Tunnelblick on macOS High Sierra and macOS Mojave

Important: See The Future of Tun and Tap VPNs on macOS for information about changes to future versions of macOS.

The following is the current status of issues that have been seen using the latest version of Tunnelblick on macOS High Sierra and macOS Mojave.

To report an issue, please follow the instructions at Tunnelblick Issues.

Tunnelblick's Tun and Tap system extensions do not load.

If you see a message similar to one of the following:

Tunnelblick was not able to load a device driver (kext) that is needed to connect...

Tunnelblick was not able to load a system extension that is needed to connect...

You may have encountered a new security feature in High Sierra and higher which restricts the loading of system extensions (previously called "kexts" by Apple).

If you are using a Tun VPN, you can — and should — modify your OpenVPN configuration file so it will work without the "Tun" system extension and avoid this problem. See Errors Loading System Extensions for instructions.

Screenshot of window with title 'System Extension Blocked' saying 'A program tried to load new system extension(s) signed by (blocked-by-red area). If you want to enable these extensions, go to the Security & Privacy System Preferences pane.'

(Tunnelblick's system extensions are signed by "Jonathan Bullard", so that's what would appear in the blocked-by-red area of the window.)

You then have 30 minutes to allow the new system extension to be loaded. As the window notes, that can be done on the "Security & Privacy" pane of "System Preferences". (The window doesn't say it, but it can only be done on the "General" tab of that pane.) Here is a screenshot:

Screenshot of the 'General' tab of the Security & Privacy System Preferences pane with a section reading 'system software from developer (blocked-by-red area) was blocked from loading' and an 'allow' button.'

(The "System software developer" in the blocked-by-red area will be "Jonathan Bullard" for Tunnelblick system extensions.)

If the user doesn't grant approval within 30 minutes, the ability to approve the system extension disappears and will only reappear after trying to connect the VPN again. When that happens, the original window does not appear (it is only shown once) but the ability to approve the system extension reappears in "System Preferences" for 30 more minutes.

If the above does not help, please see Errors Loading System Extensions for some other reasons that Tunnelblick is not able to load Tun and Tap system extensions.