Problems Loading Kexts on macOS 10.14.5
Tunnelblick may try to load a kext to control the VPN tunnel.
Note 1: If you are using a "tun" VPN, you can avoid needing to load a kext by making sure your configuration file does not include a "dev-type tun" option (it should include a "dev tun" option). The "dev-type tun" option causes OpenVPN to use a "tun" device, which requires a kext to be loaded. If a "dev-type tun" option is not present, OpenVPN will use the "utun" device which is built into macOS 10.6.8 and higher and does not require a kext to be loaded. If you are using a "tap" VPN, you cannot avoid needing to load a system extension.
Note 2: If you are NOT running on macOS 10.14.5 Beta 2_ or higher, please see Errors Loading Kexts (Device Drivers) on macOS High Sierra (10.13) and higher and Errors Loading Kexts (Device Drivers).
If you see the following on macOS 10.14.5 Beta 2 and higher:
Tunnelblick was not able to load a device driver (kext) that is needed to connect...
You may have encountered a new macOS restriction on loading kexts.
If the rest of this page does not help, it is probably a different problem. Please see Errors Loading Kexts (Device Drivers) on macOS High Sierra (10.13) and higher and Errors Loading Kexts (Device Drivers).
Tunnelblick's Tun and Tap kexts sometimes cannot be loaded on macOS 10.14.5 Beta (18F108f). This was reported in Tunnelblick GitHub Issue #527.
On April 9, 2019, Apple changed this comment to :
This newly-announced feature of 10.14.5 is present in the latest beta (10.14.5 Beta (18F108f)).
The solution for Tun kexts is to stop using them and use the built-into-macOS "utun" driver. You can do this by removing any "dev-type tun" options in your OpenVPN configuration files, and making sure there is a "dev tun" option. This will cause Tunnelblick to not load its own Tun kext, and cause OpenVPN to use the system's "utun" driver instead. (If you have changed Tunnelblick's settings so that it will "always load" the Tun kext, you must also change that setting back to the default "load automatically" or to "never load").
If you have ever used Tunnelblick 3.7.8 or 3.7.9beta05 to connect a Tap configuration on your system, you can update to new versions of Tunnelblick after 3.7.9beta05, including 3.7.9 (which has not yet been released as of 2019-04-20). These releases will include the kexts from Tunnelblick 3.7.8 and 3.7.9beta05, which will not be considered "new", so macOS 10.14.5 will allow them to be used.
If you have used another version of Tunnelblick to connect a Tap configuration on your system, you should continue using whatever version of Tunnelblick that had successfully loaded kexts on an earlier version of macOS. If you have upgraded to a later version of Tunnelblick, you must revert to that earlier version from Tunnelblick's Deprecated Downloads page.
You cannot use a Tunnelblick Tap VPN on a "clean install" of macOS 10.14.5. Perhaps you can find and load a notarized kext from another source.
Tunnelblick developers are working on creating a release that includes a notarized kexts, but it is not known when such a release will be available, if ever.
Last updated 2019-04-20 14:00 UTC.