Highlighted Articles News Installing Tunnelblick Uninstalling Tunnelblick Setting up Configurations Using Tunnelblick Getting VPN Service Common Problems Configuring OpenVPN Release Notes Thanks FAQ Discussion Group Read Before You Post

The following is the current status of issues that have been seen using the latest stable version of Tunnelblick on the latest version of macOS Catalina. Important: See The Future of Tun and Tap VPNs on macOS for information about changes to future versions of macOS. NEW macOS REQUIREMENT: Restarting the computer is required by macOS Catalina before connecting some configurations for the first time. If a configuration requires a 'tun' or 'tap' system extension, the first time Tunnelblick asks macOS to load the appropriate system extension, macOS will tell the user that they must give permission to load system extensions signed by 'Jonathan Bullard' in System Preferences : Security & Privacy : General. If the user give such permission by clicking 'Allow', macOS must restart the computer before the permission will be honored. After the permission has been given and the computer has been restarted, you may then connect all VPN configurations normally. This only needs to be done one time. Once permission to load system extensions signed by 'Jonathan Bullard' has been granted and the computer restarted, no further action is needed. Tunnelblick will be able to load 'tun' and 'tap' system extensions for any configuration without user interaction, and that ability will persist after computer restarts, 'safe boots', and updates to Tunnelblick. Note: If you are using a 'tun' VPN, you can avoid needing to load the 'tun' system extension. See the note at the start of Errors Loading Kexts (Device Drivers). WON'T FIX: Sidecar does not work when a VPN is connected using Tunnelblick's default for a configuration. Sidecar does not work if IPv6 is disabled. By default, Tunnelblick disables IPv6 while a VPN is connected. This is done to prevent information leaks in common VPN setups (see A Glance through the VPN Looking Glass: IPv6 Leakage and DNS Hijacking in Commercial VPN clients). To fix this problem: Verify with your VPN service provider that no information is leaked if IPv6 traffic is allowed. If you cannot confirm that, you should not proceed and you will not be able to use Sidecar when your VPN is connected. Launch Tunnelblick. Click the Tunnelblick icon in the menu bar and then click 'VPN Details'. Click on the large 'Configurations' button at the top of the window. Select the configuration(s) you wish to modify. Remove the check from 'Disable IPv6 unless the server is accessed via IPv6'. (This page was updated 2020-04-02.)

# Generate your own with: # openssl dhparam -out dh1024.pem 1024 # Substitute 2048 for 1024 if you are using # 2048 bit keys. Dh dh2048.pem # Configure server mode and supply a VPN subnet # for OpenVPN to draw client addresses from. # The server will take 10.8.0.1 for itself, # the rest will be made available to clients.

• OpenVPN Server on MacOS. Posted by 2 years ago. OpenVPN Server on MacOS. Hi all, I was wondering if anyone has had any success or could point to a guide for setting up an OpenVPN Server on MacOS? Is it compatible with VoD style connections for iOS and MacOS?
• 16 rows  Dec 18, 2019  Starting with macOS Server 5.7.1, Apple no longer bundles open source.

Export macOS Server Data
We’re not going to import this, as it only takes a few seconds to configure new settings. Additionally, if you have outstanding services built on macOS Server, you might be able to pull this off without touching client systems. First, let’s grab which protocols are enabled, running the following from Terminal:

sudo serveradmin settings vpn:Servers:com.apple.ppp.pptp:enabled

sudo serveradmin settings vpn:Servers:com.apple.ppp.l2tp:enabled

Next, we’ll get the the IP ranges used so we can mimic those (or change them) in the new service:

sudo serveradmin settings vpn:Servers:com.apple.ppp.pptp:IPv4:DestAddressRanges

Now let’s grab the DNS servers handed out so those can be recreated:

sudo serveradmin settings vpn:Servers:com.apple.ppp.pptp:DNS:OfferedServerAddresses:_array_index
sudo serveradmin settings vpn:Servers:com.apple.ppp.l2tp:DNS:OfferedServerAddresses:_array_index


Finally, if you’re using L2TP, let’s grab the shared secret:

How To Install Openvpn For Mac

sudo serveradmin settings vpn:Servers:com.apple.ppp.l2tp:L2TP:IPSecSharedSecretValue

Once we have all of this information, we can configure the new server using the same settings. At this point, you can decide whether you want to dismantle the old server and setup a new one on the same IP address, or whether you’d rather just change your port forwards on your router/firewall.
Ports
Before we configure any VPN services, let’s talk about ports. The following ports need to be opened per The Official iVPN Help Docs (these are likely already open if you’re using a macOS Server to provide VPN services):

• PPTP: TCP port 1723
• L2TP: UDP ports 1701, 4500 and 500
• Enable VPN pass-through on the firewall of the server and client if needed

openvpn
There are a number of ways to get a VPN Server installed on macOS. One would be to install openvpn:

sudo port -v install openvpn2
OpenVPN has a lot of sweet options, which you can read about at openvpn.net.
SoftEther
One of the other tools Apple mentioned is SoftEther. I decided not to cover it here because it uses Wine. And I’m not a fan of Wine.
Or Use iVPN
That will require some work to get dependencies and some working with files and network settings. Another option would be to install iVPN from here, on the Mac App Store. You can install it manually as well, and if you do, you’ll need to pay separately through PayPal, which is what we’ll cover here.
Once installed, if you purchased the license separately, use the Enter Manually button to provide it.
At the Registration screen, make sure the name, email, and serial are entered exactly as you see them in the email you received.
At the Thank You screen, click OK.
At the EULA screen, click Accept assuming you accept the license agreement.
Configure iVPN
At the main screen, you’ll have a few options, which we’ll unpack here:

• Use Directory Server: Allows you to use an LDAP or Active Directory connection to provide username and passwords to the service.
• Use custom accounts: Allows you to manually enter accounts to provide username and passwords for clients to connect to the
• Shared Secret: The secret, or a second factor used with L2TP connection.
• Allow 40-bit encryption keys: Allows clients to use lower levels of encryption. Let’s not do this.
• IP Address Range: The beginning and ending IP that will be manually handed out to client computers. When configuring the range, take care not to enter a range of addresses in use by any other DHCP services on your network or you will end up with conflicts.
• Basic DNS: Allows you to configure a primary and second DNS server to send to clients via DHCP when they connect to the VPN interface.
• Advanced DNS: Allows you to configure DNS servers as well as Search Domains.
• Configure Static Routes: Allows you to specify the interface and netmask used to access a given IP.
• Export Configuration Profile: Exports a configuration profile. When imported into a Mac or iOS device, that profile automatically configures the connection to the PPTP or L2TP service you’ve setup.
• VPN Host Name: Used for the configuration profile so a client system can easily find the server w

If you configure Directory Authentication, you’ll get prompted that it might be buggy. Click OK here.
The Directory Authentication screen allows you to choose which directory services to make available to PPTP or L2TP. If the system hasn’t been authenticated to a directory server, do so using the Users & Groups” System Preference pane.
Once you’ve chosen your directory service configuration, if you require a third DNS server, click on Advanced DNS and then enter it, or any necessary search-domains. Click Done when you’re finished.
Click the log button in the upper left-hand side to see the logs for the service. This is super-helpful when you start troubleshooting client connections or if the daemon stops for no good reason (other than the fact that you’re still running a VPN service on macOS Server and so the socket can’t bind to the appropriate network port).
Finally, you can also create a static route. Static routing provides a manually-configured routing entry, rather than information from a dynamic routing traffic, which means you can fix issues where a client can’t access a given IP because it’s using an incorrect network interface to access an IP.
Once everything is configure, let’s enter the publicly accessible IP address or DNS name of the server. Client computers that install the profile will then have their connection to the server automatically configured and will be able to test the connection.
Configure Clients

Openvpn Mac Os

If you configured the new server exactly as the old one and just forwarded ports to the new host, you might not have to do anything, assuming you’re using the same username and password store (like a directory service) on the back-end. If you didn’t, you can setup new interfaces with a profile. If you pushed out an old profile to configure those, I’d recommend removing it first if any settings need to change. To configure clients, we’ll install the new profile. When you open the profile on a client system (just double-click it to open it), you’ll see the Install dialog box. Here, click on Continue.
Because the profile isn’t signed, you’ll then get prompted again (note: you can sign the profile using another tool, like an MDM or Apple Configurator). Click Continue.
Then enter the username that will be used to connect to the VPN and click the Install button.
The Profile can then be viewed and manually removed if needed.
Click on the new iVPN entry in the Network System Preference pane. Here, you can enable
Now that it’s easy, let’s click the VPN icon in the menu bar and then click on Connect iVPN to test the connection.
Once clients can connect, you can use the iVPN icon in the menu bar to monitor the status of clients.