The Spark Between

Let’s do some math:

That’s 180 + 160 + 160 + 500 + 160 + 500 + 500 = 2160. Roughly 2 TB. Much fun :)

(Granted, I’m actually going to put those 3 500GB’s in RAID 5 once this copy of Ubuntu finishes downloading, so I’m only adding about 931MB, and actually, I’m going to take the old drives out and run just on the RAID array so that my data is stored in case another drive fails, but still. It will be a lot of fun having a computer with 2TB of storage and 7 hard drives for a while :-D)

Had to take a picture, cuz this prolly won’t happen again… but that, honest to goodness, is my roommate Dave!

I do so dearly love cabling… now we can hook Dave’s piano up to the computer for some MIDI-transcribing goodness, and when our SM57 arrives, hook that up too for some fancy recording. Now all I need is some free time!

My parents came to visit this weekend and my mom got me a fish! I now need a name… any suggestions?

Before:

During:

After:

Heh- I never thought I’d be buying computer parts at Best Buy again. I was surprised this weekend to see they were selling 500GB drives for $99, but checking online revealed what I expected: they didn’t actually HAVE any. They just had them on sale. BUT, then we went to the brick-and-mortar store while shopping today, and guess what they had 4 of in stock? I took 3 :-D

The Problem

You want to run an OpenVPN Client on Mac OS X. Your OpenVPN server will be serving DHCP, as well as pushing down DNS server addresses. You’ve tried connecting, and it just doesn’t seem to work. Perhaps you even see a large number of errors of the type:

write to TUN/TAP : Input/output error (code=5)

The Solution

When you connect via OpenVPN, it is the responsibility of the client to process pushed dhcp-options (including the DNS server rules), and do something useful with them. On a linux system, you could, for example, incorporate these into /etc/resolv.conf. Consult your distro’s openvpn documentation for more information.

However, this does not work on a Mac, because Mac software (even down to ssh and ping) doesn’t use /etc/resolv.conf under OS X 10.4… Oops. The solution? A combination of two tools: ipconfig and scutil. These together can manage 10.4’s new DNS configuration system, and set the tap device to obtain an address via DHCP. The problem is discussed further on nicholas riley’s blog, though his solution, a python script, a) is complicated to install, and b) did not actually work for me once installed, though I didn’t dig deep enough to understand why.

The best solution is to run an “up” script as part of the OpenVPN connection process, which will handle the necessary configuration for you. The script is provided on the Openvpn-users mailing list, by Ben Low.

Here’s how to use it with the excellent OpenVPN client Tunnelblick:

1. Install Tunnelblick, and create your OpenVPN config. I’ll assume that you know how to do this, or you wouldn’t be here. If not, consult the documentation for OpenVPN.
2. Download this script (copied from the openvpn-users mailing list). Save it to ~/Library/openvpn, the folder where your Tunnelblick OpenVPN configuration lives.

   OpenVPN TAP up-down Script: tap-up-down.sh

3. Now, make the script executable, by running:

   chmod +x ~/Library/openvpn/tap-up-down.sh

4. Edit your configuration file to include these lines:

   up ./tap-up-down.sh
   down ./tap-up-down.sh

5. Changing your configuration file will have disconnected Tunnelblick if it was connected. Tunnelblick will also prompt you again for your administrator password, since security-sensitive files have been modified.
6. Time to test! Open a Terminal window, and run the command:

   scutil –dns

   to see the current configuration of DNS resolvers. Then connect to your VPN in Tunnelblick, and run the command again:

   scutil –dns

   If all goes as planned, you will see your VPN DNS resolver properly included in the configuration. Congratulations!

7. You should now be able to ping internal hosts by their internal DNS names, e.g.:

   ping internal-server

Good luck!

Updated 11/30/2007 to add chmod +x. Thanks Karel!

Jared and I beat the Onion crossword this morning, and I am embarassed to have to tell Scott that he had to pull out DIGG for this clue that I couldn’t figure out. “If one were to —, one would get articles about crazy online personal ads” Nice work Jared!

[Update 10.4.07]: So it seems putting dashes in my post title on my phone is a bad idea… I missed the fact that this post was titled “T” instead of the correct title it now has for two solid days… oops. Moral of the story: dashes are for categories on Postie. :)