Tunnelblick on macOS High Sierra and macOS Mojave
Important: See The Future of Tun and Tap VPNs on macOS for information about changes to future versions of macOS.
If you are using macOS High Sierra or Mojave, you should use the latest version of Tunnelblick. You should allow Tunnelblick to automatically check for updates on the "Preferences" panel of Tunnelblick's "VPN Details" window.
The following is the current status of issues that have been seen using the latest version of Tunnelblick on macOS High Sierra and macOS Mojave.
To report an issue, please follow the instructions at Tunnelblick Issues.
Tunnelblick's Tun and Tap system extensions do not load.
If you see a message similar to one of the following:
Tunnelblick was not able to load a device driver (kext) that is needed to connect...
Tunnelblick was not able to load a system extension that is needed to connect...
You may have encountered a new security feature in High Sierra and higher which restricts the loading of system extensions (previously called "kexts" by Apple).
If you are using a Tun VPN, you can — and should — modify your OpenVPN configuration file so it will work without the "Tun" system extension and avoid this problem. See Errors Loading System Extensions for instructions.
(Tunnelblick's system extensions are signed by "Jonathan Bullard", so that's what would appear in the blocked-by-red area of the window.)
You then have 30 minutes to allow the new system extension to be loaded. As the window notes, that can be done on the "Security & Privacy" pane of "System Preferences". (The window doesn't say it, but it can only be done on the "General" tab of that pane.) Here is a screenshot:
(The "System software developer" in the blocked-by-red area will be "Jonathan Bullard" for Tunnelblick system extensions.)
If the user doesn't grant approval within 30 minutes, the ability to approve the system extension disappears and will only reappear after trying to connect the VPN again. When that happens, the original window does not appear (it is only shown once) but the ability to approve the system extension reappears in "System Preferences" for 30 more minutes.
If the above does not help, please see Errors Loading System Extensions for some other reasons that Tunnelblick is not able to load Tun and Tap system extensions.