Tunnelblick Launches at Startup (Login)

This is related to VPN Details Windows Appears at Startup (Login).

Some users find that Tunnelblick runs when they don't expect it to or they don't want it to.

That is probably because Tunnelblick does not use the standard macOS "Open at Login" ("Login Items") mechanism to control its behavior. (See Why and How Tunnelblick Doesn't Use Login Items below.)

Instead, Tunnelblick is launched at login:

• If it was running when you last logged out; or
• If it detects a VPN either connected or in the process of connecting; or
• If it had previously disabled all network access.

On other words:

• If you quit Tunnelblick after using it, it should not launch when you next login or start your computer.
• If you leave Tunnelblick running, it will launch when you next login.

If this is not the behavior you are experiencing, please see Troubleshooting below or ask for help on the Tunnelblick Discussion Group.

To Stop Tunnelblick from Launching on Login

You cannot stop Tunnelblick from launching on login if it detects an active VPN on login or if it had previously disabled network access unless you uninstall Tunnelblick (see Why and How Tunnelblick Doesn't Use Login Items below for why).

However, you can stop Tunnelblick from launching at login solely because it was running when you last logged out. To do that, copy/paste the following in /Applications/Utilities/Terminal, then press the enter/return key on the keyboard:

    defaults  write  net.tunnelblick.tunnelblick  doNotLaunchOnLogin  -bool  yes

To restore Tunnelblick's normal behavior, copy/paste the following, then press the enter/return key on the keyboard:

    defaults  delete  net.tunnelblick.tunnelblick  doNotLaunchOnLogin

Troubleshooting

First, check to make sure you don't have a Tunnelblick "Login Item".

1. Go to System Preferences : Users & Groups, select the user on the list on the left side of the window, then click on "Login Items" tab on the right side of the window.
2. If you see Tunnelblick, click to select it, then click the minus sign ("-") at the bottom of the list on the left side of the window.

(Note that the checkbox next to the application name is for "hiding" the application after it launches -- it is not for making the application launch at login.)

Second, check that you do not have an active VPN:

1. Launch /Applications/Utilities/Activity Monitor.
2. Click "View", then "All Processes".
3. Click on the "Process Name" header to sort the list by process name.

If you see a process named "tunnelblick-helper", that indicates that a VPN is being connected. If you see a process named "openvpn", it means that a VPN is being connected or is connected.

If you don't have Tunnelblick login items, and you don't have a process named "tunnelblick-helper" or "openvpn", ask for help on the Tunnelblick Discussion Group. Please include the output of the following Terminal commands in your post (you can copy/paste; it all goes on one line):

ps -ef | grep -w openvpn | grep -v grep ; ps -ef | grep tunnelblick-helper | grep -v grep

Why and How Tunnelblick does not Use Login Items

Tunnelblick doesn't use "Login Items" because we think it is important that users are shown an indication that a VPN is active when they log in (if one is active, of course). The indication is that Tunnelblick launches, and that it displays a connecting or connected icon. A VPN may be active because a VPN configuration is set up to connect when the computer starts, or because a different user logs into the computer while another user has connected to a VPN, or because of a crash of Tunnelblick or one of its components, or for some other reason.

Login items also don't allow Tunnelblick to launch at login if it had previously disabled all network access. That's important so it can ask the user if network access should be reenabled.

To ensure that is done, the Tunnelblick installer sets up macOS to run a very short script once each time a user logs in. The script decides whether or not to launch Tunnelblick, does so if necessary, and then quits. The script has little impact on the time to startup or login (on a five-year-old MacBook Pro the script uses 0.293 seconds of CPU time and very little I/O).

Another reason Tunnelblick doesn't use "Login Items" is that most users don't have Tunnelblick in the Dock (where it is easy to make it a Login Item by clicking "Options" : "Open at Login"). Instead, they leave Tunnelblick running all the time to make it easy to connect a VPN. When there is no active VPN, Tunnelblick uses few computer resources.