Setup OpenVPN Client on Mac OSX

Recently I bought this new router: ASUS RT-N16 Wireless-N Gigabit Router. Once I got it, I flashed it with tomato firmware, which I have been using for years, and am very happy with its stability and feature set. This time I chose a slightly different variation: Tomato USB, not only because it supports USB ports on the router, but also because it has built-in openVPN. The firmware I used is this one: experimental VPN firmware for Kernel 2.6, MIPSR2 Routers.

I followed the instructions from this link to set the VPN server, and my client configuration. As to the vpn client software, since I have a Macbook Pro, the Tunnelblick from Google becomes the number one choice.

However, after setting up the client side configurations, once I started Tunnelblick, my Macbook couldn’t get an IP address from the VPN server, even though the secure connection was established successfully. I checked the log file, and found an error message:

write to TUN/TAP : Input/output error (code=5)

. After some research, I found the solution:

1. On the server side, make sure: “Start with WAN” is checked, “Interface type” is “TAP”, “Authentication Mode” is “TLS”, “Client Address Pool”: “DHCP” is checked.
2. On the Macbook, click Tunnelblick, and then menu item “Details”.
3. Choose “Do not set nameserver” at the lower-left corner.
4. Click on “Edit configuration”.
5. Add following two lines to your configuration file, and save it:

   up "./vpn-up.sh"
   down "./vpn-down.sh"

6. In directory ~/Library/Application Support/Tunnelblick/Configurations/home.tblk/Contents/Resources, create two files: vpn-up.sh and vpn-down.sh (see bellow).
7. Make sure both files are owned by “root:wheel” and the permission is 700.

After these changes, everything works perfectly. I can ssh back to my home server without using “Port Forwarding” feature on the router; I can even print to my home printer directly from a coffee shop! It’s neat, isn’t it?

P.S.

vpn-up.sh

#!/bin/bash
sleep 2
/usr/sbin/ipconfig set tap0 DHCP

vpn-down.sh

#!/bin/bash
sleep 2
/usr/sbin/ipconfig set tap0 NONE