bjoern seegebarth

Tarif: Glasfaser 600

Alles klar, dann schieb ich das mal rüber in den Privatkundenbereich.

bjoern seegebarth

Verbindung zu Kunden über Tunnelblick (openVPN) zu Synology DiskStation bzw. RackStation mit VPN -Server.

Einstellungen sind 08/15. Verbindung vom gleichen Rechner (MacBook Pro 14" M3).

Können ja dann mal die Experten beurteilen ob das für die Hilfe ausreicht

Lass gut sein, ich gehe einfach woanders hin. Kosten sind eh die gleichen.

Ich krieg zwar eine Rechnung für Geschäftskunden, aber ist wohl so ne Telekom-Sache.

Du bekommst da von der Telekom gar nix für??

Dann sorry, wusste ich nicht.

Das finde ich ein bisschen schäbig von denen.

bjoern seegebarth

Du bekommst da von der Telekom gar nix für??

Dann sorry, wusste ich nicht.

Zumindest kein Geld

bjoern seegebarth

Das finde ich ein bisschen schäbig von denen.

Es ist halt ein Community Forum :D

Wo steht denn dein OpenVPN Server und welcher ISP ist das? Auch ein tracert zu dem Ziel wäre hilfreich, falls du doch noch Hilfe möchtest.

bjoern seegebarth

ich bin sehr faul

Dann können 80Sek für den Aufbau aber auch nicht stören ;)

Hier ein Log:

Wie gesagt, wenn ich die Verbindung nicht von einem Telekom-Anschluss starte, geht das ruckizucki, völlig problemlos. Auch in irgendwelchen Hotel-WLANs

*Tunnelblick: macOS 15.7.3 (24G419); Tunnelblick 8.0 (build 6300); prior version 3.8.7a (build 5770); Admin user

git commit ee17945a7cc14b103ce3bd758b282418c799b96c

The Tunnelblick.app process is not being translated (arm64)

System Integrity Protection is enabled

Model: Mac15,6

================================================================================

Configuration K31

"Sanitized" condensed configuration file for /Library/Application Support/Tunnelblick/Shared/K31.tblk:

dev tun

tls-client

remote macsupport-bs7.synology.me 1194

redirect-gateway def1

pull

proto udp

script-security 2

comp-lzo

reneg-sec 0

cipher AES-256-CBC

auth SHA512

auth-user-pass

<ca>

[Security-related line(s) omitted]

</ca>

================================================================================

Files in K31.tblk:

      Contents/Resources/config.ovpn

================================================================================

Configuration preferences:

-routeAllTrafficThroughVpn = 1

-keychainHasUsernameAndPassword = 1

-notOKToCheckThatIPAddressDidNotChangeAfterConnection = 1

-loginWindowSecurityTokenCheckboxIsChecked = 0

-lastConnectionSucceeded = 1

================================================================================

Wildcard preferences:

-notOKToCheckThatIPAddressDidNotChangeAfterConnection = 1

================================================================================

Program preferences:

skipWarningAboutDnsProblems = 1

inhibitOutboundTunneblickTraffic = 1

launchAtNextLogin = 1

tunnelblickVersionHistory = (

    "8.0 (build 6300)",

    "3.8.7a (build 5770)",

    "3.8.8beta01 (build 5760)",

    "3.8.7beta03 (build 5740)"

)

statusDisplayNumber = 0

lastLaunchTime = 788818205.157364

lastLanguageAtLaunchWasRTL = 0

connectionWindowDisplayCriteria = showWhenConnecting

maxLogDisplaySize = 102400

lastConnectedDisplayName = xxx

keyboardShortcutIndex = 1

updateCheckAutomatically = 1

NSWindow Frame SettingsSheetWindow = 280 151 829 548 0 0 1512 944 

NSWindow Frame ConnectingWindow = 580 545 389 217 0 0 1512 944 

NSWindow Frame SUStatusFrame = 575 606 400 135 0 0 1512 944 

NSWindow Frame SUUpdateAlert = 446 409 620 398 0 0 1512 944 

detailsWindowFrameVersion = 6300

detailsWindowFrame = {{1019, 859}, {920, 522}}

detailsWindowLeftFrame = {{0, 0}, {167, 402}}

detailsWindowViewIndex = 0

detailsWindowConfigurationsTabIdentifier = settings

leftNavSelectedDisplayName = K31

AdvancedWindowTabIdentifier = connectingAndDisconnecting

haveDealtWithOldTunTapPreferences = 1

haveDealtWithAlwaysShowLoginWindow = 1

haveDealtWithOldLoginItem = 1

haveDealtWithAfterDisconnect = 1

SUEnableAutomaticChecks = 0

SUScheduledCheckInterval = 86400

SULastCheckTime = 2022-10-14 20:45:42 +0000

SUHasLaunchedBefore = 1

================================================================================

Forced preferences:

{

    "WvK-authenticateOnConnect" = 0;

}

================================================================================

Deployed forced preferences:

(None)

================================================================================

Tunnelblick Kext Policy Data:

================================================================================

Tunnelblick Log:

2026-01-03 14:38:17.794800 *Tunnelblick: macOS 15.7.3 (24G419); Tunnelblick 8.0 (build 6300); prior version 3.8.7a (build 5770)

2026-01-03 14:38:20.036541 *Tunnelblick: Attempting connection with K31; Set nameserver = 0x00000301; monitoring connection

2026-01-03 14:38:20.036648 *Tunnelblick: openvpnstart start K31.tblk 64020 0x00000301 0 3 0 0x0210c330 -ptADGNWradsgnw 2.6.14-openssl-3.0.16 <password>

2026-01-03 14:38:20.068181 *Tunnelblick: openvpnstart starting OpenVPN

2026-01-03 14:38:20.412401 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.

2026-01-03 14:38:20.412474 WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results

2026-01-03 14:38:20.414897 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305). OpenVPN ignores --cipher for cipher negotiations. 

2026-01-03 14:38:20.414973 OpenVPN 2.6.14 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD]

2026-01-03 14:38:20.414997 library versions: OpenSSL 3.0.16 11 Feb 2025, LZO 2.10

2026-01-03 14:38:20.415481 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:64020

2026-01-03 14:38:20.415495 Need hold release from management interface, waiting...

2026-01-03 14:38:20.662063 *Tunnelblick: openvpnstart log:

     OpenVPN started successfully.

     Command used to start OpenVPN (one argument per displayed line):

          /Library/Application Support/Tunnelblick/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.6.14-openssl-3.0.16/openvpn

          --daemon

          --log-append /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-SK31.tblk-SContents-SResources-Sconfig.ovpn.769_0_3_0_34652976.64020.openvpn.log

          --cd /Library/Application Support/Tunnelblick/Shared/K31.tblk/Contents/Resources

          --machine-readable-output

          --setenv IV_GUI_VER "net.tunnelblick.tunnelblick 6300 8.0 (build 6300)"

          --verb 3

          --config /Library/Application Support/Tunnelblick/Shared/K31.tblk/Contents/Resources/config.ovpn

          --setenv TUNNELBLICK_CONFIG_FOLDER /Library/Application Support/Tunnelblick/Shared/K31.tblk/Contents/Resources

          --verb 3

          --cd /Library/Application Support/Tunnelblick/Shared/K31.tblk/Contents/Resources

          --management 127.0.0.1 64020 /Library/Application Support/Tunnelblick/Mips/K31.tblk.mip

          --setenv IV_SSO webauth,crtext

          --management-query-passwords

          --management-hold

          --redirect-gateway def1

          --script-security 2

          --route-up "/Library/Application Support/Tunnelblick/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh" -9 -d -f -m -w -ptADGNWradsgnw

          --down "/Library/Application Support/Tunnelblick/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh" -9 -d -f -m -w -ptADGNWradsgnw

2026-01-03 14:38:20.664824 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:64095

2026-01-03 14:38:20.685400 MANAGEMENT: CMD 'pid'

2026-01-03 14:38:20.685517 MANAGEMENT: CMD 'auth-retry interact'

2026-01-03 14:38:20.685534 *Tunnelblick: Established communication with OpenVPN

2026-01-03 14:38:20.685579 MANAGEMENT: CMD 'state on'

2026-01-03 14:38:20.685633 MANAGEMENT: CMD 'state'

2026-01-03 14:38:20.685720 MANAGEMENT: CMD 'bytecount 1'

2026-01-03 14:38:20.686042 *Tunnelblick: >INFO:OpenVPN Management Interface Version 5 -- type 'help' for more info

2026-01-03 14:38:20.686563 MANAGEMENT: CMD 'hold release'

2026-01-03 14:38:20.692651 *Tunnelblick: Obtained VPN username and password from the Keychain

2026-01-03 14:38:20.693437 MANAGEMENT: CMD 'username "Auth" "z-admin"'

2026-01-03 14:38:20.693618 MANAGEMENT: CMD 'password [...]'

2026-01-03 14:38:20.693890 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.

2026-01-03 14:38:20.693916 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2026-01-03 14:38:20.703976 MANAGEMENT: >STATE:1767447500,RESOLVE,,,,,,

2026-01-03 14:38:20.779700 TCP/UDP: Preserving recently used remote address: [AF_INET]95.113.128.203:1194

2026-01-03 14:38:20.779845 Socket Buffers: R=[786896->786896] S=[9216->9216]

2026-01-03 14:38:20.779869 UDPv4 link local: (not bound)

2026-01-03 14:38:20.779882 UDPv4 link remote: [AF_INET]95.113.128.203:1194

2026-01-03 14:38:20.779910 MANAGEMENT: >STATE:1767447500,WAIT,,,,,,

2026-01-03 14:38:20.886050 MANAGEMENT: >STATE:1767447500,AUTH,,,,,,

2026-01-03 14:38:20.886131 TLS: Initial packet from [AF_INET]95.113.128.203:1194, sid=4c8f6782 a87b48bd

2026-01-03 14:38:20.886232 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this

2026-01-03 14:38:21.014823 VERIFY OK: depth=2, C=US, O=Internet Security Research Group, CN=ISRG Root X1

2026-01-03 14:38:21.018472 VERIFY OK: depth=1, C=US, O=Let's Encrypt, CN=R12

2026-01-03 14:38:21.018871 VERIFY OK: depth=0, CN=macsupport-bs7.synology.me

2026-01-03 14:38:21.822853 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bits RSA, signature: RSA-SHA256, peer temporary key: 253 bits X25519

2026-01-03 14:38:21.822980 [macsupport-bs7.synology.me] Peer Connection Initiated with [AF_INET]95.113.128.203:1194

2026-01-03 14:38:21.823017 TLS: move_session: dest=TM_ACTIVE src=TM_INITIAL reinit_src=1

2026-01-03 14:38:21.823131 TLS: tls_multi_process: initial untrusted session promoted to trusted

2026-01-03 14:38:21.979804 PUSH: Received control message: 'PUSH_REPLY,route 192.168.191.0 255.255.255.0,route 10.8.0.0 255.255.255.0,route 10.8.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM'

2026-01-03 14:38:21.980005 OPTIONS IMPORT: --ifconfig/up options modified

2026-01-03 14:38:21.980051 OPTIONS IMPORT: route options modified

2026-01-03 14:38:21.981831 Opened utun device utun6

2026-01-03 14:38:21.981909 MANAGEMENT: >STATE:1767447501,ASSIGN_IP,,10.8.0.6,,,,

2026-01-03 14:38:21.981960 /sbin/ifconfig utun6 delete

                           ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address

2026-01-03 14:38:22.022551 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure

2026-01-03 14:38:22.022622 /sbin/ifconfig utun6 10.8.0.6 10.8.0.5 mtu 1500 netmask 255.255.255.255 up

2026-01-03 14:38:22.030021 /sbin/route add -net 95.113.128.203 10.24.1.1 255.255.255.255

                           add net 95.113.128.203: gateway 10.24.1.1

2026-01-03 14:38:22.046801 /sbin/route add -net 0.0.0.0 10.8.0.5 128.0.0.0

                           add net 0.0.0.0: gateway 10.8.0.5

2026-01-03 14:38:22.056400 /sbin/route add -net 128.0.0.0 10.8.0.5 128.0.0.0

                           add net 128.0.0.0: gateway 10.8.0.5

2026-01-03 14:38:22.062021 MANAGEMENT: >STATE:1767447502,ADD_ROUTES,,,,,,

2026-01-03 14:38:22.062069 /sbin/route add -net 192.168.191.0 10.8.0.5 255.255.255.0

                           add net 192.168.191.0: gateway 10.8.0.5

2026-01-03 14:38:22.066674 /sbin/route add -net 10.8.0.0 10.8.0.5 255.255.255.0

                           add net 10.8.0.0: gateway 10.8.0.5

2026-01-03 14:38:22.070090 /sbin/route add -net 10.8.0.1 10.8.0.5 255.255.255.255

                           add net 10.8.0.1: gateway 10.8.0.5

                           14:38:22 *Tunnelblick:  **********************************************

                           14:38:22 *Tunnelblick:  Start of output from client.up.tunnelblick.sh

                           14:38:22 *Tunnelblick:  Primary network service: Wi-Fi

                           14:38:25 *Tunnelblick:  Disabled IPv6 for 'USB 10/100/1000 LAN'

                           14:38:25 *Tunnelblick:  Disabled IPv6 for 'Belkin USB-C LAN'

                           14:38:25 *Tunnelblick:  Disabled IPv6 for 'AX88179B'

                           14:38:25 *Tunnelblick:  Disabled IPv6 for 'Thunderbolt Ethernet Slot 0'

                           14:38:25 *Tunnelblick:  Disabled IPv6 for 'Thunderbolt Bridge'

                           14:38:25 *Tunnelblick:  Disabled IPv6 for 'Wi-Fi'

                           14:38:25 *Tunnelblick:  Disabled IPv6 for 'iPhone USB'

                           14:38:25 *Tunnelblick:  No changes to DNS servers have been requested

                           14:38:25 *Tunnelblick:  DNS servers '10.24.1.1' will be used for DNS queries when the VPN is active

                           14:38:25 *Tunnelblick:  NOTE: The DNS servers do not include any free public DNS servers known to Tunnelblick. This may cause DNS queries to fail or be intercepted or falsified even if they are directed through the VPN . Specify only known public DNS servers or DNS servers located on the VPN network to avoid such problems.

                           14:38:25 *Tunnelblick:  Will not monitor for network configuration changes.

                           14:38:25 *Tunnelblick:  Have written State:/Network/OpenVPN for no DNS changes and to inhibit network monitoring

                           14:38:25 *Tunnelblick:  Flushed the DNS cache via dscacheutil

                           14:38:25 *Tunnelblick:  /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil

                           14:38:25 *Tunnelblick:  Notified mDNSResponder that the DNS cache was flushed

                           14:38:25 *Tunnelblick:  Notified mDNSResponderHelper that the DNS cache was flushed

                           14:38:25 *Tunnelblick:  End of output from client.up.tunnelblick.sh

                           14:38:25 *Tunnelblick:  **********************************************

2026-01-03 14:38:25.685533 Initialization Sequence Completed

2026-01-03 14:38:25.685546 MANAGEMENT: >STATE:1767447505,CONNECTED,SUCCESS,10.8.0.6,95.113.128.203,1194,,

2026-01-03 14:38:25.685551 Data Channel: cipher 'AES-256-GCM', peer-id: 0, compression: 'lzo'

2026-01-03 14:38:25.685554 Timers: ping 10, ping-restart 60

2026-01-03 14:38:26.803555 *Tunnelblick: Warning: Empty expected DNS address. It is likely that no DNS address was pushed by the VPN server.

2026-01-03 14:38:26.912162 *Tunnelblick: Routing info stdout:

   route to: 10.24.1.1

destination: 10.24.1.1

  interface: en0

      flags: <UP,HOST,DONE,LLINFO,WASCLONED,IFSCOPE,IFREF,ROUTER>

 recvpipe  sendpipe  ssthresh  rtt,msec    rttvar  hopcount      mtu     expire

       0         0         0         0         0         0      1500      1199 

stderr:

2026-01-03 14:38:26.912463 *Tunnelblick: Warning: DNS server address 10.24.1.1 is not a public IP address and is not being routed through the VPN .

Und nun vergleichst Du es mit einer „schnellen“ Verbindung@bjoern seegebarth 

Und vor allen Test Rechner richtig neu starten, also Kaltstart. Nicht dass der VPN -Client vorgeladen ist

Und wie ist das Log einer Schlechten Verbindung.

Die hier ist ja nach den Zeiten in 10 sec. aufgebaut gewesen.