Highlighted Articles
News
Installing Tunnelblick
Uninstalling Tunnelblick
Setting up Configurations
Using Tunnelblick
Getting VPN Service
Common Problems
Configuring OpenVPN
Release Notes
Thanks
FAQ

Discussion Group
Read Before You Post

If you are using macOS 11 Big Sur, you should use the latest beta version of Tunnelblick. You should enable Tunnelblick to automatically check for updates to the latest beta version (on the 'Preferences' panel of Tunnelblick's 'VPN Details' window). You can also download the latest beta from Tunnelblick Downloads.

The following is the current status of issues that have been seen using the latest beta version of Tunnelblick on beta and release versions of macOS Big Sur.

To report an issue, please follow the instructions at Tunnelblick Issues. Please include the build number of macOS Big Sur under which the problem occurs. To get the build number, click on the small Apple icon at the top left corner of the screen and then click 'About This Mac'. A window will appear with information about your computer. The build number is the string of numbers and letters that appears in parentheses after 'Version 11'. You may need to click on 'Version 11' to see the build number.

Tunnelblick's Tun and Tap system extensions do not load.

If your configuration requires a 'tun' or 'tap' system extension, connecting to your VPN will fail if an appropriate system extension is not loaded.

macOS Big Sur 11.0 Developer Beta 10 (20A5323l) does not allow Tunnelblick to load its 'tun' or 'tap' system extensions. Apple says that as a workaround 'during development' you can temporarily disable System Integrity Protection to allow these system extensions to load when logged in as an Admin user. This workaround may not work in the first release version of Big Sur — see The Future of Tun and Tap VPNs on macOS.

Note: If you are using a 'tun' VPN, you can modify your OpenVPN configuration file so it will work without the 'tun' system extension. See the note at the start of Errors Loading Kexts (Device Drivers).

Tunnelblick disables loading of Tun and Tap system extensions.

When running on Big Sur, Tunnelblick Beta 3.8.4beta01 and higher force the settings on Tunnelblick's 'Advanced' settings window to 'never load' system extensions. You can override that behavior and allow the settings to act normally, which is useful if you have disabled SIP and/or your version of Big Sur allows Tunnelblick to load the system extensions. You can override the behavior by executing the following command in Terminal:

The override can be removed by executing:

FIXED IN Tunnelblick 3.8.3beta03: Tunnelblick refuses to run.

Tunnelblick versions earlier than 3.8.3beta03 refuse to run on macOS Big Sur 11.0 Developer Beta 3 (20A5323l), complaining that the '/tmp' folder is not secure. Tunnelblick 3.8.3beta03 includes a fix for this problem.

WON'T FIX: Sidecar does not work when a VPN is connected using Tunnelblick's default for a configuration.

(This issue is not specific to Big Sur. It is present in all versions of Sidecar.)

Sidecar does not work if IPv6 is disabled. By default, Tunnelblick disables IPv6 while a VPN is connected. This is done to prevent information leaks in common VPN setups (see A Glance through the VPN Looking Glass: IPv6 Leakage and DNS Hijacking in Commercial VPN clients).

To fix this problem:

1. Verify with your VPN service provider that no information is leaked if IPv6 traffic is allowed. If you cannot confirm that, you should not proceed and you will not be able to use Sidecar when your VPN is connected.
2. Launch Tunnelblick.
3. Click the Tunnelblick icon in the menu bar and then click 'VPN Details'.
4. Click on the large 'Configurations' button at the top of the window.
5. Select the configuration(s) you wish to modify.
6. Remove the check from 'Disable IPv6 unless the server is accessed via IPv6'.

(This page was updated 2020-07-16.)

Highlighted Articles
News
Installing Tunnelblick
Uninstalling Tunnelblick
Setting up Configurations
Using Tunnelblick
Getting VPN Service
Common Problems
Configuring OpenVPN
Release Notes
Thanks
FAQ

Discussion Group
Read Before You Post

To use Tunnelblick you need access to a VPN server — your computer is one end of the tunnel and the VPN server is the other end.

The Tunnelblick project does not provide access to VPN servers — we are not 'VPN service providers'
— we only create the free software that many VPN service providers recommend or provide to their clients.

There are several ways to get access to a VPN server:

• Your employer may provide a VPN server so you can work from home or the road securely.
• You can set up your own VPN server at home, and use it to access your home network and the Internet securely when at a remote location. The VPN server could be a program running on a Mac, Windows, or Linux computer, or on your home router.
• You can get (free or for a fee) access to a VPN server by using a VPN service provider.

Employer-provided VPN Servers

Your employer should supply you with an OpenVPN configuration file (.ovpn or .conf file), along with the appropriate certificate and key files, or with a Tunnelblick VPN Configuration (.tblk), which includes the certificate and key files within it.

Follow the instructions from your employer or in Installing Tunnelblick to install Tunnelblick and configurations.

Set Up Your Own VPN Server

This is more complicated. It involves creating your own OpenVPN configuration file and creating your own certificate and key files for encryption. There are tutorials about setting up OpenVPN servers — try searching the Internet for 'set up openvpn server'. Tunnelblick includes 'easy-rsa' to help you with creating certificate and key files; there is an 'Open easy-rsa in Terminal' button on the Utilities panel. Instructions on using easy-rsa to create encryption files are available in the OpenVPN FAQ.

If you want to set up a computer to act solely as a router/bridge/firewall, consider ZeroShell. Untangle has a free VPN component.

If you have a router running DD-WRT, you can use OpenVPN on DD-RT. There is a tutorial.

If you want to run an high-performance OpenVPN server 'in the cloud', see Create a Private OpenVPN Service with AWS Client VPN Endpoint [github.com].

If you want to run an OpenVPN server 'in the cloud' which also does ad blocking, take a look at the instructions at Pi-Hole and PiVPN on Google Compute Engine Free Tier with Full Tunnel and Split Tunnel OpenVPN Configurations. (Note that the instructions download and install pi-hole and piVPN by piping from curl to bash. A better practice is to download the install scripts, examine them for problems, and then run the already-examined scripts.)

VPN Service Providers

Another way to get access to a VPN server is to use a VPN service provider, an organization that makes its VPN servers available (free or for a fee). Some provide you with a customized, and possibly renamed, version of Tunnelblick.

VPN service providers: email webmaster@tunnelblick.net to be listed on this page.

Disclaimer: The products, services, and links on this page are not endorsed or recommended by the Tunnelblick project or its developers. This list is offered solely for the convenience of those wishing to use Tunnelblick.