tunnelblick icon Tunnelblick free software for OpenVPN on macOS We need translators for several languages…
Home Downloads Support Documents Issues Source Contribute Contact

Highlighted Articles
  Installing Tunnelblick
  Uninstalling Tunnelblick
  Setting up Configurations
  Using Tunnelblick
  Getting VPN Service
  Common Problems
  Configuring OpenVPN
  Release Notes

Discussion Group
  Read Before You Post

Problems Loading Kexts on macOS 10.14.5

Tunnelblick may try to load a kext to control the VPN tunnel.

Note 1: If you are using a "tun" VPN, you can avoid needing to load a kext by making sure your configuration file does not include a "dev-type tun" option (it should include a "dev tun" option). The "dev-type tun" option causes OpenVPN to use a "tun" device, which requires a kext to be loaded. If a "dev-type tun" option is not present, OpenVPN will use the "utun" device which is built into macOS 10.6.8 and higher and does not require a kext to be loaded. If you are using a "tap" VPN, you cannot avoid needing to load a system extension.

Note 2: If you are NOT running on macOS 10.14.5 Beta 2_ or higher, please see Errors Loading Kexts (Device Drivers) on macOS High Sierra (10.13) and higher and Errors Loading Kexts (Device Drivers).

If you see the following on macOS 10.14.5 Beta 2 and higher:

Tunnelblick was not able to load a device driver (kext) that is needed to connect...

You may have encountered a new macOS restriction on loading kexts.

If the rest of this page does not help, it is probably a different problem. Please see Errors Loading Kexts (Device Drivers) on macOS High Sierra (10.13) and higher and Errors Loading Kexts (Device Drivers).

Tunnelblick's Tun and Tap kexts sometimes cannot be loaded on macOS 10.14.5 Beta (18F108f). This was reported in Tunnelblick GitHub Issue #527.

This is caused by a sudden and unexpected change by Apple. The earlier (January 13, 2019) version of Apple's Notarizing Your App Before Distribution said [1]:

In macOS 10.14, notarizing your software is optional, but recommended. In a future version of macOS, notarization will be required.

On April 9, 2019, Apple changed this comment to [2]:

Beginning in macOS 10.14.5, all new or updated kernel extensions and all software from developers new to distributing with Developer ID must be notarized in order to run.

This newly-announced feature of 10.14.5 is present in the latest beta (10.14.5 Beta (18F108f)).

Tun Kexts

The solution for Tun kexts is to stop using them and use the built-into-macOS "utun" driver. You can do this by removing any "dev-type tun" options in your OpenVPN configuration files, and making sure there is a "dev tun" option. This will cause Tunnelblick to not load its own Tun kext, and cause OpenVPN to use the system's "utun" driver instead. (If you have changed Tunnelblick's settings so that it will "always load" the Tun kext, you must also change that setting back to the default "load automatically" or to "never load").

Tap Kexts

If you have ever used Tunnelblick 3.7.8 or 3.7.9beta05 to connect a Tap configuration on your system, you can update to new versions of Tunnelblick after 3.7.9beta05, including 3.7.9 (which has not yet been released as of 2019-04-20). These releases will include the kexts from Tunnelblick 3.7.8 and 3.7.9beta05, which will not be considered "new", so macOS 10.14.5 will allow them to be used.

If you have used another version of Tunnelblick to connect a Tap configuration on your system, you should continue using whatever version of Tunnelblick that had successfully loaded kexts on an earlier version of macOS. If you have upgraded to a later version of Tunnelblick, you must revert to that earlier version from Tunnelblick's Deprecated Downloads page.

You cannot use a Tunnelblick Tap VPN on a "clean install" of macOS 10.14.5. Perhaps you can find and load a notarized kext from another source.

Tunnelblick developers are working on creating a release that includes a notarized kexts, but it is not known when such a release will be available, if ever.

1. https://web.archive.org/web/20190113051400/https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution

2. https://web.archive.org/web/20190409053228/https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution

Last updated 2019-04-20 14:00 UTC.

  Deutsch     Français     中文(简体)     Русский     Español     日本語     …