Frequently Asked Questions

VPN Tracker Pro is a great asset if you are a consultant, a system or network administrator, or are working with multiple VPN connections:

• Export VPN connections for yourself and other users.
• Scan the remote network for services or to assist users.
• Connect to multiple VPNs at the same time.
• Manage a large number of VPNs using search, a condensed layout, and connection groups.
• Configure your Mac as a router to provide the entire network with a VPN tunnel using Network to Network connections.

By itself, the IPsec protocol does not support usernames. If you were given a username from your network administrator for connecting to your corporate VPN solution, there are generally two possibilities:

• Your corporate VPN solution uses the term "username" for "identifiers". Please try to use your username as the "Local Identifier" in VPN Tracker.
• Your corporate VPN solution is using Extended Authentication (XAUTH). You can enable XAUTH in VPN Tracker. The software will then prompt for your username and password when the connection is being established.

We ask for your email address in order to track the flow of our downloads and, if selected, send you news and updates about the product you've downloaded.

All information collected by equinux is used internally and will never be shared with any third parties without your permission. For more information about equinux's stance on privacy and security, please refer to the equinux Privacy Policy.

If you do not want to receive our newsletter, just unsubscribe using the link at the bottom of every newsletter you receive.

Yes, as long as your VPN gateway uses Extended Authentication (XAUTH) to request the passcode, you can use any third party token with VPN Tracker.

• macOS 15.0 Sequoia
• macOS 14.0 Sonoma
• macOS 13.0 Ventura
• macOS 12.0 Monterey
• macOS 11.0 Big Sur
• macOS 10.15 Catalina
• macOS 10.14 Mojave
• macOS 10.13 High Sierra

Yes, this is possible. If you set up shared networking for the guest operating system it shares the network connection of your Mac and you can access all network resources that are accessible from OS X.

Note that if you are using remote DNS for your VPN connection, you will need to manually enter the DNS server in your guest operating system in order for it to work – there is no way for VPN Tracker to “transmit” this setting to the guest operating system

For information on how to set up VPN Tracker with Parallels, check out our VPN Tracker with Parallels Configuration Guide.

Unfortunately, we cannot guarantee this. Secure networking is a complex subject. VPN Tracker is extremely reliable and is used by customers around the world. But there are some rare scenarios in which VPN connections cannot be established (e.g. when a firewall is set up to actively block VPN connections).

We recommend using the free trial version to test VPN Tracker with your particular network and usage scenario.

If you require any assistance setting up your VPN connection with VPN Tracker, you can contact equinux support at any time.

A couple of years ago, a team of security experts released a paper describing an attack that can break an IKEv1 Aggressive Mode Pre-Shared Key connection using an attack that would not equally have been possible with an IKEv1 Main Mode Pre-Shared Key connection, leading to the incorrect assumption that Aggressive Mode is inherently insecure. This claim, however, is not backed up by objective facts. What most people don't know, part of that attack was the ability to guess the Pre-Shared Key (PSK) using a brute force attack and such a brute force attack can only be successful if the PSK is weak. A PSK is also just a password and as with every password, choosing a weak password always leads to poor security. As long as your PSK is at least 14 characters long (the longer the better), consists out of lower case letters, upper case letters and digits, and was randomly generated, so it's impossible to somehow guess it, and as long as your Phase 1 hash algorithm is at least SHA1 (or better, we recommend SHA-256 if possible), there's absolutely no reason to consider IKEv1 Aggressive Mode with Pre-Shared Key as less secure than IKEv1 Main Mode with Pre-Shared Key. If you want to be even more secure, switch to certificate based authentication instead of PSK if possible as then the attack is not possible at all.

Technical background:

The Pre-Shared Key (PSK) is not a password used for encryption of any data, it's used for authentication, just when you log in to a website using a username and a password. During Phase 1, both sides must prove to each other to know the PSK. This cannot be done by just sending it to the other side, as if the other side didn't know it before, it will know it after receiving it. Instead both sides calculate a number (a hash digest) out of data they exchanged so far (data that will be different every time you start a new connection, which ensures the calculated value will be as well) and the PSK. Only this digest is send to other side. The other side can now verify that digest by performing the same calculations and comparing the result with the digest received. If both are equal, the sender must have used the same PSK in the calculation, which proves knowledge of the PSK. Then the receiver also calculates such a digest, using a slightly different formula as before, leading to an entirely different result, and sends it back in reply to also prove its knowledge.

The differences between Main Mode and Aggressive Mode is simply that in Main Mode the digest is exchanged encrypted because the session key exchange already negotiated a session encryption key when the digest is exchanged, whereas in Aggressive Mode it is exchanged unencrypted as part of the key exchange that will lead to a session key. By snooping the connection establishment of an Aggressive Mode connection, the attackers were able to get the digest as well as all values required to calculate that digest, except for the PSK itself. Please note that this alone doesn't mean the connection is broken already, it only means that the attackers now have enough data to start guessing the PSK using a brute force or dictionary attack. Only if the PSK is too weak to withstand those attacks and the attackers are able to correctly guess it, the connection will be broken. That's why a good, secure PSK is essential.

The same attack is in fact also possible with a Main Mode PSK connection, it just requires some extra work. For a Main Mode connection it's not enough to just snoop the traffic, the attackers would need to perform a so called Man-in-the-Middle (MitM) attack, allowing them to capture and manipulate all traffic exchanged. By performing a MitM attack, attackers can break the key exchange and thus will be able to decrypt all the exchanged packets. Doing so will not make it possible to break into your VPN, they still need to know the PSK for that, otherwise they cannot successfully authenticate to the other side and then Phase 1 will never complete, but that way they can get all the information required to start guessing on the PSK, just as in case of a an Aggressive Mode connection. And if an attacker is already able to snoop on your VPN traffic (which is required to attack Aggressive Mode), it's very likely that attacker is equally possible to perform a MitM attack and in that case using Main Mode will not offer you any additional protection.

A PSK out of 11 random alphanumeric characters offers an entropy of approx. 64 bits, that's 2^64 possible values. Modern high end graphics adapter (as of 2015) can calculate in the order of 1 billion SHA-256 hashes a second. On average one has to try 50% of all possible values to find a match, wich would be about 292 years. Yet if the attackers have an array of 100 such graphics adapters, it would "only" be around 3 years. If the PSK is 14 characters, the entropy is about 80 bits and you are already at 19,154,798 years. Now even having 10,000 graphics adapters would help a lot. Also one must consider the costs of such an attack, which is not so much the cost of buying all these graphics adapters, rather their power consumption when all these graphics adapters run at maximum current 24 hours a day and that for years, decades, or even centuries. The power costs will be billions of dollar and all that to just break one single PSK connection in the entire world. And whenever you change the PSK, an attacker must start all over, so if you change the PSK regularly, let's say once a year, an attacker has at most one year to find it; that's very ambitious, even for a weak PSK.

Symptom

As soon as you connect your VPN tunnel, Skype is not able to make calls any longer, however calls started prior to connecting the VPN continue to work.

Solution

Make sure the field Local Address is not empty. If it is, fill in a private IP address. A private IP address has the following form:

• 192.168.x.x
• 10.x.x.x
• 172.y.x.x

x: A number of the range 0 to 255.
y: A number of the range 16 to 31.

Only rule: It must not be an IP address from a remote network on the other side of the VPN tunnel (must not partially match an entry of the field "Remote Networks"), as choosing such an address will make the tunnel stop working (it will connect, but you cannot really reach anything over it).

Alternate Solutions

If the solution above does not fix your issues, make sure that

• DNS resolution still works once the VPN tunnel is up.
   
• Public Internet servers are still reachable once the VPN tunnel is up.
   
• In case of a Host to Everywhere connection, make sure the VPN gateway does not block any network traffic that is crucial for Skype to work.
   

Explanation

VPN Tracker creates a virtual tunnel interface for every VPN tunnel. Like any network interface, this virtual tunnel interface requires an IP address to be functional as an IP network interface. If your VPN gateway assigns you an IP address, the assigned address is applied to the tunnel interface. If not, the address you put into Local Address will be used. If you leave local address empty, the IP address of your primary network interface will be used.

In the last case, your system ends up with two interfaces with identical IP addresses. This is allowed and usually not a problem, unless a software does “stupid things”, like querying the network interface for a given IP address and then ignoring the order of precedence of the returned results.

Important Notes

Don't worry – it happens to all of us!

Just head on over to our login retrieval page, enter your equinux ID or email address and we'll send you your details.

Recently changed your e-mail address? Send us a message!

With both SMB (Windows File Sharing) and AFP (Apple File Sharing), low latency connections are key to achieving good performance. This is of course assuming that you already have a connection with reasonable bandwidth in between the two VPN endpoints (this can be easily verified by transferring a larger file through HTTP or FTP).

Using SSL VPN? Switch to IPSec

In comparison to SSL VPN, IPSec is able to offer much faster connection speeds as it runs on the network layer – level 3 of the OSI – meaning it’s much closer to the physical hardware. This will give you a faster VPN performance.

Learn more in this blog post.

Finder Settings

If you are using the Finder and the issue is mostly with listing folders (but not so much when actually copying files), try turning off icons/icon previews in the Finder's View Options (Cmd-J).

Reducing Latency

If you experience performance issues both when listing folders and when transferring files, your aim should be to reduce latency. Some ways to reduce latency include:

• Avoid high-latency Internet uplinks (e.g. satellite, some types of wireless providers, line aggregation, ...).
• When using a DSL line, see with your ISP if you can get "fast path" enabled (= interleaving turned off). ISPs sometimes market this as an option for online gaming, but it's also very helpful for AFP/SMB or connecting to some types of database backends.
• Make sure VPN traffic is appropriately prioritized in order not to be slowed down by someone else using the same Internet connection.

To measure latency between the two endpoints of the VPN, use ping to a host on the other end of the connection (or, when pinging from the client end, ping the VPN gateway). For your convenience, VPN Tracker has a ping utility built right in, it can be found in the Tools menu.

To measure latency of each endpoint's individual uplink, it's often helpful to do a ping the local router (to make sure there are no unnecessary latencies introduced in the local network) and the ISP's first router (to get an idea if enabling fast path or switching ISPs may be a suitable measure to decrease latency).

If you cannot reduce latency any further:

If you are in a situation where you cannot reduce latency any further (or where the base latency from the distance between the two endpoints itself is so large local measures won't make much difference), consider switching to a file transfer protocol that is less vulnerable to latency, e.g. WebDAV or FTP, or use measures such as reducing the number of files and folders in a hierarchy to increase performance.

Current Firmware (Fireware XTM)

WatchGuard Firebox X Edge e-Series devices with Fireware XTM (Fireware 11) are fully supported in current versions of VPN Tracker. For details please see our configuration guide.

Older Firmware

Devices running an older firmware may often work using the following setup. Please note however that we can't guarantee that this setup will work in all cases.

Start by creating a new user on the Firebox Edge and then configure MUVPN support for this user.

In VPN Tracker, use a "Custom Connection" device profile as the basis for your new connection.

Map the WatchGuard settings to your VPN Tracker configuration as shown in the table below:

The following settings are independent of your specific MUVPN configuration:

• Local Identifier Type: Email (even if it is a name and not an email address)
• Exchange Mode: Aggressive
• Phase 1 Diffie-Hellman Group: Group 2 (1024 bit)
• Perfect Forward Secrecy (PFS): off

Finally make sure the that VPN Tracker's "Network" setting is set to "Host to Network", and the correct Remote Network (i.e. the network that you want connect to through the VPN) is used (e.g. 192.168.1.0/255.255.255.0).

VPN Tracker for Mac fully supports all the latest macOS versions, including macOS Sequoia

Starting from macOS 11, Apple have made some key changes to the macOS security architecture. VPN Tracker for Mac offers full support for all the latest macOS versions. This includes support for: IPsec VPN, IKEv2 (Beta), OpenVPN, L2TP VPN, PPTP VPN, SonicWall SSL VPN, Fortinet SSL VPN, Windows SSTP VPN, Cisco AnyConnect VPN and WireGuard® VPN.

Tip: Sign up for VPN Tracker Insider Updates to get Beta releases as soon as they are available.

WireGuard® is a registered trademark of Jason A. Donenefeld.

Find your PPTP VPN connection settings in the Control Panel of your Windows PC
Start VPN Tracker 365 on your Mac and click the "+" to create a new PPTP connection
Copy the connection settings from the first step into the configuration window
Finally, start up your PPTP connection to test

If you are an existing VPN Tracker customer and want to upgrade to VPN Tracker 365, you can simply install VPN Tracker 365 and your connections will automatically be imported:

Download VPN Tracker 365

Once you have VPN Tracker 365, you can purchase a VPN Tracker 365 plan.

Open the VPN Tracker 365 app and go to "VPN Tracker 365" > "Preferences"
Next to "Update", check the box "Get early access to Pre-Release versions"
From the drop down menu, select "Beta versions"

Your equinux ID is your personal account at equinux. You can use it to purchase and activate products & licenses.

The first time you shop in our online store, you'll be asked to create an equinux ID. After your purchase, software licenses are automatically linked to your equinux ID and can be activated by simply entering the same equinux ID and password you used during purchase.

Retail boxes and certain products may still require an Activation Code. Once entered, the product will be linked to your equinux ID.

If you have forgotten your equinux ID and/or password, use our login & password retrieval form.

If you need to transfer a license to another equinux ID, you can easily do this yourself at my equinux.

‣ First log in with your equinux ID and password: http://my.equinux.com
‣ Click the checkboxes for each product that you want to transfer
‣ Click the "Transfer" button below and enter the equinux ID or email address of the new license owner and click next.       
‣ Finally click "Confirm" to complete the transfer. The system will transfer the license, display a message and email both the old and new license owner that the license has been transferred.

1. Open VPN Tracker and add a new WireGuard® connection
2. Upload your WireGuard® configuration file or scan your QR code
3. Save your connection to your account using secure end-to-end encryption

SonicWALL Simple Client Provisioning with VPN Tracker is available with all SonicWALLs running SonicOS 4.0 or newer and all editions of VPN Tracker.

If you are still using VPN Tracker 6 or earlier, Professional or Player Edition is required.

Double click the connection file to import into VPN Tracker 365.
Enter the import password - your network admin will give this to you.
Now, click the toggle switch to connect to your VPN. Note: If you are asked  to enter user credentials, your admin will tell you which login you need to use.

When connecting via SonicWall SCP or SonicWall IKEv1 with DHCP, VPN Tracker 365 for Mac requests an IP address from the SonicWall gateway using the DHCP protocol. For this request, VPN Tracker 365 modifies the MAC address slightly, making it different from the actual MAC address of your device. This allows administrators to assign a fixed IP address when your Mac is connected via LAN or WiFi and a different IP when it’s connected through VPN.

This modification sets a specific bit in the MAC address, marking it as a self-assigned address rather than a factory-assigned one.

Example:
Original MAC address: 00:1B:63:B7:42:23
VPN Tracker MAC address: 02:1B:63:B7:42:23

Starting with macOS 15 Sequoia, Apple defaults to using a rotating MAC address for WiFi connections, labeled as a “Private Wi-Fi Address” in System Settings. To prevent connectivity issues related to this feature, VPN Tracker 365 reports the actual hardware address (with the minor modification described above) instead of the one used in “Rotating” or “Fixed” modes.

On iOS, VPN Tracker cannot retrieve a MAC address directly. Instead, it generates a random value once and stores it for future use. VPN Tracker for iOS then uses this stored value as the MAC address.

• IPsec
• IKEv2 (Beta)
• L2TP (only macOS)
• PPTP (only macOS)
• OpenVPN
• SSTP VPN
• Cisco AnyConnect SSL VPN
• SonicWall SSL VPN
• Fortinet SSL VPN
• WireGuard® VPN

Open the VPN Tracker 365 app and go to "VPN Tracker 365" > "Preferences"
Next to "Update", check the box "Get early access to Pre-Release versions"
From the drop down menu, select "Nightly Builds"

VPN Tracker Personal Safe is secure encrypted cloud storage for your personal VPN connections and shortcuts.

How to save a connection in Personal Safe

Not sure if your VPN connection is backed up? The safe icon in the connection list indicates whether a connection has been stored in your Personal Safe:

To add a connection to your Personal Safe, simply right click the connection and select 'Add to Personal Safe' for access across all your devices.

Why should I use Personal Safe?
VPN Tracker Personal Safe makes using VPN more reliable and secure:

Security
Personal Safe adds an additional level of security to your connections: all your connection details are encrypted using a highly-secure key (Argon3 + PKTNY) that only you can unlock.

Backup
Lost iPhone? Broken Mac? Personal Safe keeps your connections safe, so you can instantly get them on your replacement device. Sign in with your secure key and they are instantly downloaded and ready to go.

Use your connections on all your devices
iMac at home and iPad for the road? Your Personal Safe keeps your connections synced across all your devices – securely and effortlessly.

How are connections stored?
When you add a connection to your Personal Safe, it is encrypted using your personal encryption keys and then uploaded to a secure cloud storage location. It can only be accessed with your user credentials and encryption key.


Is Personal Safe secure?
Personal Safe has been designed from scratch for VPN connections. Unlike other storage systems that rely on passwords and leave files unencrypted, Personal Safe encrypts all your connections with keys that only you can use.

That means connections are

• Encrypted on your device and
• Stored on encrypted storage at my.vpntracker.com that only you can access

Even if someone could get access to your Personal Safe, the key-based security means they can't access the encrypted connection information without your password.

We've designed the system so no-one (including the VPN Tracker team) can access or unlock your connections.

Configuration guides for configuring VPN Tracker with Cisco devices are available here.

Configuration guides for Cisco Small Business (Linksys) devices are available here.

Import of Cisco IPsec VPN Client Configuration Files (.pcf)

Cisco VPN Client configuration files that use group password authentication can be imported into VPN Tracker:

‣ "File" > "Import 3rd Party Configuration" > "Cisco .pcf"

A Technical Support Report contains your VPN Tracker settings and relevant network and system settings that our technical support team needs to be able to assist you quickly. Confidential data (e.g passwords, pre-shared keys, private keys) are not included in a Technical Support Report (TSR).

How to create a Technical Support Report on a Mac:

‣ Click on your VPN connection in VPN Tracker 365.
‣ In the bottom right corner under the "Status" tab, you will see the TSR button.
‣ Click the button to generate the report and follow the instructions to send to our support team.

‣ Tap on the connection. The connection card appears.
‣ Tap on “Feedback”
‣ Provide a short description of the connection problem
‣ Tap on Send

If you have an issue connecting to the VPN in the first place, please make a connection attempt right before creating the Technical Support Report, then create the Technical Support Report as soon as the connection attempt has failed.

If you can connect to the VPN, but something is not working right after the connection has been established, please establish the VPN connection, then create the Technical Support Report while the VPN is connected.

You can either email the report directly to our support team from VPN Tracker 365, or save it to email later or from a different computer, or to upload it using the contact form on our website:

Whenever possible, also include screenshots of the VPN setup on your VPN gateway.

If your credit card is being refused, please check the following information, for possible mistakes or mismatches :

• Please check the credit card number you have entered carefully for possible typos
• Make sure the expiration date entered is correct
• Check whether the security code you entered matches the code on your card: American Express cardholders can find the 4-digit code on the front of their card, other cardholders can usually find a 3-digit code on the back.
• Try another credit card, if you have access to one
• If you are certain your information is correct and your card is still not being accepted, it might be due to a technical issue with our credit card gateway. Please try again later.

VPN Tracker strictly follows Apple’s recommendation regarding where to place its files, so you will find VPN Tracker files only in standard system locations where they belong. Depending on the fact if these are system-wide or per-user files, they are either found in /Library (system-wide) or ~/Library (per-user), where ~ is a placeholder meaning "home of the current active user".

To access the system-wide library folder:

‣ In Finder Choose "Go" > "Go to Folder ..." 
‣ Enter /Library

To access the user library folder:

‣ In Finder Choose "Go" > "Go to Folder ..." 
‣ Enter ~/Library

Tip: Also remember to check your Keychain for VPN Tracker items (search for "VPN Tracker")

Note: Some of these files may be currently loaded by the system, and some may be cached. To make your system as clean as if VPN Tracker had never been installed on it, you will also need to uninstall the application itself and then reboot your system. After the reboot, the system will automatically remove any remaining VPN Tracker components not mentioned above, as those reference the application itself and will vanish as soon as the application is gone (some of those can otherwise not be deleted).

• VPN Tracker 365: Download here
• An internet connection
• A VPN Router/Gateway

Create a new connection

‣ Click on the plus symbol in the bottom left corner:



‣ Choose: "New Company Connection"

Choose your VPN Router

‣ In the list of VPN Gateway vendors, choose the manufacturer and model of your VPN router. In case your VPN router does not appear in the list, try the following:

‣ Choose "Use custom device profile." 

‣ Click on "Create" to add your VPN connection.

Your configuration guide

Testing VPN throughput using a remote file share is usually not a good idea for two reasons:

The first reason is the file sharing protocol itself. File sharing protocols like SMB, AFP, or NFS have been designed for local networks that are fast, reliable, and have a very low latency. The Internet on the other hand is slow (at least the connection to it), unreliable and has a very high latency. For realistic results, you need to use a protocol that was optimized for such a situation, like HTTP or FTP.

The second reason is the implementation of the file sharing protocol. Today most file shares use SMB, the Windows file sharing protocol. Apple has its own implementation of that protocol but this implementation is anything but good. While the SMB 3.x implementation is already poor, the SMB 1.x/2.x implementation (compatibility mode) is horrible, and for several reasons macOS will often fall back into that compatibility mode. When testing with a local NAS file share, we got 28 MBps using SMB 3 and only 18 MBps using SMB 1, compared to 50 MBps using AFP.

If you have a Mac at the remote side, it’s pretty easy to setup a benchmark HTTP server. All you need is to open the standard application “Terminal” (use spotlight to find it) and then run the following set of commands (every command is confirmed by Return/Enter):

mkdir /tmp/www-bench
cd /tmp/www-bench
dd count=1048576 bs=1024 if=/dev/random of=1GiB.dat
php -S 0.0.0.0:8080

The First command creates a new directory, the second one enters that directory, the third one creates a 1 GiB data file filled with random data, the last one starts a primitive HTTP server that serves the content of the current directory at port 8080. Now your VPN users can just open this address in Safari (or any other browser):

http://a.b.c.d:8080/1GiB.dat

Where “a.b.c.d” is the IP address of the Mac where you just typed the commands above. By watching the transfer speed in browser, you get a good idea of how capable your VPN is. Of course, this is limited by many factors, like the speed of your local Internet connection, the speed of the remote Internet connection, and the CPU power of the VPN gateway (which is usually far less than the CPU power of a Mac).

To clean up after the test, activate the terminal window again and hit CTRL+C to stop the HTTP server, and finally run the following two commands:

cd
rm -r /tmp/www-bench

Option 1: Manual Access:

Open Finder.
Open the "Go" menu.
Choose "Connect to Server..."
Enter the IP address (e.g."192.168...")
Click "Connect".

That's it! Now you have access to your files in Finder for this session. Please note, you will have to carry out these steps each time you need to connect.

Option 2: Creating a Shortcut:
You can also create a shortcut to your server within the VPN Tracker app, meaning it will be saved for whenever you need to access the server.

Go to "VPN Shortcuts" in the app menu.


In the shortcuts section, click on the bottom menu and drag out the File Server icon.


Choose a VPN connection and a server to create your shortcut. If your chosen server does not appear on the list you can also enter it manually.

After you have completed these steps your connection will be saved in the shortcuts section for whenever you need to use it.

This video tutorial shows you how to quickly create a VPN Shortcut to a file server...

• Log in to your account at my.vpntracker.com
• In the Teams view under "Subscriptions", you will see a list of both your active and your expired plans
• To renew an expired plan, please click on: “Reactivate license
• You will then be shown your available plan options

• Grandfathering pricing is exclusively available for customers using the automatic renewal option. If your plan has expired, you can re-obtain VPN Tracker for the current price tier
• After starting your new plan, you will regain full access to your account including your Personal Safe and Team Management features.

http://www.vpntracker.com/interop

For a general introduction to computer networking, VPNs and IPsec, there are several excellent introductions available online or as books, see for example here.

If you experience specific configuration problems, our technical engineers are happy to provide support for setting up VPN connections with VPN Tracker. In many cases, connection problems are related to misconfiguration of either VPN Tracker or the VPN gateway.

If you provide

• A problem description and information on what you've already tried
• A Technical Support Report from VPN Tracker ("Help" > "Generate Technical Support Report")
• Screenshots of the VPN gateway configuration
• A log from the VPN gateway

we can usually quickly spot the cause for a problem and provide advice on how to resolve it.

As there are several factors unrelated to VPN Tracker or the VPN gateway that can influence connectivity (e.g. firewalls/routers in between VPN Tracker and the VPN gateway), we cannot guarantee that a connection can be established under any circumstances.

While we try our best, our support options may be limited if

• you use a device which we did not test ourselves (most devices work just fine with VPN Tracker, though, and we're happy to take a look even at issues with untested VPN gateways)
• you do not provide the information we need in order to assist you (see above)
• your network administrator does not cooperate
• you change connection parameters while we're trying to debug the settings

Recently, root certificates for "Let's Encrypt" expired. Apple has decided not to update root certificates for OS X versions older than macOS 10.12. This means that when apps or Safari on your Mac access websites using Let's Encrypt root certificates, they will not load correctly.

Note: this is a general OS X issue that you will want to address to ensure you can access all websites and services.

This issue also affects the secure communication between VPN Tracker and the my.vpntracker.com account service.

1. Download the latest VPN Tracker version for your system:
   • Mac OS X 10.9 or 10.10: VPN Tracker 365 20.0.1
   • Mac OS X 10.11: Get the latest VPN Tracker 365 version
   
   
2. Install the root certificate fix
• Visit our certificate fix page
• Download the fix
• Open the profile in System Preferences and choose "Install"


3. Re-launch VPN Tracker and sign in again

If you are still experiencing the same problem, please try this:

• Open Safari
• Go to Preferences > Privacy > Manage website data
• Search for 'equinux' and 'vpntracker' and choose 'Remove all'

Older VPN Tracker versions may also have issues due to certifcates as described above. As these versions are end-of-life, we can no longer offer support for them. The steps above should also apply to these versions. For support and to use VPN Tracker on the latest macOS versions, please switch to a new VPN Tracker plan.

Are you seeing a 'Server certificate' error message whilst activating your equinux software?

One likely cause is your system's date & time: Make sure your system clock is set correctly by checking 'Set date & time automatically' under System Preferences > Date & Time.

We also use a fairly new security certificate to protect your data. However, older versions of OS X might not immediately recognize the certificate.

To make sure OS X will recognize the certificate, you could try one of the following two fixes:

Run Software Update

‣ Go to the System Preferences and select "Software Update"
‣ Install any available system updates 
‣ Afterwards, restart and try activating again

Disable your firewall

Please make sure you are not running any firewalls which may block access to our activations server. Applications you may wish to disable temporarily include:

• Mac OS X Firewall
• LittleSnitch (Litte Snitch Configuration - Preferences … - General - Stop)
• Intego NetBarrier

Disable your proxy

In some cases the use of proxies may interfere with certain certificates stored in your Keychain.

‣ Open System Preferences
‣ Go to the "Network" section
‣ Choose your network connection and click "Advanced…"
‣ Uncheck any proxies you may have configured and click "Ok"

Check your Keychain

‣ Open: "Application" > "Utilities" > "Keychain Access" 
‣ Select "Keychain Access" > "Keychain First Aid"
‣ Enter your OS X account password, select Repair on the right and hit Start

Install the root certificate manually

• Download the latest Let's Encrypt root certificates
• Double-click to add the certificate to your Mac's keychain
  Tip: If you have multiple users on the Mac, add it to the 'System' keychain to fix this problem for all users
• Double-click the new entry "ISRG Root X1" to open the trust settings
  
  
  
  
• Under "Trust", choose "Always trust"
  
  
  
  
• Close the window and confirm with your Mac user password

You should now be able to activate your software using your equinux ID and password.

VPN Tracker 9 & VPN Tracker 10

Please go to"Configure" > "Advanced" > "Additional Settings"

• Always prompt for XAUTH credentials is not checked.
  If this option is checked, VPN Tracker will in fact always prompt you, whether it finds credentials in your keychain or not.
   
• Use stored XAUTH password as passcode is not checked.
  If this option is checked, VPN Tracker assumes that the password stored in keychain is in fact a passcode and it will only hand it out to the gateway if the gateway asks for a passcode. If it asks for a password instead, VPN Tracker doesn’t have any such info and thus asks you to please provide one.

Please don't go! :-(

If you're sure that your time with us is at an end then we've made it nice and easy to remove all your info from our database so that you don't need to wait for us to do it.

Just log in at your License Manager, click 'Edit your Account' on the left hand navigation panel and, after a tearful farewell, click 'Delete Account'.

If you do leave then we'd like to say thank you, bye and come back soon!

You can manage all of your VPN Tracker plans after logging in to our website https://my.vpntracker.com using your existing equinux ID and password.

Here you will find all information about your subscriptions and payments and can manage your colleagues' VPN Tracker plans.

You need to enter your equinux ID and password to activate most equinux applications. However sometimes applications will also require you to enter your Mac OS X user password in order to access certain required system components.

So if you see a window like the one below, you'll need to enter the username and password of an Administrator account on your Mac to proceed, not your equinux ID and password.

SonicWALL Simple Client Provisioning enables VPN Tracker to automatically retrieve the settings for the VPN connection from supported SonicWALL VPN gateways. For most users, it is only necessary to configure the SonicWALL's WAN IP address in VPN Tracker – everything else happens automatically.

For a list of supported SonicWALL devices, please refer to this FAQ.

We use analytics in VPN Tracker 365 to help us improve the app and your overall VPN experience. All measurements are completely anonymous and we never evaluate any personal information or any data going through your connection.

What is measured

• Generic connection settings (e.g. what type of connection it is, which options are being used etc.)
• Which features are used (e.g. is auto-connect enabled, are any actions configured etc.)
• How many connections you have

Your data, your privacy

• Your authentication details and credentials are never read, captured or transmitted
• Your VPN traffic is never analyzed, captured or accessible

You’re in control

If you’d prefer not to share any anonymous usage information with equinux, you can deactivate this option at any time in VPN Tracker’s preferences by unchecking 'Share diagnostics data'.

We offer a free trial version of all available VPN Tracker plans so you can test your VPN connections with VPN Tracker before purchasing. VPN Tracker Mac Trial licenses are valid for 7 days and offer the exact feature set of the appropriate plan so you can fully test all features of the plan. You're able to test all connections and protocols to ensure your connections works before purchasing. If you are happy with VPN Tracker, you won't need to do anything to continue using it. All your created connections and settings will remain in the app and the trial license will convert to a paid license after the trial period. Otherwise you can cancel your trial license up to 24 hours before the end of the trial period.

Get the free VPN Tracker trial

Yes, VPN Tracker supports IPsec (IKEv1 + IKEv2), L2TP (Mac only), PPTP (Mac only), OpenVPN, SonicWALL SSL VPN, Cisco AnyConnect SSL VPN, Fortinet SSL VPN, SSTP VPN, and WireGuard® VPN (Beta - learn more). Additional protocols are on our roadmap.

WireGuard is a registered trademark of Jason A. Donenfeld.

What does Extended Diagnostics mean?

• VPN Tracker 365: Download here
• An internet connection
• A VPN Router/Gateway

Create a new connection

‣ Click on the plus symbol in the bottom left corner:

‣ Choose: "New Company Connection"

Choose your VPN Router

‣ In the list of VPN Gateway vendors, choose the manufacturer and model of your VPN router. In case your VPN router does not appear in the list, try the following:
‣ Choose "Use custom device profile." 
‣ Click on "Create" to add your VPN connection.

Your configuration guide

In certain circumstances, due to a bug in macOS, the Kernel Extension required by VPN Tracker may not be installed correctly by your System.

If that happens, you may see the error above.

To fix the problem, please try this:

• Go to Macintosh HD/Library/Extensions and delete the file com.vpntracker.365mac.kext
• Then open the Terminal app (under Applications > Utilities) and enter the following command:
  sudo kextcache --clear-staging
• Then reboot your Mac and try launching VPN Tracker 365 again

If the problem is not fixed, please try this:

• Restart your Mac and hold down Command+R to boot into Recovery Mode
• Choose "Disk Utility"
• Choose your harddrive and click "Mount"
• Exit Disk Utility
• Go to the menu bar and choose "Utilities > Terminal"
• Enter the following commands:
  cd /Volumes/Macintosh\ HD/Library/StagedExtensions/Library/Extensions/
rm -rf com.vpntracker.365mac.kext
• Restart your Mac and try launching VPN Tracker 365 again

Our activation process requires that your Mac accepts cookies.

‣ To check this, please open up Safari. 
‣ Click on "Safari" in the main menu at the very top of the screen.
‣ Choose "Preferences." 
‣ Select the "Privacy" tab and verify that cookies are always accepted. 
‣ Make sure JavaScript at "Security" is also activated. 
‣ Please close Safari.
‣ Restart the application and retry the activation.

• PPTP VPN connections are not supported, as iOS and Android do not support PPTP passthrough
• For IPsec VPN connections, it's possible you may have to adjust your settings for NAT-T.

• Security software (e.g. virus scanners, Malware blockers)
• Malware or Adware

• Kaspersky

VPN Tracker is licensed per user. That means each person using VPN Tracker needs their own license.

To prevent security issues, account sign-ins are checked by an automatic system. There are multiple possible causes that can trigger an account lock:

• Sharing one account with other people
• The account is being used as a "generic" account (e.g. "Lab computer 1"), instead of being personalized for one person

• Go to my.vpntracker.com
• Sign in with your equinux ID
• Go to "My Subscriptions" and choose "Add plans…"
• Add additional licenses for each person that needs VPN access and complete your order
• Once you have the correct number of licenses for your team, assign the new licenses to your co-workers – check out our Team Setup Guide for step-by-step instructions

Once you have completed these steps, please contact our support team and include your equinux ID and order confirmation number. A team member will review your details and will be able to lift the restrictions on your account.

For any other questions, please reach out to our Account Security Team.

• File Servers
• Company intranet & internal websites
• Company email accounts
• Internal databases
• Remote Desktop
• Internal calendars

You can assign different roles to Team members, which give them access to certain features.

Note: Roles are currently being rolled out – if you do not see the role dropdown option in your Team, please reach out and we can set your team up.

You can assign the following roles:

• Open the VPN Tracker Connection Creator for PPTP VPN
• Enter the IP address or Host Name of the PPTP server you want to connect to, then follow the remaining steps in the setup wizard
• Save your new VPN connection in your account using secue end-to-end encryption to start using on your Mac

VPN Tracker has three settings that can speed up connecting to Cisco devices and improve compatibility.

• Establish a shared tunnel to 0.0.0.0/0 for split-tunneling
• Send Cisco firewall attribute
• Use ... as the application version during Mode Config

Note: All settings described on this page require VPN Tracker 6.2 or newer.
 

Establish a shared tunnel to 0.0.0.0/0 for split-tunneling

What does this setting do?
In a split-tunneling setup using EasyVPN, VPN Tracker will no longer establish an IPsec Security Association (SA) to each remote network, but establish a single SA to 0.0.0.0/0. Split-tunneling is achieved only through an appropriate routing setup. This can speed up the connection processes significantly for connections with multiple remote networks.

When should I use this setting?
The setting works with most Cisco devices that use EasyVPN and a split-tunneling setup.

How can I try it?

On the Advanced tab, uncheck the box “Establish a separate tunnel for each remote network” (see screenshot)
Make sure the box “Establish a shared tunnel to 0.0.0.0/0 for split tunneling” is checked (see screenshot)

If your connection does not work with this new setting, simply revert back to your previous setup by checking the box “Establish a separate tunnel for each remote network”.

Send Cisco firewall attribute

What does this setting do?
This setting causes VPN Tracker to send a special attribute during EasyVPN indicating the presence of a firewall.

When should I use this setting?
You can try enabling this setting if your current EasyVPN-based connection to a Cisco device gets dropped at phase 2 (“The VPN gateway asked VPN Tracker to disconnect...” error).

Use ... as the application version during Mode Config

What does this setting do?
This setting causes VPN Tracker to send a different application version than the default “VPN Tracker 6” during EasyVPN and Mode Config.

When should I use this setting?
You can try setting a different application version, e.g. “Cisco Systems VPN Client 4.8.0:Linux” if your current EasyVPN-based connection to a Cisco device gets dropped at phase 2 (“The VPN gateway asked VPN Tracker to disconnect...” error).

• Personal Safe White Paper
• VPN Tracker Personal Safe features

• Creating a VPN Tracker team
• Inviting team members
• Assigning VPN Tracker plans to team members
• Using the package installer and onboarding tools
• Sharing VPN connections
• Managing billing and invoices for your team

There are three possible causes for this:

1. equinux is constantly improving VPN Tracker 365 and as a result VPN Tracker has a high update frequency. Especially if you don’t use VPN Tracker on a daily basis, it’s not unlikely that we already released an update since the last time you were using VPN Tracker. Sometimes there are less than 24 hours between updates, especially with security fixes where it's critical they are released as soon as possible.
    
2. If you were using an older VPN Tracker version, it may be required to install an intermediate update first before you are be able to install the most up-to-date version. In that case you may install an update and directly on next launch VPN Tracker may offer another update.
    
3. You might have multiple copies of VPN Tracker installed on your system. For technical reasons updates to VPN Tracker 36517.0.6 and below have to be installed using the system installer and if multiple copies of VPN Tracker exist on your system, the installer may choose to update the wrong copy. To solve that problem:
    

   ‣ Place a copy of VPN Tracker into a dedicated folder (we recommend the Applications folder).
    
   ‣ Use Spotlight to find copies in other folders.
   (Hold down the CMD key in Spotlight to quickly see the location of a hit)
    
   ‣ Delete all copies that are not in the dedicated folder.
    
   ‣ Finally start VPN Tracker from the dedicated folder and re-apply the update.
    

   
    

1. Make sure your connections are stored in your Personal Safe or in TeamCloud (look for the safe or cloud icons in the Status tab)
   
   
   
   
2. Sign out of VPN Tracker 365 on your old Mac (choose "VPN Tracker 365 > Sign out… " from the menu bar)
3. Sign in to VPN Tracker 365 on your new Mac with your equinux ID and password

• Log in to you your account at my.vpntracker.com
• Go to "My Plans and Billing" in the sidebar, where you will see your current active plan(s), in case your plan is a team plan, please go to "Team Plans and Billing" in the sidebar
• To deactivate your renewal, flip the switch from blue to grey
• After deactivating auto renewal, you will receive an email confirming the deactivation.

The VPN Tracker 365 Connection Checker helps determine which VPN protocols your current internet connection supports. This is particularly useful in places like hotels, cafés, or offices, where network restrictions may apply.

Understanding the Results

• ✅ Green Check Mark: The protocol was successfully tested and is expected to work on your current network.
• ⚠️ Yellow Exclamation Mark: The test was inconclusive. The protocol may or may not work due to network restrictions or unstable conditions. You can try connecting, but success isn't guaranteed.

Why is a VPN Protocol Not Working?

If a protocol gets a ⚠️ yellow exclamation mark, possible reasons include:

• Network Restrictions – Some Wi-Fi networks (hotels, workplaces) limit or block certain VPN protocols.
• Firewall Rules – A firewall may be filtering VPN traffic, preventing stable connections.
• ISP Limitations – Some internet providers restrict or throttle VPN usage.
• Router Settings – Your router may not allow VPN passthrough for certain protocols (e.g., PPTP, L2TP).
• Double NAT Issues – If you're behind multiple routers (common in hotels, mobile networks), VPN connections can be disrupted.
• Unstable Internet Connection – High packet loss or weak connectivity can interfere with VPN protocols.

Explanations for the VPN Connection Test for IPsec

For IPsec, at least the ESP (Encapsulating Security Payload) or NAT-T (Network Address Translation Traversal) protocol must function to establish a stable VPN connection. Often, ESP is not usable in certain environments, such as due to firewall settings or network configurations. However, as long as NAT-T is available, the connection can still be established.

What to Do If a Protocol Fails?

• Switch networks – If possible, test from a different Wi-Fi Network
• Try a mobile hotspot – Create a hotspot with your mobile phone and test if you get a different result
• Try a different protocol (e.g., if IKEv2 is unstable, try OpenVPN).
• Check router settings if you're on a home or office network.
• Use VPN Tracker's built-in troubleshooting tools for more insights.

With the VPN Tracker Connection Checker, you can quickly identify network issues and choose the best protocol for a stable connection.

1. Germany
   
2. Austria
   
3. United States
   
4. Australia
   
5. Brazil
   
6. Canada
   
7. France
   
8. Japan
   
9. Luxembourg
   
10. Netherlands
    
11. New Zealand
    
12. Singapore
    
13. Spain
    
14. Sweden
    
15. Switzerland
    
16. United Kingdom
    

‣ Choose "File" > "New" > "World Connect Destination"



‣ Then, choose "World Connect" and "Countries"



‣ Check your country of choice:

Please try this:

Open the Terminal app (from Applications → Utilities → Terminal) and paste in this command:

sudo launchctl enable system/com.vpntracker.365mac.agent

The problem should be resolved.

VPN Tracker is licensed per user. That means each person using VPN Tracker needs their own license.

If colleagues or other team-members also need to use VPN Tracker, you can upgrade your subscription with additional licenses and assign these using Team Management.

In some circumstances, VPN Tracker may not be able to store your account login credentials in your Keychain.

To fix this issue, please try the following:

• Quit VPN Tracker
• Open Keychain Access from Applications > Utilities
• Select your login keychain
• Choose File > Lock Keychain “login”
• Then choose File > Unlock Keychain “login”

On newer macOS releases, you may not see the option to lock/unlock your Keychain. In that case, please enter the following command via the Terminal:

security lock-keychain ~/Library/Keychains/login.keychain

security lock-keychain ~/Library/Keychains/login.keychain

Now re-open VPN Tracker and try signing in again.

If the problem still pops up, try this:

• Quit VPN Tracker
• Go back to Keychain Access
• In the search box enter “VPN Tracker User Auth”
• Delete the VPN Tracker User Auth Token entry

Now re-open VPN Tracker and try signing in again.

If none of the tips above work, macOS has an option to reset your Keychain. Note that this should only be tried as a last resort, as it completely resets your login Keychain:

• Open Keychain Access
• Go to Keychain > Preferences
• Choose "Reset Default Keychains…"

If there are any further issues, please contact our support team and include the application logs from this location:
/Library/Application Support/VPN Tracker 365/var/log.

• You'll need to be a Manager or Organizer in your team – multi-admin support is currently rolling out to teams – reach out if you'd like this enabled for your Team right away.
• Select a connection in VPN Tracker and choose the 'Share with Team' option from the Status or Configure views

The person receiving the connection needs to be a member of your VPN Tracker team and has to have set up their TeamCloud encryption keys.
This happens automatically when they open VPN Tracker and other Team members are online. If another team member is not available, their TeamCloud setup can also be confirmed by a Team manager under my.vpntracker.com.

Are you using virtualization software, such as VMware, Parallels or VirtualBox? These software products create network interfaces for their internal networking needs, and sometimes the network addresses they choose happen to conflict with the remote network of a VPN connection. Even if you are not currently using this software (but have it installed or not completely uninstalled) their network interfaces exist and can cause conflicts.

To find out which network interface is causing the conflict:

1. Attempt to connect to your VPN (so the error message appears in the VPN Tracker log)
2. Set the log level in VPN Tracker to “verbose”
3. Look for a line that says
   Remote network ... conflicts with local network ... of interface ...

This is the network interface that is causing the problem. On most Macs, “en0” will correspond to the Ethernet interface and “en1” to the AirPort interface. Any other enX interfaces are either from virtualization software, or from additional network hardware (e.g. USB network adapters/modems). Network interfaces whose names start with “vboxnet” generally belong to VirtualBox and network interfaces starting with “vmnet” to VMware.

• If the network interface is a "real" interface, see this FAQ for more information.
• If the interface is virtual, change the network address(es) used by the virtualization software. More information can be found in this FAQ.

1. Trust the certificate in VPN Tracker manually

2. Turn off the certificate warning in the connection settings

For a list of compatible devices, please refer to this page.

If you router is not in the list please refer to this FAQ and the VPN Tracker manual for help determining compatibility.

Please note that the local router (i.e. the router at the location where your Mac with VPN Tracker is) in most cases does not have to be specifically compatible with VPN or VPN Tracker. Almost all routers work fine with VPN Tracker.

Google Calendar

1. Set up your event in your Google Calendar.
2. Click on "Options" > "Publish Event"
3. Copy the event link to include in your email template. Important: Make sure your calendar is set to public to ensure all recipients will be able to view the event.

Apple and Outlook Calendar

WireGuard is a registered trademark of Jason A. Donenfeld.

• Go to my.vpntracker.com and sign in with your equinux ID and password.
• Under "My Subscriptions" in the sidebar menu, you'll see a list of your current VPN Tracker 365 plans.
• Activate automatic renewals to ensure your license is renewed at your current rate.
• Alternatively, you can let your current license expire and then purchase a new plan at the new customers rate from our online store.

Renewals can be canceled up until 10 days before their renewal date. The cancelation will take effect on the next possible renewal date. You can continue to use the software until the end of your term, at which point your subscription will end.

If your OpenVPN connection drops after a while, it may be due to the rekeying period. Test whether extending the period can solve the problem.

Proceed as follows:

• Edit your OpenVPN connection in VPN Tracker
• Navigate to "Advanced Settings > Phase 2"
• Change the Lifetime value to 28800 (which corresponds to a period of 8 hours)

If this doesn't resolve your issues, may also want to check your interoperability keep-alive, activity, and dead peer detection settings.

If you continue to have problems with your VPN connection, please send us a TSR report.

SonicWalls distribute IP addresses using the DHCP protocol. Once the VPN tunnel itself has already been established, the VPN client must perform a DHCP exchange to obtain an IP address and use this IP address for all traffic sent over the VPN tunnel. There are two reasons why this can fail:

1. The SonicWall never received your DHCP request (DHCP-Discover). That would be the case if there is an issue with the VPN tunnel itself not working properly.
   
   Try these:
   • Re-run the VPN Tracker Connection Checker from the "Tools" menu. Then try connecting the VPN again. This will let VPN Tracker automatically detect the best settings for your internet connection.
      
   • Make sure that you have no software installed that blocks VPN traffic in general. Please see this FAQ entry for more details.
      
2. The SonicWall doesn’t want to reply to your DHCP request. The DHCP protocol is designed in such a way that there can be multiple DHCP servers per network and only those who think they can fulfill a request will also respond to it, all others will stay silent (there is no “negative” response for discover requests).
   
   Try these:
   • Try rebooting the SonicWall. SonicWalls are pretty stable but we’ve seen it a couple of times that the DHCP server is acting strange, as if all IP addresses are reserved, yet that’s not what you will see in the web interface. Rebooting will fix that behavior at once.
      
   • Make sure you have sufficient addresses left in the address pool. If the pool is too small and all addresses are in use or reserved, it is expected behavior that the SonicWall doesn’t respond.
      

When you share a connection using TeamCloud, it is encrypted and then shared with members of your VPN Tracker Team.

• TeamCloud uses strong encryption to protect all data
• The connection is encrypted using end-to-end encryption for each Team member individually
• End-to-end encryption means that we can never access your encrypted connection

• Pre-shared keys for a connection are automatically included, so your team members can connect right away
• The pre-shared key will not be added to a team member's Keychain, so they cannot access it

• Your username and password are not shared with your team, they are removed before the connection is shared
• Each Team member can enter their own username and password
• These can be stored inside their Keychain and additionally will be added as user-specific credentials to TeamCloud (only available to that team member)

• Remote Connection Wipe: By removing a team member from your Team, their access to TeamCloud is also immediately revoked. Any connections they have on their Macs will be removed automatically.
• Don't allow settings to be changed prevents users that aren't Team managers or owners from editing a connection

• VPN Shortcuts can be shared to TeamCloud directly

If you have any feedback regarding these settings, please get in touch and let us know your requirements.