Errors Loading System Extensions
Important: See The Future of Tun and Tap VPNs on macOS for information about changes to future versions of macOS.
Tunnelblick may try to load a system extension to control the VPN tunnel. (Note: Apple previously used the terms "kext" and "kernel extension" but now uses the term "system extension".)
Note: If you are using a "tun" VPN, you can avoid needing to load a system extension by doing the following:
The "dev-node tun" option causes OpenVPN to use a "tun" device, which requires a system extension to be loaded. If a "dev-node tun" option is not present and a "dev tun" option is present, OpenVPN will use the "utun" device which is built into macOS and does not require a system extension to be loaded.
(If you are using a "tap" VPN, Tunnelblick must load a system extension for your VPN to operate.)
If you see a message similar to one of the following:
Tunnelblick was not able to load a device driver (kext) that is needed to connect...
Tunnelblick was not able to load a system extension that is needed to connect...
There are two possible causes for this message:
(1) Your version of macOS did not allow the system extension to load or you did not give permission for the system extension to load:
(2) There may be incompatible system extensions already loaded. Recent versions of Tunnelblick try to be "good citizens" by loading system extensions only when needed, and unloading them when they are no longer needed. However, some other VPN clients (CiscoAnyConnect SSL VPN, for example) load their own, incompatible system extensions when the computer is started and leave them loaded, whether or not a VPN connection is in use. (Some non-VPN software also loads incompatible system extensions — for example, Pogoplug loads a "com.pogoplug.xcetun" tun system extension which interferes with Tunnelblick's tun system extension. "Security" programs also may load incompatible system extensions.)
To find out if an incompatible system extension is causing the problem, use the
To unload system extensions and allow Tunnelblick to load its own system extensions, use the
(The "sudo" is necessary because this command modifies the loading of a device driver. You will be asked for your administrator password, which will not appear (even as asterisks) when you type it.)
If you find that restarting your computer reloads the system extension you might need to find where it is being loaded from. Common locations are
There are user-contributed scripts on the Downloads page that will automatically unload the Cisco system extension when Tunnelblick makes a connection, and reload the Cisco system extension when the connection is disconnected.