2014, 6:31:06 AM5/20/14

to tunnelbli...@googlegroups.com, isan...@gmail.com

You need to contact your VPN service provider, AirVPN. That is the organization which gave you your configuration files, and perhaps a username and password, and to which you are probably paying a fee for VPN service. For more information, please see Getting VPN Service.

Tunnelblick is just the free software that many VPN service providers recommend or supply to their customers. We do not provide VPN service, just software.

Laura Valdes

unread,

Jun 2, 2014, 12:13:23 AM6/2/14

to tunnelbli...@googlegroups.com, isan...@gmail.com

Thank you! I will contact them, because I have been paying since December for this service and it has never worked right.

Reply all

Reply to author

Forward