There are a number of possible causes for such a behavior. This FAQ will help you to find out what is causing the problem in your specific situation. In this FAQ we will be using destination device as a generic term for the device you are trying to connect to. The destination device can be anything from a normal computer, to a server, to a network printer.

1. Are you trying to connect to the destination device using a host name?

If you are using a host name, please try once using its IP address instead. If that works, the problem has to do with DNS resolution. Please make sure DNS is enabled for the VPN connection and correctly configured. Note that using Bonjour or NETBIOS hostnames is generally not possible over VPN.

2. Is the IP address you are connecting to really part of the remote network?

For example, if your remote network is 192.168.13.0/24, you should be able to connect to IPs starting with 192.168.13.x, but connections to IPs starting with 192.168.14.x will not work as they are outside the address range of traffic tunneled through the VPN.

3. Is the local address in VPN Tracker part of the remote network?

Using a local address in VPN Tracker (Basic > Local Address) that is part of the remote network is not possible with most VPN gateways. Please use a local address that is outside all remote networks. For example, if your remote network is 192.168.13.0/24, do not use an address starting with 192.168.13. If you are using an automatic configuration method (e.g. Mode Config, EasyVPN, DHCP over VPN) you may be able to assign a local address to VPN Tracker that is part of the remote network. Refer to the configuration guide for your VPN gateway for more information.

4. Could multiple VPN users use the same local address?

If multiple VPN users exist, pleas make sure no two users are using the same local address (Basic > Local Address), otherwise one of them will not be able to use the tunnel anymore whenever both of them are connected. If that field is empty in your configuration, VPN Tracker will just use the IP address of your primary network interface as local address, and of course, this can also cause an address conflict with another user, that’s why we do not recommend to leave that field empty if there are multiple VPN users.

5. Can you ping the LAN address of the VPN gateway?

You can find a ping tool directly in VPN Tracker under Tools > Ping Host. The LAN address of the VPN gateway is special in the regard that this address doesn’t need to be routed at all. So if you can ping that address but no other remote address, it is most likely a routing issue at the remote end.

6. If you can't ping anything, try re-running the VPN Availability Test

The VPN Availability Test can be found in the menu: Tools > VPN Availability Test. Then try connecting the VPN again. The results of this test depend on the capabilities of your local Internet router/modem or the Internet connection itself and they influence how the VPN tunnel is established. VPN Tracker automatically runs the test for every new Internet connection it is able to detect but even if a connection has been tested before, there are various reasons why the behavior of that connection may have changed in the meantime.

7. Is your VPN gateway the default gateway (router) of its network?

If the VPN gateway is not the default gateway, you will in many cases need a suitable routing setup in order for responses to reach you. Whenever a device doesn’t know how to reach an IP address directly, it forwards its reply to its default gateway and if that isn’t the VPN gateway, it won’t know what to do with that reply data. In that case its important to configure the default gateway to forward replies to VPN users to the VPN gateway.

8. Is your VPN gateway the default gateway (router) of its network?

For more details, we would like to direct you to the following FAQ entry.

Configuring the Pre-Shared Key for a new VPN connection

I have lost my Pre-Shared Key - how can I get it back?

1. Check if you have stored the affected connection in your Personal Safe. If so, you may be able to download the connection again.
2. Check the Keychain (Applications > Utilities > Keychain Access). The Pre-Shared Key is usually saved here. Enter "Shared Secret" into the search bar to view a list of all your saved PSKs.
3. Are you using Time Machine Backup? You could try restoring an older connection with the Pre-Shared-Key.
4. Check your firewall or ask the relevant VPN Administrator. Refer to your device handbook to find out where to obtain this information on your specific firewall.

After upgrading to macOS 15 Sequoia, you might notice that your Mac constantly changes its MAC address, affecting your ability to connect to your VPN. This behavior is due to macOS 15’s new privacy features, which can assign randomized MAC addresses for network connections. However, you can configure your network settings to always use a fixed MAC address, which can resolve issues with VPN connectivity, such as DHCP reservations failing due to MAC address changes.

How to Set a Fixed MAC Address in macOS 15 (Sequoia):

1. Open System Settings:
   • Click the Apple logo in the top-left corner of your screen.
   • Select System Settings from the dropdown menu.
2. Go to Wi-Fi Settings:
   • In the left sidebar, click Wi-Fi.
   • Select the Wi-Fi network you usually connect to for VPN access and click on "Details...".
3. Configure the MAC Address:
   • Look for the option labeled Private Wi-Fi Address.
   • Change this option to "Fixed" to use a fixed MAC address instead of a randomized one.
   In some cases, the Fixed Setting may still cause issues. If this is the case, change the setting to "Off"
   {S_1478}
   • Your network will now always connect using the same MAC address, helping maintain your VPN connection stability.
4. Re-establish VPN Tracker Connection:
   • Once you've set a fixed MAC address, ensure that your VPN’s DHCP reservation or configuration aligns with this MAC address.

This process will restore the VPN Tracker’s ability to connect reliably using a consistent MAC address, resolving issues caused by macOS 15 Sequoia’s default MAC address randomization feature.

• If you haven't already, you can download VPN Tracker using this link.
• After the download has completed, launch the app and click the "Login" button in the top left-hand corner of the app home page.
• Enter your equinux ID and password in the space provided. Hint: This is the login you first created when purchasing VPN Tracker in our online store.

Are you a World Connect User?

You will need to download VPN tracker World Connect. You can do so using this link. VPN Tracker World Connect must be installed using the App Store. Once you've installed the app on your device, sign in with your equinux ID and password.

• Private IP Addresses, and
• Public IP Addresses

• 192.168.0.x, and
• 192.168.1.x

1. Change your local network to a different range (Preferred)

   
   Possible Ranges are:
   
   • 10.250.250.x
   • 172.30.30.x
   • 192.168.250.x
   
   Advantage: Once you have made this change on your home network, you will never have conflicts in this network.
   Disadvantage: You will need to change the settings on your private network router once, this requires access and can take some time.
   What to do:
   
   • Login to your home router
   • Find the setup section with “DHCP” settings.
   • Change your router to a different IP adress (for example an address from one of the ranges listed above, for example 172.30.30.1)
   • Change the DHCP Server Settings to the same range of your router (If your router IP is 172.30.30.1, your range could be 172.30.30.10 to 172.30.30.253){S_1183}
   
   After you have made these changes, there will be no more conflicts between your home and company network.{S_1184}

2. Force Traffic over VPN

   
   There may be situations where it's not possible to use the first option (for example if you're in a coffee shop or hotel) In this case you have the option to force the traffic over your VPN Network, this means your VPN Network (company network) will always win.
   Advantage: This setting is global, meaning no matter what network you are in you will always be able to connect.
   Disadvantage: Once you are connected to your company’s VPN, you can not access local service, like home router, local storages or printers.
   What to do:
   
   • Configure your VPN Tracker connection
   • Select the "Advanced" Tab at the top
   • In the "Traffic control" section, activate the Checkbox "Force traffic over the VPN if remote networks conflict with local networks"{S_1189}
   
   

Download VPN Tracker free

There are multiple passwords that VPN Tracker may require: Your admin password for installation, passwords needed for connecting to your VPN or accessing your Keychain, etc.

This guide shows all password prompts you may encounter in VPN Tracker, explains why they are needed and lets you know which password should be entered.

Administrator password prompts

VPN Tracker will occasionally require you to enter an administrator password - for example during the macOS installation process in order to approve the System Extension needed to allow VPN Tracker to work effectively.

Account + licensing

To log in to VPN Tracker on Mac or iOS, or to log in to your account on my.vpntracker.com, you will need to enter your equinux ID and password. This password gives you access to your VPN Tracker account where your plan, team data, connections and device information is stored.

Pre-Shared Key

Many VPN connections are secured using a Pre-Shared Key (PSK) or Shared Secret which is set on the VPN gateway during the configuration process. You need to enter the PSK in VPN Tracker in order to connect to your VPN.

If you are not the administrator of your VPN gateway, contact the admin for assistance. Tip: Admins can share pre-configured VPN connections using TeamCloud to avoid PSK confusion at enduser level.

Extended Authentication (XAUTH)

Most VPNs have a list of permitted VPN users - e.g. members of staff. Each VPN user has their own unique username and password which they need to enter in order to connect to the VPN. These are often the same credentials you use to sign in at the office. If you're not sure, get in touch with your admin who can advise you further.

1. Start your VPN connection in VPN Tracker
2. Go to the Finder > Go To >Connect to Server
3. In the Server Address field, enter the name or IP address of the server you want to connect to
4. Click on the Connect button.

Create a VPN Shortcut:

Such a setup is called “Host to Everywhere” in VPN Tracker. All non-local traffic will be sent through the VPN. For this setup to work, it must be properly configured in VPN Tracker and on the VPN gateway:

1. The Network Topology must be set to “Host to Everywhere” in VPN Tracker
2. The VPN gateway must accept an incoming VPN connection with a 0.0.0.0/0 (= everywhere) endpoint

Once these are configured, it should already be possible to establish the VPN connection. However, it is very likely that Internet access will not yet work. For Internet access to work, several more things need to be configured on the VPN gateway:

1. The VPN gateway must route VPN traffic not destined for its local networks out on the Internet
2. This traffic must be subject to Network Address Translation (NAT) in order for replies to reach the VPN gateway
3. In many cases, a suitable remote DNS setup is necessary for DNS resolution to continue to work

Note that not alll VPN gateways can be configured for Host to Everywhere connections. Most devices designed for small office or home networks (e.g. devices by NETGEAR or Linksys) are not capable of dealing with Host to Everywhere connections.

VPN Tracker automatically stores a backup of all your VPN connections on your Mac. If you have inadvertently deleted a connection, or wish to revert to an earlier copy of a connection, you can manually restore the backup copy.

1. Turn off Personal Safe syncing

You need to deactivate Personal Safe for the connections you're trying to restore from your backup, to prevent unwanted changes being synced:

• Open VPN Tracker 365
• From the menu bar, choose: VPN Tracker 365 > Preferences > Personal Safe
• Uncheck the connections you want to restore from your backup
• Quit VPN Tracker 365

2. Restore from your Backup

• Open Finder and choose "Go" > "Go to Folder…" from the menu bar
• Enter this path and press Return:
  /Library/Application Support/VPN Tracker 365
• Rename your "etc" folder to "etc-backup" – for safekeeping
• Go into the "backup" folder

Here you'll see a number of backup folders, all organized and named by date.

• Move the "etc-date" folder you want to restore up one level into the main "VPN Tracker 365" folder
• Rename the folder your just moved to just "etc" (deleting the date)
• Open VPN Tracker 365

All of your connections will now be restored to their backed-up state.

3. Re-activate Personal Safe

• Choose: VPN Tracker 365 > Preferences > Personal Safe from the menu bar
• Check your connections, to add them to Personal Safe

Download VPN Tracker free

IPsec VPN uses a different protocol (ESP) for the actual data transfer than for establishing the connection (IKE). Since the ESP protocol does not use network ports, NAT (Network Address Translation) routers may have difficulties handling it correctly. Only NAT routers that support "IPSec Passthrough" (sometimes also named "VPN Passthrough" or "ESP Passtrhough") and where this option is also enabled, can handle ESP data packets.

To work around this problem, two alternative tunneling methods exist:

• NAT-Traversal (old, RFC draft version)
• NAT-Traversal (new, RFC standard version)

Which of these methods will work with your connection depends on two properties:

1. Which of these methods allows traffic to pass through your local Internet router.
2. Which of these methods are supported by your VPN remote gateway.

To test for the first property, VPN Tracker will automatically establish three VPN test connections to a VPN gateway hosted by us whenever it detects a new router that has not been tested before. One connection uses plain ESP, the other two either NAT-T method mentioned above. It will remember the test results for this router and take them into account whenever you start a connection from the network location. The reason we are testing with our own gateway is simply that the test requires a gateway supporting all three methods, with a known configuration and a simply way to verify if traffic did arrive at that gateway.

The second property is not tested in advance, VPN Tracker will become aware of that information when it actually tries to connect to your VPN gateway. VPN Tracker will compare the methods your gateway supports with the stored test results. If there is a match, a method that your gateway supports and that was also working during the test, this method will be used. If there is no match, VPN Tracker will immediately stop and show an appropriate error in the log, explaining the situation.

If you suspect a NAT-Traversal issue or you think the previous test results may be wrong or outdated, simply re-run the test:

‣ Make sure NAT-Traversal (Advanced tab) is set to Automatic
‣ Go to "Tools" > "Test VPN Availability"
‣ Click "Test Again"
‣ Wait until the test has completed, then connect to your VPN

The test dialog also allows you to tell VPN Tracker to not test the current location and forget any previously created test results. This is rarely needed and also not recommended but there might be situation where the test results are wrong because access to our VPN gateway is not possible (e.g. it is blocked) and thus the test result are just bogus and say nothing about the true capabilities of your VPN gateway.

• Download VPN Tracker for Mac or iPhone
• Copy your VPN connection details from the AnyConnect app
• Connect and enter your username and password when asked

‣Open System Preferences

‣Go to Security

‣Click "Allow"

{S_685}

By default, traffic to the remote network cannot be sent through the VPN tunnel if it is using the same network as the local network.

Resolving a Network Conflict using Traffic Control

You can use Traffic Control and VPN Tracker will send non-essential local network traffic over the VPN.

Activate Traffic Control:
> Go to Advanced > Traffic Control
> Check "Force traffic over the VPN if remote networks conflict with local networks"

Note that you will never be able to reach the following addresses over VPN: The IP address of your local router, your DHCP server, and your DNS server(s). If you need to reach those IPs over VPN, you will have to resolve the network conflict instead of using Traffic Control. The same applies for any IPs that you need to reach locally and over VPN.

Resolving a Network Conflict Manually

You have two basic options for resolving a conflict:

1. Change the local network to use a different network address. In most situations, this will entail changing the LAN settings on the local router (including DHCP settings if DHCP is used).
2. Change the remote network to use a different network address. With most setups, this entails changing the LAN on the VPN gateway (including DHCP settings if DHCP is used), and changing the IPs used by devices on the VPN gateway's LAN (or triggering a DHCP refresh, if DHCP is used). If the LAN is used in the VPN settings (such as for policies or firewall rules), these will need to be changed as well. Finally, change the remote network in VPN Tracker to match the new settings

If you decide to change the remote network, it makes sense to choose a private network that less commonly used. According to our informal statistics, conflicts are least likely using these networks:

• Subnets of 172.16.0.0/12
• Subnets of 192.168.0.0/16, excluding 192.168.0.0/24, 192.168.1.0/24 and 192.168.168.0/24

If these are not an option, use a subnet of 10.0.0.0/8, excluding 10.0.0.0/24, 10.0.1.0/24, 10.1.0.0/24, 10.1.1.0/24. However, since wireless network operators sometimes choose to use the entire 10.0.0.0/8 network, the first two options are preferred.

If you have a more sophisticated VPN gateway, in particular a SonicWALL, you may be able to set up an alternative remote network on the VPN gateway that is mapped 1:1 through Network Address Translation (NAT) onto the actual network. Users can then connect to this network instead if they have a conflict of networks. We have a guide available that describes this approach for SonicWALL devices.

If the conflict is caused by virtual network interfaces (e.g. Parallels, VMware), see here for more information.

In some circumstances, VPN Tracker may not be able to store your account login credentials in your Keychain.

To fix this issue, please try the following:

• Quit VPN Tracker
• Open Keychain Access from Applications > Utilities
• Select your login keychain
• Choose File > Lock Keychain “login”
• Then choose File > Unlock Keychain “login”

On newer macOS releases, you may not see the option to lock/unlock your Keychain. In that case, please enter the following command via the Terminal:

security lock-keychain ~/Library/Keychains/login.keychain

security lock-keychain ~/Library/Keychains/login.keychain

Now re-open VPN Tracker and try signing in again.

If the problem still pops up, try this:

• Quit VPN Tracker
• Go back to Keychain Access
• In the search box enter “VPN Tracker User Auth”
• Delete the VPN Tracker User Auth Token entry

Now re-open VPN Tracker and try signing in again.

If none of the tips above work, macOS has an option to reset your Keychain. Note that this should only be tried as a last resort, as it completely resets your login Keychain:

• Open Keychain Access
• Go to Keychain > Preferences
• Choose "Reset Default Keychains…"

If there are any further issues, please contact our support team and include the application logs from this location:
/Library/Application Support/VPN Tracker 365/var/log.

To establish a VPN connection to a certain location (such as your office), you will need a VPN gateway at that location. This gateway could be a hardware VPN gateway device (see our compatibility page for compatible devices and setup guides).

The VPN gateway needs to be connected to the Internet (e.g. to a DSL modem or similar), preferably with a static IP address or it should be capable of using a service like DynDNS.org to map its dynamic IP to a hostname. Configuration is easiest if the VPN gateway is also the router (default gateway) of its network. If the VPN gateway is not the router of its network, a suitable routing setup may be necessary for traffic over the VPN to be routed correctly.

Configuration details can be found in the configuration guides for specific devices.

Some kinds of software may cause issues with VPN Tracker:

1. Personal Firewalls / Desktop Firewalls
2. Protection Software (e.g Virus Scanners, Malware Protection)
3. Other VPN Clients / VPN Software (for example NCP Client)

Personal Firewalls usually ask the user, if an app should be allowed to send network traffic. It’s important to grant VPN Tracker full network access. If you have already added rules for VPN Tracker, please whitelist VPN Tracker.

Protection Software often sees VPN traffic as a potential source of threat, as it isn’t able to analyze that traffic because of its very strong encryption. Please ensure VPN Tracker is ignored by any protection software running on your Mac and allow VPN traffic to pass through.

Other VPN clients should not be a problem, if they are designed to co-exist with othe VPN apps. Unfortunately, not all other clients are and some capture all VPN traffic as soon as they are installed, even if the app is not running.
In these situations, you may need to uninstall the VPN client - we also suggest asking the vendor to improve its “cooperation” with other VPN apps.

Here are some common examples of the types of apps mentioned above. If you are uncertain whether any of these applications may be installed on your system, try the following:

• Open the app “Terminal”
• Copy and paste the following command: kextstat | grep -v com.apple

You’ll get a list of all kernel extensions that are not from Apple. Just compare that list with the identifiers in parenthesis below:

• Little Snitch
  (at.obdev.nke.LittleSnitch)
   
• TripMode
  (ch.tripmode.TripModeNKE)
   
• Sophos Anti Virus
  (com.sophos.kext.oas, com.sophos.nke.swi)
   
• Symantec Endpoint Protection / Norton AntiVirus
  (com.symantec.kext.SymAPComm, com.symantec.kext.internetSecurity, com.symantec.kext.ips, com.symantec.kext.ndcengine, com.symantec.SymXIPS)
   
• Kaspersky Internet/Total Security
  (com.kaspersky.nke ,com.kaspersky.kext.kimul, com.kaspersky.kext.klif, com.kaspersky.kext.mark)
   
• Intego Mac Internet Security
  (com.intego.netbarrier.kext.network, com.intego.virusbarrier.kext.realtime, com.intego.netbarrier.kext.process, com.intego.netbarrier.kext.monitor)
   
• Fortinet FortiClient
  (com.fortinet.fct.kext.avkern2, com.fortinet.fct.kext.fctapnke)
   
• Cisco Advanced Malware Protection (AMP)
  (com.cisco.amp.nke, com.cisco.amp.fileop)
   
• TUN/TAP based VPN Clients
  (net.sf.tuntaposx.tap, net.sf.tuntaposx.tun)
   
• eset Security Products
  (com.eset.kext.esets-kac, com.eset.kext.esets-mac und com.eset.kext.esets-pfw)
   

If your OpenVPN connection drops after a while, it may be due to the rekeying period. Test whether extending the period can solve the problem.

Proceed as follows:

• Edit your OpenVPN connection in VPN Tracker
• Navigate to "Advanced Settings > Phase 2"
• Change the Lifetime value to 28800 (which corresponds to a period of 8 hours)

If this doesn't resolve your issues, may also want to check your interoperability keep-alive, activity, and dead peer detection settings.

If you continue to have problems with your VPN connection, please send us a TSR report.

For a certificate to be available in the "Local Certificate" list, it must be present in the Mac OS X Keychain with its corresponding private key.

You can easily check this in the Keychain Access application: If a certificate is listed under "My Certificates" (and not just "Certificates"), its private key is available and you will be able to select it in VPN Tracker as the "Local Certificate".

Important note for CheckPoint VPN users:

The Mac OS X Keychain Access application currently does not understand how to read private keys from some CheckPoint generated certificates.

To properly import the certificate into the Mac OS X Keychain, first convert it using the openssl command line tool:

1. Open a Terminal ("Applications" > "Utilities" > "Terminal")
   
   
2. Convert the certificate to PEM format:

     openssl pkcs12 -in /Users/joe/Desktop/MyCheckPointCert.p12 -out /tmp/out.pem
   

   Replace /Users/joe/Desktop/MyCheckPointCert.p12 with the path to the actual certificate that you want to convert.

   You will first be asked for the password that the certificate is encrypted with. If you do not know it, please ask the administrator who has created your certificate for you. You will then be asked twice for the password that will be used to protect the exported PEM file. You can use the same password that the original certificte was encrypted with. Note that no characters will appear on screen while you type in your passwords. Simply type the password and press the return key.

3. Convert the PEM file back to PKCS#12 (.p12) format:

     openssl pkcs12 -in /tmp/out.pem -export -out ~/Desktop/MyFixedCheckPointCert.p12
   

   Replace /Users/joe/Desktop/MyFixedCheckPointCert.p12 with the path where you want the fixed certificate to be stored.

   You will first be asked for the password that you have just used for exporting to the PEM file, and then for a password to protect the fixed .p12 file with. You can again use the same password for everything.

Now double-click your fixed certificate file to import it into the Mac OS X keychain.

A couple of years ago, a team of security experts released a paper describing an attack that can break an IKEv1 Aggressive Mode Pre-Shared Key connection using an attack that would not equally have been possible with an IKEv1 Main Mode Pre-Shared Key connection, leading to the incorrect assumption that Aggressive Mode is inherently insecure. This claim, however, is not backed up by objective facts. What most people don't know, part of that attack was the ability to guess the Pre-Shared Key (PSK) using a brute force attack and such a brute force attack can only be successful if the PSK is weak. A PSK is also just a password and as with every password, choosing a weak password always leads to poor security. As long as your PSK is at least 14 characters long (the longer the better), consists out of lower case letters, upper case letters and digits, and was randomly generated, so it's impossible to somehow guess it, and as long as your Phase 1 hash algorithm is at least SHA1 (or better, we recommend SHA-256 if possible), there's absolutely no reason to consider IKEv1 Aggressive Mode with Pre-Shared Key as less secure than IKEv1 Main Mode with Pre-Shared Key. If you want to be even more secure, switch to certificate based authentication instead of PSK if possible as then the attack is not possible at all.

Technical background:

The Pre-Shared Key (PSK) is not a password used for encryption of any data, it's used for authentication, just when you log in to a website using a username and a password. During Phase 1, both sides must prove to each other to know the PSK. This cannot be done by just sending it to the other side, as if the other side didn't know it before, it will know it after receiving it. Instead both sides calculate a number (a hash digest) out of data they exchanged so far (data that will be different every time you start a new connection, which ensures the calculated value will be as well) and the PSK. Only this digest is send to other side. The other side can now verify that digest by performing the same calculations and comparing the result with the digest received. If both are equal, the sender must have used the same PSK in the calculation, which proves knowledge of the PSK. Then the receiver also calculates such a digest, using a slightly different formula as before, leading to an entirely different result, and sends it back in reply to also prove its knowledge.

The differences between Main Mode and Aggressive Mode is simply that in Main Mode the digest is exchanged encrypted because the session key exchange already negotiated a session encryption key when the digest is exchanged, whereas in Aggressive Mode it is exchanged unencrypted as part of the key exchange that will lead to a session key. By snooping the connection establishment of an Aggressive Mode connection, the attackers were able to get the digest as well as all values required to calculate that digest, except for the PSK itself. Please note that this alone doesn't mean the connection is broken already, it only means that the attackers now have enough data to start guessing the PSK using a brute force or dictionary attack. Only if the PSK is too weak to withstand those attacks and the attackers are able to correctly guess it, the connection will be broken. That's why a good, secure PSK is essential.

The same attack is in fact also possible with a Main Mode PSK connection, it just requires some extra work. For a Main Mode connection it's not enough to just snoop the traffic, the attackers would need to perform a so called Man-in-the-Middle (MitM) attack, allowing them to capture and manipulate all traffic exchanged. By performing a MitM attack, attackers can break the key exchange and thus will be able to decrypt all the exchanged packets. Doing so will not make it possible to break into your VPN, they still need to know the PSK for that, otherwise they cannot successfully authenticate to the other side and then Phase 1 will never complete, but that way they can get all the information required to start guessing on the PSK, just as in case of a an Aggressive Mode connection. And if an attacker is already able to snoop on your VPN traffic (which is required to attack Aggressive Mode), it's very likely that attacker is equally possible to perform a MitM attack and in that case using Main Mode will not offer you any additional protection.

A PSK out of 11 random alphanumeric characters offers an entropy of approx. 64 bits, that's 2^64 possible values. Modern high end graphics adapter (as of 2015) can calculate in the order of 1 billion SHA-256 hashes a second. On average one has to try 50% of all possible values to find a match, wich would be about 292 years. Yet if the attackers have an array of 100 such graphics adapters, it would "only" be around 3 years. If the PSK is 14 characters, the entropy is about 80 bits and you are already at 19,154,798 years. Now even having 10,000 graphics adapters would help a lot. Also one must consider the costs of such an attack, which is not so much the cost of buying all these graphics adapters, rather their power consumption when all these graphics adapters run at maximum current 24 hours a day and that for years, decades, or even centuries. The power costs will be billions of dollar and all that to just break one single PSK connection in the entire world. And whenever you change the PSK, an attacker must start all over, so if you change the PSK regularly, let's say once a year, an attacker has at most one year to find it; that's very ambitious, even for a weak PSK.

Symptom

As soon as you connect your VPN tunnel, Skype is not able to make calls any longer, however calls started prior to connecting the VPN continue to work.

Solution

Make sure the field Local Address is not empty. If it is, fill in a private IP address. A private IP address has the following form:

• 192.168.x.x
• 10.x.x.x
• 172.y.x.x

x: A number of the range 0 to 255.
y: A number of the range 16 to 31.

Only rule: It must not be an IP address from a remote network on the other side of the VPN tunnel (must not partially match an entry of the field "Remote Networks"), as choosing such an address will make the tunnel stop working (it will connect, but you cannot really reach anything over it).

Alternate Solutions

If the solution above does not fix your issues, make sure that

• DNS resolution still works once the VPN tunnel is up.
   
• Public Internet servers are still reachable once the VPN tunnel is up.
   
• In case of a Host to Everywhere connection, make sure the VPN gateway does not block any network traffic that is crucial for Skype to work.
   

Explanation

VPN Tracker creates a virtual tunnel interface for every VPN tunnel. Like any network interface, this virtual tunnel interface requires an IP address to be functional as an IP network interface. If your VPN gateway assigns you an IP address, the assigned address is applied to the tunnel interface. If not, the address you put into Local Address will be used. If you leave local address empty, the IP address of your primary network interface will be used.

In the last case, your system ends up with two interfaces with identical IP addresses. This is allowed and usually not a problem, unless a software does “stupid things”, like querying the network interface for a given IP address and then ignoring the order of precedence of the returned results.

Parallels

Go to "Preferences" > "Network" in Parallels and change the DHCP ranges for Shared and/or Host-Only Networking so they no longer conflict with your VPN's remote network.

VMware Fusion

A PDF with instructions can be downloaded from the VMware community forums:

• VMware Fusion 3.x
• VMware Fusion 1.x/2.x

What does this mean?

How to disable DNS over HTTPS in Firefox

If you're running FortiOS 3, please make sure you are running at least MR6 patch 2. Previous firmware releases have an issue that will cause the device to respond incorrectly to VPN Tracker's attempts to use XAUTH in combination with an Aggressive Mode based connection.

VPN Tracker supports industry standard OpenVPN, IPsec (IKEv1 + IKEv2), L2TP, PPTP, SSL, SSTP, and WireGuard® protocols. This means that it will work with almost all devices supporting these types of VPN connections.

A list of tested devices is available on our website

What if my device is not on this list?

There are hundreds of VPN devices available on the market, and we'd love to offer device profiles for all of them. Unfortunately, it is impossible to test all devices. If your gateway is not in the list, it will probably still work with VPN Tracker.

Tip: Try out one of our custom protocol profiles to test your VPN connection free in VPN Tracker on Mac, iPhone or iPad.

Important Notes

There is a known bug in the Watchguard firmware that is causing a lot of trouble. Currently, we still do not know why VPN Tracker is triggering this bug, as the Windows client seems to not trigger it. We talked with Watchguard, but even they could not tell us what we are doing wrong. Basically the tunnel dies internally in the Watchguard (it's still shown as open and established, but traffic arriving over this tunnel is rejected as if the tunnel was closed).

If you are using a Branch Office VPN at the moment, try switching to a MUVPN if possible. MUVPN works with VPN Tracker as well and usually yields for better results.

Please refer to the following description.

Current Firmware (Fireware XTM)

WatchGuard Firebox X Edge e-Series devices with Fireware XTM (Fireware 11) are fully supported in current versions of VPN Tracker. For details please see our configuration guide.

Older Firmware

Devices running an older firmware may often work using the following setup. Please note however that we can't guarantee that this setup will work in all cases.

Start by creating a new user on the Firebox Edge and then configure MUVPN support for this user.

In VPN Tracker, use a "Custom Connection" device profile as the basis for your new connection.

Map the WatchGuard settings to your VPN Tracker configuration as shown in the table below:

The following settings are independent of your specific MUVPN configuration:

• Local Identifier Type: Email (even if it is a name and not an email address)
• Exchange Mode: Aggressive
• Phase 1 Diffie-Hellman Group: Group 2 (1024 bit)
• Perfect Forward Secrecy (PFS): off

Finally make sure the that VPN Tracker's "Network" setting is set to "Host to Network", and the correct Remote Network (i.e. the network that you want connect to through the VPN) is used (e.g. 192.168.1.0/255.255.255.0).

You can retrieve your equinux ID or password using this form.

If you don’t receive the email* containing your information, please note that the email may have mistakenly been marked as spam or junk mail, so be sure to check your email filters.

If you are unable to retrieve your username and password using the retrieval form, please contact the support team for assistance. When contacting us, please provide your old and new email adresses.

* Please note that the email will be sent to the address active on account. If your email address has since changed and you no longer have access to the previous account, you will need to contact the support team for assistance.

With both SMB (Windows File Sharing) and AFP (Apple File Sharing), low latency connections are key to achieving good performance. This is of course assuming that you already have a connection with reasonable bandwidth in between the two VPN endpoints (this can be easily verified by transferring a larger file through HTTP or FTP).

Using SSL VPN? Switch to IPSec

In comparison to SSL VPN, IPSec is able to offer much faster connection speeds as it runs on the network layer – level 3 of the OSI – meaning it’s much closer to the physical hardware. This will give you a faster VPN performance.

Learn more in this blog post.

Finder Settings

If you are using the Finder and the issue is mostly with listing folders (but not so much when actually copying files), try turning off icons/icon previews in the Finder's View Options (Cmd-J).

Reducing Latency

If you experience performance issues both when listing folders and when transferring files, your aim should be to reduce latency. Some ways to reduce latency include:

• Avoid high-latency Internet uplinks (e.g. satellite, some types of wireless providers, line aggregation, ...).
• When using a DSL line, see with your ISP if you can get "fast path" enabled (= interleaving turned off). ISPs sometimes market this as an option for online gaming, but it's also very helpful for AFP/SMB or connecting to some types of database backends.
• Make sure VPN traffic is appropriately prioritized in order not to be slowed down by someone else using the same Internet connection.

To measure latency between the two endpoints of the VPN, use ping to a host on the other end of the connection (or, when pinging from the client end, ping the VPN gateway). For your convenience, VPN Tracker has a ping utility built right in, it can be found in the Tools menu.

To measure latency of each endpoint's individual uplink, it's often helpful to do a ping the local router (to make sure there are no unnecessary latencies introduced in the local network) and the ISP's first router (to get an idea if enabling fast path or switching ISPs may be a suitable measure to decrease latency).

If you cannot reduce latency any further:

If you are in a situation where you cannot reduce latency any further (or where the base latency from the distance between the two endpoints itself is so large local measures won't make much difference), consider switching to a file transfer protocol that is less vulnerable to latency, e.g. WebDAV or FTP, or use measures such as reducing the number of files and folders in a hierarchy to increase performance.

Don't worry – it happens to all of us!

Just head on over to our login retrieval page, enter your equinux ID or email address and we'll send you your details.

Recently changed your e-mail address? Send us a message!

VPN Tracker for Mac fully supports all the latest macOS versions, including macOS Sequoia

Starting from macOS 11, Apple have made some key changes to the macOS security architecture. VPN Tracker for Mac offers full support for all the latest macOS versions. This includes support for: IPsec VPN, IKEv2 (Beta), OpenVPN, L2TP VPN, PPTP VPN, SonicWall SSL VPN, Fortinet SSL VPN, Windows SSTP VPN, Cisco AnyConnect VPN and WireGuard® VPN.

Tip: Sign up for VPN Tracker Insider Updates to get Beta releases as soon as they are available.

WireGuard® is a registered trademark of Jason A. Donenefeld.

Find your PPTP VPN connection settings in the Control Panel of your Windows PC
Start VPN Tracker 365 on your Mac and click the "+" to create a new PPTP connection
Copy the connection settings from the first step into the configuration window
Finally, start up your PPTP connection to test

This depends on your settings. The most common setup is “Host to Network“, in which case only traffic to the specified remote network(s) will go through the VPN tunnel.

With a “Host to Everywhere” setup, all traffic – except traffic to the local network(s) – goes through the VPN. A Host to Everywhere connection requires a suitable setup on the VPN gateway.

Open the VPN Tracker 365 app and go to "VPN Tracker 365" > "Preferences"
Next to "Update", check the box "Get early access to Pre-Release versions"
From the drop down menu, select "Beta versions"

SonicWALL Simple Client Provisioning with VPN Tracker is available with all SonicWALLs running SonicOS 4.0 or newer and all editions of VPN Tracker.

If you are still using VPN Tracker 6 or earlier, Professional or Player Edition is required.

1. Open VPN Tracker and add a new WireGuard® connection
2. Upload your WireGuard® configuration file or scan your QR code
3. Save your connection to your account using secure end-to-end encryption

If you are an existing VPN Tracker customer and want to upgrade to VPN Tracker 365, you can simply install VPN Tracker 365 and your connections will automatically be imported:

Download VPN Tracker 365

Once you have VPN Tracker 365, you can purchase a VPN Tracker 365 plan.

• {FQ317}

• IPsec
• IKEv2 (Beta)
• L2TP (only macOS)
• PPTP (only macOS)
• OpenVPN
• SSTP VPN
• Cisco AnyConnect SSL VPN
• SonicWall SSL VPN
• Fortinet SSL VPN
• WireGuard® VPN

Double click the connection file to import into VPN Tracker 365.
Enter the import password - your network admin will give this to you.
Now, click the toggle switch to connect to your VPN. Note: If you are asked  to enter user credentials, your admin will tell you which login you need to use.

When connecting via SonicWall SCP or SonicWall IKEv1 with DHCP, VPN Tracker 365 for Mac requests an IP address from the SonicWall gateway using the DHCP protocol. For this request, VPN Tracker 365 modifies the MAC address slightly, making it different from the actual MAC address of your device. This allows administrators to assign a fixed IP address when your Mac is connected via LAN or WiFi and a different IP when it’s connected through VPN.

This modification sets a specific bit in the MAC address, marking it as a self-assigned address rather than a factory-assigned one.

Example:
Original MAC address: 00:1B:63:B7:42:23
VPN Tracker MAC address: 02:1B:63:B7:42:23

Starting with macOS 15 Sequoia, Apple defaults to using a rotating MAC address for WiFi connections, labeled as a “Private Wi-Fi Address” in System Settings. To prevent connectivity issues related to this feature, VPN Tracker 365 reports the actual hardware address (with the minor modification described above) instead of the one used in “Rotating” or “Fixed” modes.

On iOS, VPN Tracker cannot retrieve a MAC address directly. Instead, it generates a random value once and stores it for future use. VPN Tracker for iOS then uses this stored value as the MAC address.

• If the app you want to quit is in your dock, hold the "Option" (⌥) key and right-click on the app icon, then, select "Force Quit" from the menu.
• You can also hold down "Option" (⌥) + "Cmd" (⌘) + "Esc" which will trigger a window with a list of apps you have running. To force quit one or more of these apps, simply select it from the list and click the "Force Quit" button.

VPN Tracker Pro is a great asset if you are a consultant, a system or network administrator, or are working with multiple VPN connections:

• Export VPN connections for yourself and other users.
• Scan the remote network for services or to assist users.
• Connect to multiple VPNs at the same time.
• Manage a large number of VPNs using search, a condensed layout, and connection groups.
• Configure your Mac as a router to provide the entire network with a VPN tunnel using Network to Network connections.

VPN Tracker Personal Safe is secure encrypted cloud storage for your personal VPN connections and shortcuts.

How to save a connection in Personal Safe

Not sure if your VPN connection is backed up? The safe icon in the connection list indicates whether a connection has been stored in your Personal Safe:

To add a connection to your Personal Safe, simply right click the connection and select 'Add to Personal Safe' for access across all your devices.

Why should I use Personal Safe?
VPN Tracker Personal Safe makes using VPN more reliable and secure:

Security
Personal Safe adds an additional level of security to your connections: all your connection details are encrypted using a highly-secure key (Argon3 + PKTNY) that only you can unlock.

Backup
Lost iPhone? Broken Mac? Personal Safe keeps your connections safe, so you can instantly get them on your replacement device. Sign in with your secure key and they are instantly downloaded and ready to go.

Use your connections on all your devices
iMac at home and iPad for the road? Your Personal Safe keeps your connections synced across all your devices – securely and effortlessly.

How are connections stored?
When you add a connection to your Personal Safe, it is encrypted using your personal encryption keys and then uploaded to a secure cloud storage location. It can only be accessed with your user credentials and encryption key.


Is Personal Safe secure?
Personal Safe has been designed from scratch for VPN connections. Unlike other storage systems that rely on passwords and leave files unencrypted, Personal Safe encrypts all your connections with keys that only you can use.

That means connections are

• Encrypted on your device and
• Stored on encrypted storage at my.vpntracker.com that only you can access

Even if someone could get access to your Personal Safe, the key-based security means they can't access the encrypted connection information without your password.

We've designed the system so no-one (including the VPN Tracker team) can access or unlock your connections.

Open the VPN Tracker 365 app and go to "VPN Tracker 365" > "Preferences"
Next to "Update", check the box "Get early access to Pre-Release versions"
From the drop down menu, select "Nightly Builds"

Your equinux ID is your personal account at equinux. You can use it to purchase and activate products & licenses.

The first time you shop in our online store, you'll be asked to create an equinux ID. After your purchase, software licenses are automatically linked to your equinux ID and can be activated by simply entering the same equinux ID and password you used during purchase.

Retail boxes and certain products may still require an Activation Code. Once entered, the product will be linked to your equinux ID.

If you have forgotten your equinux ID and/or password, use our login & password retrieval form.

By itself, the IPsec protocol does not support usernames. If you were given a username from your network administrator for connecting to your corporate VPN solution, there are generally two possibilities:

• Your corporate VPN solution uses the term "username" for "identifiers". Please try to use your username as the "Local Identifier" in VPN Tracker.
• Your corporate VPN solution is using Extended Authentication (XAUTH). You can enable XAUTH in VPN Tracker. The software will then prompt for your username and password when the connection is being established.

A Technical Support Report contains your VPN Tracker settings and relevant network and system settings that our technical support team needs to be able to assist you quickly. Confidential data (e.g passwords, pre-shared keys, private keys) are not included in a Technical Support Report (TSR).

How to create a Technical Support Report on a Mac:

‣ Click on your VPN connection in VPN Tracker 365.
‣ In the bottom right corner under the "Status" tab, you will see the TSR button.
‣ Click the button to generate the report and follow the instructions to send to our support team.

‣ Tap on the connection. The connection card appears.
‣ Tap on “Feedback”
‣ Provide a short description of the connection problem
‣ Tap on Send

If you have an issue connecting to the VPN in the first place, please make a connection attempt right before creating the Technical Support Report, then create the Technical Support Report as soon as the connection attempt has failed.

If you can connect to the VPN, but something is not working right after the connection has been established, please establish the VPN connection, then create the Technical Support Report while the VPN is connected.

You can either email the report directly to our support team from VPN Tracker 365, or save it to email later or from a different computer, or to upload it using the contact form on our website:
{S_1181}

Whenever possible, also include screenshots of the VPN setup on your VPN gateway.

If you need to transfer a license to another equinux ID, you can easily do this yourself at my equinux.

‣ First log in with your equinux ID and password: http://my.equinux.com
‣ Click the checkboxes for each product that you want to transfer
‣ Click the "Transfer" button below and enter the equinux ID or email address of the new license owner and click next.       
‣ Finally click "Confirm" to complete the transfer. The system will transfer the license, display a message and email both the old and new license owner that the license has been transferred.

Configuration guides for configuring VPN Tracker with Cisco devices are available here.

Configuration guides for Cisco Small Business (Linksys) devices are available here.

Import of Cisco IPsec VPN Client Configuration Files (.pcf)

Cisco VPN Client configuration files that use group password authentication can be imported into VPN Tracker:

‣ "File" > "Import 3rd Party Configuration" > "Cisco .pcf"
{S_118}

• VPN Tracker 365: Download here
• An internet connection
• A VPN Router/Gateway

Create a new connection

‣ Click on the plus symbol in the bottom left corner:

{S_670}

‣ Choose: "New Company Connection"

Choose your VPN Router

‣ In the list of VPN Gateway vendors, choose the manufacturer and model of your VPN router. In case your VPN router does not appear in the list, try the following:

‣ Choose "Use custom device profile." 

‣ Click on "Create" to add your VPN connection.

{S_672}

Your configuration guide

Option 1: Manual Access:

Open Finder.
Open the "Go" menu.
Choose "Connect to Server..."
Enter the IP address (e.g."192.168...")
Click "Connect".

That's it! Now you have access to your files in Finder for this session. Please note, you will have to carry out these steps each time you need to connect.

Option 2: Creating a Shortcut:
You can also create a shortcut to your server within the VPN Tracker app, meaning it will be saved for whenever you need to access the server.

Go to "VPN Shortcuts" in the app menu.
{S_677}

In the shortcuts section, click on the bottom menu and drag out the File Server icon.
{S_678}

Choose a VPN connection and a server to create your shortcut. If your chosen server does not appear on the list you can also enter it manually.

After you have completed these steps your connection will be saved in the shortcuts section for whenever you need to use it.

This video tutorial shows you how to quickly create a VPN Shortcut to a file server...

VPN Tracker strictly follows Apple’s recommendation regarding where to place its files, so you will find VPN Tracker files only in standard system locations where they belong. Depending on the fact if these are system-wide or per-user files, they are either found in /Library (system-wide) or ~/Library (per-user), where ~ is a placeholder meaning "home of the current active user".

To access the system-wide library folder:

‣ In Finder Choose "Go" > "Go to Folder ..." 
‣ Enter /Library

To access the user library folder:

‣ In Finder Choose "Go" > "Go to Folder ..." 
‣ Enter ~/Library

Tip: Also remember to check your Keychain for VPN Tracker items (search for "VPN Tracker")

Note: Some of these files may be currently loaded by the system, and some may be cached. To make your system as clean as if VPN Tracker had never been installed on it, you will also need to uninstall the application itself and then reboot your system. After the reboot, the system will automatically remove any remaining VPN Tracker components not mentioned above, as those reference the application itself and will vanish as soon as the application is gone (some of those can otherwise not be deleted).

• Log in to your account at my.vpntracker.com
• In the Teams view under "Subscriptions", you will see a list of both your active and your expired plans
• To renew an expired plan, please click on: “Reactivate license
• You will then be shown your available plan options

• Grandfathering pricing is exclusively available for customers using the automatic renewal option. If your plan has expired, you can re-obtain VPN Tracker for the current price tier
• After starting your new plan, you will regain full access to your account including your Personal Safe and Team Management features.

• Send keep-alive ping every

  This option controls whether and how often VPN Tracker sends keep-alive pings. A keep-alive ping is not a normal ping, and is not considered tunnel traffic by the VPN gateway, so it does not keep the connection alive at the gateway. The sole purpose of these pings is to keep the connection alive through firewalls and NAT routers between VPN Tracker and the gateway when no other tunnel traffic is being sent.

• Disconnect if inactive for

  This option controls if and after how long VPN Tracker will disconnect due to inactivity. Only tunnel traffic is considered activity, keep-alive pings sent from either side and protocol management traffic are not considered tunnel traffic.

• Consider the peer dead if no sign of liveliness for

  This option controls if and after what time VPN Tracker will disconnect due to no sign of life. Any traffic from the gateway is considered a sign of life, regardless of whether it is tunnel traffic, keep alive ping, or protocol management traffic.

  This option has no effect if the gateway is not configured to send pings (--ping option or ping in the server configuration file), because without pings enabled, there may be no tunnel or management traffic for quite some time, but this is not proof that the gateway is no longer alive, since it won't send anything if there is nothing to send. With ping enabled, the gateway would at least send keep-alive pings in such a situation, and if those don't arrive either, the gateway has most likely dropped the connection or gone offline.

The VPN Tracker 365 Connection Checker helps determine which VPN protocols your current internet connection supports. This is particularly useful in places like hotels, cafés, or offices, where network restrictions may apply.

Understanding the Results

• ✅ Green Check Mark: The protocol was successfully tested and is expected to work on your current network.
• ⚠️ Yellow Exclamation Mark: The test was inconclusive. The protocol may or may not work due to network restrictions or unstable conditions. You can try connecting, but success isn't guaranteed.

Why is a VPN Protocol Not Working?

If a protocol gets a ⚠️ yellow exclamation mark, possible reasons include:

• Network Restrictions – Some Wi-Fi networks (hotels, workplaces) limit or block certain VPN protocols.
• Firewall Rules – A firewall may be filtering VPN traffic, preventing stable connections.
• ISP Limitations – Some internet providers restrict or throttle VPN usage.
• Router Settings – Your router may not allow VPN passthrough for certain protocols (e.g., PPTP, L2TP).
• Double NAT Issues – If you're behind multiple routers (common in hotels, mobile networks), VPN connections can be disrupted.
• Unstable Internet Connection – High packet loss or weak connectivity can interfere with VPN protocols.

Explanations for the VPN Connection Test for IPsec

For IPsec, at least the ESP (Encapsulating Security Payload) or NAT-T (Network Address Translation Traversal) protocol must function to establish a stable VPN connection. Often, ESP is not usable in certain environments, such as due to firewall settings or network configurations. However, as long as NAT-T is available, the connection can still be established.

What to Do If a Protocol Fails?

• Switch networks – If possible, test from a different Wi-Fi Network
• Try a mobile hotspot – Create a hotspot with your mobile phone and test if you get a different result
• Try a different protocol (e.g., if IKEv2 is unstable, try OpenVPN).
• Check router settings if you're on a home or office network.
• Use VPN Tracker's built-in troubleshooting tools for more insights.

With the VPN Tracker Connection Checker, you can quickly identify network issues and choose the best protocol for a stable connection.

Yes, as long as your VPN gateway uses Extended Authentication (XAUTH) to request the passcode, you can use any third party token with VPN Tracker.

Testing VPN throughput using a remote file share is usually not a good idea for two reasons:

The first reason is the file sharing protocol itself. File sharing protocols like SMB, AFP, or NFS have been designed for local networks that are fast, reliable, and have a very low latency. The Internet on the other hand is slow (at least the connection to it), unreliable and has a very high latency. For realistic results, you need to use a protocol that was optimized for such a situation, like HTTP or FTP.

The second reason is the implementation of the file sharing protocol. Today most file shares use SMB, the Windows file sharing protocol. Apple has its own implementation of that protocol but this implementation is anything but good. While the SMB 3.x implementation is already poor, the SMB 1.x/2.x implementation (compatibility mode) is horrible, and for several reasons macOS will often fall back into that compatibility mode. When testing with a local NAS file share, we got 28 MBps using SMB 3 and only 18 MBps using SMB 1, compared to 50 MBps using AFP.

If you have a Mac at the remote side, it’s pretty easy to setup a benchmark HTTP server. All you need is to open the standard application “Terminal” (use spotlight to find it) and then run the following set of commands (every command is confirmed by Return/Enter):

mkdir /tmp/www-bench
cd /tmp/www-bench
dd count=1048576 bs=1024 if=/dev/random of=1GiB.dat
php -S 0.0.0.0:8080

The First command creates a new directory, the second one enters that directory, the third one creates a 1 GiB data file filled with random data, the last one starts a primitive HTTP server that serves the content of the current directory at port 8080. Now your VPN users can just open this address in Safari (or any other browser):

http://a.b.c.d:8080/1GiB.dat

Where “a.b.c.d” is the IP address of the Mac where you just typed the commands above. By watching the transfer speed in browser, you get a good idea of how capable your VPN is. Of course, this is limited by many factors, like the speed of your local Internet connection, the speed of the remote Internet connection, and the CPU power of the VPN gateway (which is usually far less than the CPU power of a Mac).

To clean up after the test, activate the terminal window again and hit CTRL+C to stop the HTTP server, and finally run the following two commands:

cd
rm -r /tmp/www-bench

Please go to"Configure" > "Advanced" > "Additional Settings"

• Always prompt for XAUTH credentials is not checked.
  If this option is checked, VPN Tracker will in fact always prompt you, whether it finds credentials in your keychain or not.
   
• Use stored XAUTH password as passcode is not checked.
  If this option is checked, VPN Tracker assumes that the password stored in keychain is in fact a passcode and it will only hand it out to the gateway if the gateway asks for a passcode. If it asks for a password instead, VPN Tracker doesn’t have any such info and thus asks you to please provide one.

‣ Open "System Preferences."

‣ Click "Language & Region."

{S_519_50%}

‣ Change to your preferred language by dragging your selected language to the top of the list.

{S_520_50%}

‣ Close your software. For example, with VPN Tracker, you can do so by choosing "VPN Tracker" > "Quit VPN Tracker."

{S_525_30%}

‣ Reopen the software.

Are you seeing a 'Server certificate' error message whilst activating your equinux software?

One likely cause is your system's date & time: Make sure your system clock is set correctly by checking 'Set date & time automatically' under System Preferences > Date & Time.

We also use a fairly new security certificate to protect your data. However, older versions of OS X might not immediately recognize the certificate.

To make sure OS X will recognize the certificate, you could try one of the following two fixes:

Run Software Update

‣ Go to the System Preferences and select "Software Update"
‣ Install any available system updates 
‣ Afterwards, restart and try activating again

Disable your firewall

Please make sure you are not running any firewalls which may block access to our activations server. Applications you may wish to disable temporarily include:

• Mac OS X Firewall
• LittleSnitch (Litte Snitch Configuration - Preferences … - General - Stop)
• Intego NetBarrier

Disable your proxy

In some cases the use of proxies may interfere with certain certificates stored in your Keychain.

‣ Open System Preferences
‣ Go to the "Network" section
‣ Choose your network connection and click "Advanced…"
‣ Uncheck any proxies you may have configured and click "Ok"

Check your Keychain

‣ Open: "Application" > "Utilities" > "Keychain Access" 
‣ Select "Keychain Access" > "Keychain First Aid"
‣ Enter your OS X account password, select Repair on the right and hit Start

Install the root certificate manually

• Download the latest Let's Encrypt root certificates
• Double-click to add the certificate to your Mac's keychain
  Tip: If you have multiple users on the Mac, add it to the 'System' keychain to fix this problem for all users
• Double-click the new entry "ISRG Root X1" to open the trust settings
  
  {S_1288}
  
  
• Under "Trust", choose "Always trust"
  
  {S_1289}
  
  
• Close the window and confirm with your Mac user password

You should now be able to activate your software using your equinux ID and password.

VPN Tracker 9 & VPN Tracker 10

You can view a copy of all your invoices in our Online Store:

You will find the invoices for your VPN Tracker 365 purchases in the section "Invoices", here:

http://my.vpntracker.com

You work in accounting and need access to the VPN Tracker invoices for your company? Please ask your VPN Tracker Team manager to invite you to you company's team with the role "Accounting". Afterwards you will receive emails as soon as a new invoice is available and you can dowload this from the web portal

‣ If you would like to save a PDF copy of your invoice, then do the following:
 Press "Command + P"  
 Choose "PDF" > "Save as PDF"

We ask for your email address in order to track the flow of our downloads and, if selected, send you news and updates about the product you've downloaded.

All information collected by equinux is used internally and will never be shared with any third parties without your permission. For more information about equinux's stance on privacy and security, please refer to the equinux Privacy Policy.

If you do not want to receive our newsletter, just unsubscribe using the link at the bottom of every newsletter you receive.

We use analytics in VPN Tracker 365 to help us improve the app and your overall VPN experience. All measurements are completely anonymous and we never evaluate any personal information or any data going through your connection.

What is measured

• Generic connection settings (e.g. what type of connection it is, which options are being used etc.)
• Which features are used (e.g. is auto-connect enabled, are any actions configured etc.)
• How many connections you have

Your data, your privacy

• Your authentication details and credentials are never read, captured or transmitted
• Your VPN traffic is never analyzed, captured or accessible

You’re in control

If you’d prefer not to share any anonymous usage information with equinux, you can deactivate this option at any time in VPN Tracker’s preferences by unchecking 'Share diagnostics data'.

Please don't go! :-(

If you're sure that your time with us is at an end then we've made it nice and easy to remove all your info from our database so that you don't need to wait for us to do it.

Just log in at your License Manager, click 'Edit your Account' on the left hand navigation panel and, after a tearful farewell, click 'Delete Account'.

If you do leave then we'd like to say thank you, bye and come back soon!

You can manage all of your VPN Tracker plans after logging in to our website https://my.vpntracker.com using your existing equinux ID and password.

Here you will find all information about your subscriptions and payments and can manage your colleagues' VPN Tracker plans.

We offer a free trial version of all available VPN Tracker plans so you can test your VPN connections with VPN Tracker before purchasing. VPN Tracker Mac Trial licenses are valid for 7 days and offer the exact feature set of the appropriate plan so you can fully test all features of the plan. You're able to test all connections and protocols to ensure your connections works before purchasing. If you are happy with VPN Tracker, you won't need to do anything to continue using it. All your created connections and settings will remain in the app and the trial license will convert to a paid license after the trial period. Otherwise you can cancel your trial license up to 24 hours before the end of the trial period.

Get the free VPN Tracker trial

SonicWALL Simple Client Provisioning enables VPN Tracker to automatically retrieve the settings for the VPN connection from supported SonicWALL VPN gateways. For most users, it is only necessary to configure the SonicWALL's WAN IP address in VPN Tracker – everything else happens automatically.

For a list of supported SonicWALL devices, please refer to this FAQ.

Yes, NAT-Traversal is supported by VPN Tracker. VPN Tracker supports the current version of NAT-Traversal that uses UDP encapsulated packets on port 4500 (RFC 3947), as well as previous draft versions that send UDP encapsulated packets on port 500. In addition, Cisco's UDP encapsulation is also supported.

NAT-Traversal helps to establish VPNs from networks behind routers that perform Network Address Translation (NAT). Such routers can be found in many places: home DSL routers, wireless hotspots, Internet cafes, hotels, airports, etc. Many mobile ISPs (3G modems) also require NAT-Traversal to be used.

VPN Tracker automatically recognizes if NAT-Traversal is needed, and turns it on and off accordingly. It can even test your local router to see what NAT-Traversal method works best with it.

You can assign different roles to Team members, which give them access to certain features.

Note: Roles are currently being rolled out – if you do not see the role dropdown option in your Team, please reach out and we can set your team up.

You can assign the following roles:

Recently, root certificates for "Let's Encrypt" expired. Apple has decided not to update root certificates for OS X versions older than macOS 10.12. This means that when apps or Safari on your Mac access websites using Let's Encrypt root certificates, they will not load correctly.

Note: this is a general OS X issue that you will want to address to ensure you can access all websites and services.

This issue also affects the secure communication between VPN Tracker and the my.vpntracker.com account service.

1. Download the latest VPN Tracker version for your system:
   • Mac OS X 10.9 or 10.10: VPN Tracker 365 20.0.1
   • Mac OS X 10.11: Get the latest VPN Tracker 365 version
   
   
2. Install the root certificate fix
• Visit our certificate fix page
• Download the fix
• Open the profile in System Preferences and choose "Install"


3. Re-launch VPN Tracker and sign in again

If you are still experiencing the same problem, please try this:

• Open Safari
• Go to Preferences > Privacy > Manage website data
• Search for 'equinux' and 'vpntracker' and choose 'Remove all'

Older VPN Tracker versions may also have issues due to certifcates as described above. As these versions are end-of-life, we can no longer offer support for them. The steps above should also apply to these versions. For support and to use VPN Tracker on the latest macOS versions, please switch to a new VPN Tracker plan.

You need to enter your equinux ID and password to activate most equinux applications. However sometimes applications will also require you to enter your Mac OS X user password in order to access certain required system components.

So if you see a window like the one below, you'll need to enter the username and password of an Administrator account on your Mac to proceed, not your equinux ID and password.

If your credit card is being refused, please check the following information, for possible mistakes or mismatches :

• Please check the credit card number you have entered carefully for possible typos
• Make sure the expiration date entered is correct
• Check whether the security code you entered matches the code on your card: American Express cardholders can find the 4-digit code on the front of their card, other cardholders can usually find a 3-digit code on the back.
• Try another credit card, if you have access to one
• If you are certain your information is correct and your card is still not being accepted, it might be due to a technical issue with our credit card gateway. Please try again later.

• VPN Tracker 365: Download here
• An internet connection
• A VPN Router/Gateway

Create a new connection

‣ Click on the plus symbol in the bottom left corner:
{S_300}
‣ Choose: "New Company Connection"

Choose your VPN Router

‣ In the list of VPN Gateway vendors, choose the manufacturer and model of your VPN router. In case your VPN router does not appear in the list, try the following:
‣ Choose "Use custom device profile." 
‣ Click on "Create" to add your VPN connection.
{S_301}

Your configuration guide

What does Extended Diagnostics mean?

• File Servers
• Company intranet & internal websites
• Company email accounts
• Internal databases
• Remote Desktop
• Internal calendars

VPN Tracker is licensed per user. That means each person using VPN Tracker needs their own license.

To prevent security issues, account sign-ins are checked by an automatic system. There are multiple possible causes that can trigger an account lock:

• Sharing one account with other people
• The account is being used as a "generic" account (e.g. "Lab computer 1"), instead of being personalized for one person

• Go to my.vpntracker.com
• Sign in with your equinux ID
• Go to "My Subscriptions" and choose "Add plans…"
• Add additional licenses for each person that needs VPN access and complete your order
• Once you have the correct number of licenses for your team, assign the new licenses to your co-workers – check out our Team Setup Guide for step-by-step instructions

Once you have completed these steps, please contact our support team and include your equinux ID and order confirmation number. A team member will review your details and will be able to lift the restrictions on your account.

For any other questions, please reach out to our Account Security Team.

Please try this:

Open the Terminal app (from Applications → Utilities → Terminal) and paste in this command:

sudo launchctl enable system/com.vpntracker.365mac.agent

The problem should be resolved.

Yes, VPN Tracker supports IPsec (IKEv1 + IKEv2), L2TP (Mac only), PPTP (Mac only), OpenVPN, SonicWALL SSL VPN, Cisco AnyConnect SSL VPN, Fortinet SSL VPN, SSTP VPN, and WireGuard® VPN (Beta - learn more). Additional protocols are on our roadmap.

WireGuard is a registered trademark of Jason A. Donenfeld.

You can create and edit connections right inside my.vpntracker.com using any browser. Thanks to advanced engineering, this works with the same data security you know from VPN Tracker on the Mac.

It works like this

• Choose your device brand and model
• Enter your connection details

To save your new connection:

• You enter your equinux ID password
• Your encrypted secure master key is fetched from my.vpntracker

Now a program is run locally on your device through your browser that handles encryption:

• The local encryption program decrypts the master key on your device
• Then it uses your master key to encrypt the new connection data
• The fully encrypted connection is then uploaded to your Personal Safe or TeamCloud on my.vpntracker
• Your Mac, iPhone or iPad can then fetch the encrypted connection, ready for you to connect

So there you have it. Integrated connection editing on my.vpntracker with the full security and end-to-end encryption you know from VPN Tracker for Mac.

• You'll need to be a Manager or Organizer in your team – multi-admin support is currently rolling out to teams – reach out if you'd like this enabled for your Team right away.
• Select a connection in VPN Tracker and choose the 'Share with Team' option from the Status or Configure views

The person receiving the connection needs to be a member of your VPN Tracker team and has to have set up their TeamCloud encryption keys.
This happens automatically when they open VPN Tracker and other Team members are online. If another team member is not available, their TeamCloud setup can also be confirmed by a Team manager under my.vpntracker.com.

1. Make sure your connections are stored in your Personal Safe or in TeamCloud (look for the safe or cloud icons in the Status tab)
   
   {S_1278_50%}
   
   
2. Sign out of VPN Tracker 365 on your old Mac (choose "VPN Tracker 365 > Sign out… " from the menu bar)
3. Sign in to VPN Tracker 365 on your new Mac with your equinux ID and password

There are three possible causes for this:

1. equinux is constantly improving VPN Tracker 365 and as a result VPN Tracker has a high update frequency. Especially if you don’t use VPN Tracker on a daily basis, it’s not unlikely that we already released an update since the last time you were using VPN Tracker. Sometimes there are less than 24 hours between updates, especially with security fixes where it's critical they are released as soon as possible.
    
2. If you were using an older VPN Tracker version, it may be required to install an intermediate update first before you are be able to install the most up-to-date version. In that case you may install an update and directly on next launch VPN Tracker may offer another update.
    
3. You might have multiple copies of VPN Tracker installed on your system. For technical reasons updates to VPN Tracker 36517.0.6 and below have to be installed using the system installer and if multiple copies of VPN Tracker exist on your system, the installer may choose to update the wrong copy. To solve that problem:
    

   ‣ Place a copy of VPN Tracker into a dedicated folder (we recommend the Applications folder).
    
   ‣ Use Spotlight to find copies in other folders.
   (Hold down the CMD key in Spotlight to quickly see the location of a hit)
    
   ‣ Delete all copies that are not in the dedicated folder.
    
   ‣ Finally start VPN Tracker from the dedicated folder and re-apply the update.
    

   
    

If you have a charge from equinux on your credit card that you do not recognize, it may be for one of the following products offered through the equinux Online Store:

• VPN Tracker (VPN software for Mac, iPhone and iPad)
• Mail Designer 365 (email newsletter design software for Macs)
• tizi (iPhone and iPad accessories)

Common scenarios

Auto-renewing products

VPN Tracker and Mail Designer 365 are offered as subscriptions. When a plan has been configured to auto-renew, the associated payment method will automatically be charged.

Additional team-members added

If multiple employees are using one of our products, they may have configured team billing. This means the associated credit card may have been charged, in order to add a new team member to an account.

Invoices and other questions

You can download your invoices from our website:

• VPN Tracker Invoices
• Mail Designer 365 Invoices
• Other equinux invoices

If you have checked with your team and still have additional questions regarding a charge, please contact our support team. Be sure to include the details from your credit card statement and the last 4 digits of your card.

• Security software (e.g. virus scanners, Malware blockers)
• Malware or Adware

• Kaspersky

• Open the VPN Tracker Connection Creator for PPTP VPN
• Enter the IP address or Host Name of the PPTP server you want to connect to, then follow the remaining steps in the setup wizard
• Save your new VPN connection in your account using secue end-to-end encryption to start using on your Mac

• Creating a VPN Tracker team
• Inviting team members
• Assigning VPN Tracker plans to team members
• Using the package installer and onboarding tools
• Sharing VPN connections
• Managing billing and invoices for your team

VPN Tracker has three settings that can speed up connecting to Cisco devices and improve compatibility.

• Establish a shared tunnel to 0.0.0.0/0 for split-tunneling
• Send Cisco firewall attribute
• Use ... as the application version during Mode Config

Note: All settings described on this page require VPN Tracker 6.2 or newer.
 

Establish a shared tunnel to 0.0.0.0/0 for split-tunneling

What does this setting do?
In a split-tunneling setup using EasyVPN, VPN Tracker will no longer establish an IPsec Security Association (SA) to each remote network, but establish a single SA to 0.0.0.0/0. Split-tunneling is achieved only through an appropriate routing setup. This can speed up the connection processes significantly for connections with multiple remote networks.

When should I use this setting?
The setting works with most Cisco devices that use EasyVPN and a split-tunneling setup.

How can I try it?

On the Advanced tab, uncheck the box “Establish a separate tunnel for each remote network” (see screenshot)
Make sure the box “Establish a shared tunnel to 0.0.0.0/0 for split tunneling” is checked (see screenshot)

If your connection does not work with this new setting, simply revert back to your previous setup by checking the box “Establish a separate tunnel for each remote network”.

Send Cisco firewall attribute

What does this setting do?
This setting causes VPN Tracker to send a special attribute during EasyVPN indicating the presence of a firewall.

When should I use this setting?
You can try enabling this setting if your current EasyVPN-based connection to a Cisco device gets dropped at phase 2 (“The VPN gateway asked VPN Tracker to disconnect...” error).

Use ... as the application version during Mode Config

What does this setting do?
This setting causes VPN Tracker to send a different application version than the default “VPN Tracker 6” during EasyVPN and Mode Config.

When should I use this setting?
You can try setting a different application version, e.g. “Cisco Systems VPN Client 4.8.0:Linux” if your current EasyVPN-based connection to a Cisco device gets dropped at phase 2 (“The VPN gateway asked VPN Tracker to disconnect...” error).

• Download VPN Tracker 365
• Create an account
• Verify your email address

• Log in to you your account at my.vpntracker.com
• Go to "My Plans and Billing" in the sidebar, where you will see your current active plan(s), in case your plan is a team plan, please go to "Team Plans and Billing" in the sidebar
• To deactivate your renewal, flip the switch from blue to grey {S_1139}
• After deactivating auto renewal, you will receive an email confirming the deactivation.

• Personal Safe White Paper
• VPN Tracker Personal Safe features

http://www.vpntracker.com/interop

For a general introduction to computer networking, VPNs and IPsec, there are several excellent introductions available online or as books, see for example here.

If you experience specific configuration problems, our technical engineers are happy to provide support for setting up VPN connections with VPN Tracker. In many cases, connection problems are related to misconfiguration of either VPN Tracker or the VPN gateway.

If you provide

• A problem description and information on what you've already tried
• A Technical Support Report from VPN Tracker ("Help" > "Generate Technical Support Report")
• Screenshots of the VPN gateway configuration
• A log from the VPN gateway

we can usually quickly spot the cause for a problem and provide advice on how to resolve it.

As there are several factors unrelated to VPN Tracker or the VPN gateway that can influence connectivity (e.g. firewalls/routers in between VPN Tracker and the VPN gateway), we cannot guarantee that a connection can be established under any circumstances.

While we try our best, our support options may be limited if

• you use a device which we did not test ourselves (most devices work just fine with VPN Tracker, though, and we're happy to take a look even at issues with untested VPN gateways)
• you do not provide the information we need in order to assist you (see above)
• your network administrator does not cooperate
• you change connection parameters while we're trying to debug the settings

• PPTP VPN connections are not supported, as iOS and Android do not support PPTP passthrough
• For IPsec VPN connections, it's possible you may have to adjust your settings for NAT-T.

1. Germany
   
2. Austria
   
3. United States
   
4. Australia
   
5. Brazil
   
6. Canada
   
7. France
   
8. Japan
   
9. Luxembourg
   
10. Netherlands
    
11. New Zealand
    
12. Singapore
    
13. Spain
    
14. Sweden
    
15. Switzerland
    
16. United Kingdom
    

‣ Choose "File" > "New" > "World Connect Destination"

{S_402_50%}

‣ Then, choose "World Connect" and "Countries"

{S_403_50%}

‣ Check your country of choice:

{S_404_50%}

• macOS 15.0 Sequoia
• macOS 14.0 Sonoma
• macOS 13.0 Ventura
• macOS 12.0 Monterey
• macOS 11.0 Big Sur
• macOS 10.15 Catalina
• macOS 10.14 Mojave
• macOS 10.13 High Sierra

WireGuard is a registered trademark of Jason A. Donenfeld.

This error occurs when VPN Tracker lacks the necessary permissions to configure system VPN settings. Possible causes include:

• An incomplete installation.
• macOS reaching its limit on VPN configurations due to existing VPN setups from other apps.

How to Fix:

1. Check Existing VPN Configurations:

• Open System Settings and navigate to the VPN section.
• Review all listed VPN connections, paying special attention to duplicate or outdated configurations.
• Remove unnecessary VPNs, particularly those from other apps.
• If you only have one other VPN configuration listed, remove it.

2. Restart VPN Tracker and Add the VPN Configuration:

• Launch VPN Tracker and attempt to add the VPN configuration again.
• If macOS prompts for permission to modify VPN configurations, click "Allow"—it should not require an admin password at this stage.
• Try connecting through VPN Tracker again. It should now work without any issues.

3. Restore Other VPN Connections:

• Open the other VPN app whose configuration you removed earlier.
• The app should prompt you to re-add its VPN configuration.

By following these steps, you should be able to resolve the permission error and successfully establish a VPN connection using VPN Tracker.

Are you using virtualization software, such as VMware, Parallels or VirtualBox? These software products create network interfaces for their internal networking needs, and sometimes the network addresses they choose happen to conflict with the remote network of a VPN connection. Even if you are not currently using this software (but have it installed or not completely uninstalled) their network interfaces exist and can cause conflicts.

To find out which network interface is causing the conflict:

1. Attempt to connect to your VPN (so the error message appears in the VPN Tracker log)
2. Set the log level in VPN Tracker to “verbose”
3. Look for a line that says
   Remote network ... conflicts with local network ... of interface ...

This is the network interface that is causing the problem. On most Macs, “en0” will correspond to the Ethernet interface and “en1” to the AirPort interface. Any other enX interfaces are either from virtualization software, or from additional network hardware (e.g. USB network adapters/modems). Network interfaces whose names start with “vboxnet” generally belong to VirtualBox and network interfaces starting with “vmnet” to VMware.

• If the network interface is a "real" interface, see this FAQ for more information.
• If the interface is virtual, change the network address(es) used by the virtualization software. More information can be found in this FAQ.

In our online store we accept a variety of payment methods:

• Visa
• Mastercard
• American Express
• PayPal*
• Personal/Business Checks* (US Orders Only)
• Bank Transfers* (European Union Only)

* License will be emailed to you once your payment has cleared.

When paying my check or bank transfer, you will receive an email with additional payment details once you have placed your order. Bank Transfer and Check orders are currently not available for Mail Designer Purchases

By default Zyxel creates firewall policies to allow traffic to flow from SSL VPN to LAN zone and from LAN to SSL VPN zone. Those rules are required to allow VPN traffic flow once the connection has been established. But there is no policy that actually allows VPN management traffic at the WAN port, client requests arriving at the WAN port are discarded by the firewall.

To allow an OpenVPN connection on the WAN port, you first have to create an own policy. In the main navigation, select Security Policy > Policy Control, click on the + Add button and create a policy that allows traffic for the service SSLVPN to flow from WAN to ZyWALL. Please see screenshot below.

Yes, this is possible. If you set up shared networking for the guest operating system it shares the network connection of your Mac and you can access all network resources that are accessible from OS X.

Note that if you are using remote DNS for your VPN connection, you will need to manually enter the DNS server in your guest operating system in order for it to work – there is no way for VPN Tracker to “transmit” this setting to the guest operating system

For information on how to set up VPN Tracker with Parallels, check out our VPN Tracker with Parallels Configuration Guide.

SonicWalls distribute IP addresses using the DHCP protocol. Once the VPN tunnel itself has already been established, the VPN client must perform a DHCP exchange to obtain an IP address and use this IP address for all traffic sent over the VPN tunnel. There are two reasons why this can fail:

1. The SonicWall never received your DHCP request (DHCP-Discover). That would be the case if there is an issue with the VPN tunnel itself not working properly.
   
   Try these:
   • Re-run the VPN Tracker Connection Checker from the "Tools" menu. Then try connecting the VPN again. This will let VPN Tracker automatically detect the best settings for your internet connection.
      
   • Make sure that you have no software installed that blocks VPN traffic in general. Please see this FAQ entry for more details.
      
2. The SonicWall doesn’t want to reply to your DHCP request. The DHCP protocol is designed in such a way that there can be multiple DHCP servers per network and only those who think they can fulfill a request will also respond to it, all others will stay silent (there is no “negative” response for discover requests).
   
   Try these:
   • Try rebooting the SonicWall. SonicWalls are pretty stable but we’ve seen it a couple of times that the DHCP server is acting strange, as if all IP addresses are reserved, yet that’s not what you will see in the web interface. Rebooting will fix that behavior at once.
      
   • Make sure you have sufficient addresses left in the address pool. If the pool is too small and all addresses are in use or reserved, it is expected behavior that the SonicWall doesn’t respond.
      

For a list of compatible devices, please refer to this page.

If you router is not in the list please refer to this FAQ and the VPN Tracker manual for help determining compatibility.

Please note that the local router (i.e. the router at the location where your Mac with VPN Tracker is) in most cases does not have to be specifically compatible with VPN or VPN Tracker. Almost all routers work fine with VPN Tracker.

• Choose your team or your account in the sidebar menu and click on Subscriptions
• Choose the plan you wish to upgrade and click on Upgrade edition

• Press "Shift" (⇧) + "Cmd" (⌘) + "4" then click and drag the mouse cursor to capture a specific area of your screen.
• Press "Shift" (⇧) + "Cmd" (⌘) + "4" and then the space bar to capture a specific window or element on your screen.
• Alternatively, press "Shift" (⇧) + "Cmd" (⌘) + "3" to capture your full screen.

• Go to my.vpntracker.com and sign in with your equinux ID and password.
• Under "My Subscriptions" in the sidebar menu, you'll see a list of your current VPN Tracker 365 plans.
• Activate automatic renewals to ensure your license is renewed at your current rate.
• Alternatively, you can let your current license expire and then purchase a new plan at the new customers rate from our online store.

When you share a connection using TeamCloud, it is encrypted and then shared with members of your VPN Tracker Team.

• TeamCloud uses strong encryption to protect all data
• The connection is encrypted using end-to-end encryption for each Team member individually
• End-to-end encryption means that we can never access your encrypted connection

• Pre-shared keys for a connection are automatically included, so your team members can connect right away
• The pre-shared key will not be added to a team member's Keychain, so they cannot access it

• Your username and password are not shared with your team, they are removed before the connection is shared
• Each Team member can enter their own username and password
• These can be stored inside their Keychain and additionally will be added as user-specific credentials to TeamCloud (only available to that team member)

• Remote Connection Wipe: By removing a team member from your Team, their access to TeamCloud is also immediately revoked. Any connections they have on their Macs will be removed automatically.
• Don't allow settings to be changed prevents users that aren't Team managers or owners from editing a connection

• VPN Shortcuts can be shared to TeamCloud directly

If you have any feedback regarding these settings, please get in touch and let us know your requirements.

Renewals can be canceled up until 10 days before their renewal date. The cancelation will take effect on the next possible renewal date. You can continue to use the software until the end of your term, at which point your subscription will end.

1. Trust the certificate in VPN Tracker manually

2. Turn off the certificate warning in the connection settings

• Network shares
• Databases
• Email accounts & calendars
• Company intranet
• Remote Desktop

Remote Connection Wipe offers additional security by removing information about your VPN infrastructure. You may also want to use Remote Connection Wipe for compliance purposes or when working with external contractors.

Remote Connection Wipe also has the added benefit of working with any VPN connection, even those that don’t offer user authentication. This lets you to block VPN access for an individual user without having to distribute a new connection to your entire team.

In certain circumstances, due to a bug in macOS, the Kernel Extension required by VPN Tracker may not be installed correctly by your System.

If that happens, you may see the error above.

To fix the problem, please try this:

• Go to Macintosh HD/Library/Extensions and delete the file com.vpntracker.365mac.kext
• Then open the Terminal app (under Applications > Utilities) and enter the following command:
  sudo kextcache --clear-staging
• Then reboot your Mac and try launching VPN Tracker 365 again

If the problem is not fixed, please try this:

• Restart your Mac and hold down Command+R to boot into Recovery Mode
• Choose "Disk Utility"
• Choose your harddrive and click "Mount"
• Exit Disk Utility
• Go to the menu bar and choose "Utilities > Terminal"
• Enter the following commands:
  cd /Volumes/Macintosh\ HD/Library/StagedExtensions/Library/Extensions/
rm -rf com.vpntracker.365mac.kext
• Restart your Mac and try launching VPN Tracker 365 again

Our activation process requires that your Mac accepts cookies.

‣ To check this, please open up Safari. 
‣ Click on "Safari" in the main menu at the very top of the screen.
‣ Choose "Preferences." 
‣ Select the "Privacy" tab and verify that cookies are always accepted. 
‣ Make sure JavaScript at "Security" is also activated. 
‣ Please close Safari.
‣ Restart the application and retry the activation.

No, you currently cannot undo remote connection wipe. However, you can reinstate a team member. Remember, you will need to redistribute your team’s VPN connections to the new user before they will be able to connect.

What's the point of a VPN?

Secure data

How do you establish a VPN connection?

‣ Go to "VPN Tracker" > "Refresh My Account"

{S_523_30%}

1. Go to my.vpntracker.com and log in with your reseller ID
2. Navigate to the Reseller section in the left hand menu, here you will see all of your orders and the plans you purchased with each order.
   
3. Next to the license(s) you want to Transfer to a customer select "Transfer all..."
   Please note, this button will only appear if the license is available for transfer.
   {S_1463_80%}
4. Enter the email address of the customer you are transferring the licenses to and press "Transfer".
   {S_1464_50%}

With VPN Tracker 365 you can create a team under https://my.vpntracker.com and assign each team member a VPN Tracker 365 Plan.
This will not give each team member access to your equinux ID. The team members will only see their assigned plan in their own equinux ID after logging in to https://my.vpntracker.com. You will stay the only admin of your equinux ID.

SonicWALL Simple Client Provisioning requires VPN Tracker to send an initial data packet to the VPN gateway that is so large that it may be split ("fragmented") into two IP packets. Some routers are known to not let these packets pass.

If a router between VPN Tracker and the SonicWALL is affected by this problem, you (or your SonicWALL's admin) will notice no connection attempt arriving at the SonicWALL when Simple Client Provisioning is turned on (i.e. there will be nothing in the SonicWALL's log, and a packet trace will show no packets from VPN Tracker), but everything will work fine with DHCP over IPsec.

Routers known to have these problems:

• AirPort Extreme with firmware versions prior to 7.3.1, works when upgraded to 7.3.1

• Log in to your account at my.vpntracker.com and select your team from the sidebar menu
• Under Subscriptions, you can see an overview of your existing plans
• At the top of the page you will see a "Merge Subscriptions" button. Press this. {S_1322}
• Select the plans you would like to combine by clicking on the checkbox on the left side next to each plan
• Once you have selected all plans, click Combine Subscriptions at the bottom of the window

The following article describes where VPN Tracker stores its data in case you need to make manual backups instead of using Time Machine.

VPN Tracker stores all its data files in the standard system locations as recommended by Apple. Depending on the fact if these are system-wide or per-user files, they are either found in /Library (system-wide) or ~/Library (per-user), where ~ is a placeholder meaning "home of the current active user".

To access the system-wide library folder:

In Finder Choose "Go" > "Go to Folder ..." 
Enter /Library

To access the user library folder:

In Finder Choose "Go" > "Go to Folder ..." 
Enter ~/Library

VPN shortcuts, all information related to your equinux ID, accounting data, scanner results, and window positions are per-user settings.

For a full backup of all your settings, you need to backup the following files and folders:

• /Library/Application Support/VPN Tracker 365
• /Library/Preferences/com.vpntracker.365mac.plist
• ~/Library/Application Support/VPN Tracker 365
• ~/Library/Preferences/com.vpntracker.365mac.plist

Backup your keychain
Please note that passwords in VPN Tracker are usually not stored in any of the locations named above but in your keychain. If you have no external backup of all your passwords, be sure to also backup your keychains which can be found in ~/Library/Keychains

• Go to Configure > Basic
• Click on the currently selected Profile under "Connection based on"
• Choose "IPsec/L2TP/OpenVPN/SSL/PPTP"
• Choose your VPN protocol from the list and click Apply
• Choose "Don't overwrite" to preserve the default settings for your device

VPN Tracker supports X.509 certificates (RSA Signatures) and smart cards using X.509 certificates (PKI tokens) for authentication.

For more information, see the VPN Tracker manual.

• Read the setup guide for Ubiquiti EdgeRouter
• See all supported devices and protocols

If you're not able to access your team's VPN connection via TeamCloud, please check the following:

• Make sure you have the latest version of VPN Tracker 365.
• You'll need to be a member of your company's VPN Tracker Team – contact your IT person if you haven't been added.
• If you have just been added to your Team, your Team manager will need to launch VPN Tracker or go to my.vpntracker.com to complete your TeamCloud setup.
• If you see some, but not all of your Team's TeamCloud connections, you may need to upgrade your license to access them all.

If your question isn't answered above, please get in touch.

If you use Shimo and have found that it has stopped working, check out VPN Tracker.

Alternative to Shimo 5

VPN Tracker supports many of the same VPN protocols as Shimo, but is built to support new Macs and macOS releases, including macOS Sonoma and new macOS Sequoia.

Install the free VPN Tracker 365 trial and set up your VPN connection. Once you're connected, choose a VPN Tracker plan for ongoing updates, compatibility with the latest macOS releases and professional support.

First, start VPN Tracker and create a new free user account to start your trial. Now we can set up your VPN connection:

• In VPN Tracker, go to File > New > Company Connection
• Choose your VPN gateway manufacturer and device model
or
• Go to Protocols and select your VPN protocol

Now you have a connection, you'll need to enter the connection details. You can look up some connection details in your Mac's Keychain:

• Go to Applications > Utilities > Keychain Access
• Search for "Shimo" in the top right corner
• You'll find entries named "Shimo: vpn.example.com" – where "vpn.example.com" is your VPN's gateway address
• Double-click the entry to open its details
• To find your pre-shared key: Locate the Shimo entry with an "Account" label ending with "groupPassword"
  {S_1294}
• To find your login password: Locate a Shimo Keychain entry with the account label ending in "userPassword"
• Click "Show password" and enter your macOS account password to reveal the password (note you may be prompted twice for it)

Choose "Configure" from the top right corner of your connection and put the details for your VPN connection in:

• For VPN gateway address, enter the gateway hostname from the Keychain entry names ("vpn.example.com" in our example)
• For the pre-shared key, enter the password from the Keychain labeled "groupPassword"
• Enter your username and password
• Start your connection and see if you're able to connect

Choose your authentication options

Information about certificates

Please keep in mind that, as well as the public part of the certificate, you also need to export the private key.

Important: Private keys cannot be imported into the Keychain alone and can only be imported together with the corresponding certificate. For this to occur, the certificate and private keys need to be in PKCS12 format. You can generate this format by entering the following command into the Terminal:

openssl pkcs12 -export -in (example.com).user.crt -inkey (example.com).user.key -out (example.com).user.p12

Following this, (example.com).user.p12 can be imported by a double click. When generating your keys, you will be asked to enter a password, as private keys in PKCS12 format are always encrypted. This can be a password of your choice but please be aware you will need to enter it again during the import.

Troubleshooting

What to do if you can't connect?

You may need additional details that your VPN admin might have given you when you first set up your VPN connection. Check your emails (tip: try searching for the VPN gateway address).

• Get the latest version of the OCLP:
  OpenCore Legacy Patcher Releases
   
• Start and click Settings: {S_1341}
• Check "Disable AMFI": {S_1342}
• Then select "Post-Install Root Patch" in the main menu and restart the device.

What's the point of a VPN?

Secure data

How do you establish a VPN connection?

• Open the Terminal app (from Applications → Utilities → Terminal)
• Paste in this command: sudo rm -f /var/run/vpncontrol.sock
• Confirm it with your password
• Then reboot your Mac

Then try connecting again. The problem caused by the underlying networking components should be resolved.

Symptom

Solution

1. Do nothing; the conflict will persist until resolved.
2. The safe is right; the version from the safe is downloaded.
3. VPN Tracker is right; the version of VPN Tracker is written to the safe.

Reasoning

1. After you've downloaded and opened VPN Tracker 365, click on Sign in > Create Account

{S_1110}


2. Enter the credentials for your new account (Name, Email, Password) in the space provided.
3. Next you'll receive an email to the address you used to sign up with:

{S_1109}


4. Click on the link in the email to verify your address. If you can't find the email in your main inbox, make sure to check your spam folder.
5. Once your address has been verified, you will be able to purchase a VPN Tracker 365 plan and set up your own connections.

How to proceed

• Built using end-to-end encryption - our servers have no access to your connection data
• Securely encrypted with user-specific encryption keys for additional security
• Encryption runs locally in your browser

Managing connections on the web

Visit my.vpntracker.com, log in to your account, and go to "Subscriptions" to update your payment method.

Go to your current subscription and click on "Edit" to change the payment method. Click "Choose another way to pay" to add a new credit card or alternatively, add a PayPal account. This will be used as your new default payment method for your plan.

• Go to the VPN Tracker Store
• Add the requested licenses to your shopping cart by clicking the Plus Symbol.
• Be sure to select: “Purchase as new plan”. The quote tool does not currently support the “Add to an existing plan” feature.
• Once you have added the licenses to your cart click on the blue “Save as quote” button on the right side of the page
  {S_1242}
• Your product selection and price will be saved into a quote which will remain valid for seven days after it has been generated.
• Be sure to log in to your account to see your final price.
• You can share your quote with others by sending them the URL of your quote.
• Alternatively, you can export the quote as a PDF or print it.
• Once you are ready to purchase, just click the “Purchase Now” button and all items from your quote will be directly put back into your shopping cart and you can proceed with your purchase.
  

• Log in to your account at my.vpntracker.com
• In the Team overview, go to "Licenses". Here you can see all your existing plans
• Then, click on “Add plans” {S_1145}
• On the following page enter the number of licenses you would like to add and select the edition. Then click on "Add to plan"
  {S_1146}
• Under Checkout you will see your new plan. Your new plan will start from today’s date and will run for one year.
  {S_1147}
• The "Yearly total" is the total price for one year
• If applicable (i.e. if you have merged your plans), the "Prorating Discount" is the remaining value of your existing licenses which gets deducted from the yearly total to make the "Amount due now".
• Check the Terms and Conditions and click "Pay now"
• You can now assign your licenses to your team members

Once you have decided which product to purchase, the next step is to proceed to our Online Store and place your order. We accept all major credit cards, PayPal and bank transfers or checks, depending on your country.

After your order has been processed you will receive a confirmation for your purchase. This will confirm the items purchased, and additional payment instructions if you're paying via bank transfer or check (in those cases you will also receive an additonal email confirming your payment when it has been processed.)

In the purchase confirmation email you will also receive additional information like the download links for your purchased apps.

• Roll out VPN connections via TeamCloud
• You can see who has access to your VPN and identify any users who should not have access to the connection.
• You do not have to share your admin account with any other users.
• You can easily revoke licenses from team members who pose a potential security risk (i.e. ex employees.)
• Without Team Management, any of your other VPN Tracker users have the ability to sign in to your admin account and gain access to critical features, including assigning or revoking plans.

One of our customers has kindly provided instructions on how to integrate Cisco EasyVPN and VPN Tracker with a DMVPN setup:

EasyVPN Server and DMVPN Hub on 1 Cisco router tutorial

Using VPN Tracker 5 with a Cisco Easy VPN Server

• A demo license is only valid for 30 days.
• A demo license allows you to use all the Pro Edition features except the export feature.
• A demo license restricts tunnel traffic up to 500 kb in either direction.
• Once the 500 kb limit has been reached, a demo license allows you to stay connected for another 3 minutes.

The majority of VPN users use their Mac out and about on the go. If a MacBook ever gets lost or stolen, there’s a risk that remote access to your network could fall into the wrong hands. With VPN Tracker, you can prevent unauthorized VPN access by remotely revoking access to the connection.

If you are an existing VPN Tracker customer and want to upgrade to VPN Tracker 365, you can simply install VPN Tracker 365 and your connections will automatically be imported:

Download VPN Tracker 365

Once you have VPN Tracker 365, you can purchase a VPN Tracker 365 plan.

Purchasing through our online store is perfectly safe. All transferred information is encrypted via HTTPS - so it is secured against any potential threats.

As VPN Tracker has low-level access to your system, it is digitally signed and checks that the app has not been altered in any way every time you launch it. If VPN Tracker it looks as though changes have been made to the VPN Tracker app, you'll see that message.

Unfortunately other applications (e.g. Uninstaller/Deinstaller, Clean-Up Tools, and so on), that can cause this problem.

Should you repeatedly run into that issue, please send us a copy of your VPN Tracker app. Locate VPN Tracker on your harddrive, copy it to your Desktop and create a zip file (CTRL-/right click VPN Tracker, then choose "Compress VPN Tracker"). By comparing the broken copy we can find out what has been changed and offer advice how to prevent it from happening again.

If you have already purchased a VPN Tracker license but would like to change to a different product, you have two options:

1. Purchase an upgrade In most cases you can upgrade your existing plan. The VPN Tracker store will automatically pro-rate your purchase based on the remaining value of your current product.

Go to your my.vpntracker upgrade page to see your upgrade options.

• Visit our store promocode transfer page and follow the steps to receive your promocode
• Choose your new product on the my.vpntracker store
• Enter your promocode during checkout

1. Check if you can reach my.vpntracker.com
2. If you can access my.vpntracker, try quitting and relaunching the app
3. If that doesn't help, try again a bit later
4. If it's still not working after a cup of coffee - reach out

Unfortunately, we cannot guarantee this. Secure networking is a complex subject. VPN Tracker is extremely reliable and is used by customers around the world. But there are some rare scenarios in which VPN connections cannot be established (e.g. when a firewall is set up to actively block VPN connections).

We recommend using the free trial version to test VPN Tracker with your particular network and usage scenario.

If you require any assistance setting up your VPN connection with VPN Tracker, you can contact equinux support at any time.

We use analytics to help us improve the app and your overall VPN experience. All measurements are completely anonymous and we never evaluate any personal information or any data going through your connection.

What is measured

• Generic connection settings (e.g. what type of connection it is, which options are being used etc.)
• Which features are used (e.g. is auto-connect enabled, are any actions configured etc.)
• How many connections you have

Your data, your privacy

• Your specific network settings or credentials are never read, captured or transmitted
• Your VPN traffic is never analyzed, captured or accessible

You’re in control

If you’d prefer not to share any anonymous usage information with equinux, you can deactivate this option at any time in VPN Tracker’s preferences by unchecking 'Share diagnostics data'.

• Log in to your my.vpntracker account and select your team in the sidebar
• Scroll to Team Members. Here you will see a list of the colleagues you have invited to your team and their current license
• Click Manage to be shown your available licenses and select a product from the list to assign it to a user
• If you have no available licenses, you can purchase more from the Team Store by clicking Buy licenses

• macOS 15 Sequoia and newer: System Settings > General > Login Items & Extensions, scroll down and click on the ⓘ icon next to “Network Extensions”. Enable the toggle next to VPN Tracker 365 in the dialog that appears.
• macOS 13 Ventura and macOS 14 Sonoma: System Settings > Privacy & Security, scroll down and choose “Allow” in the confirmation box.
• macOS 11 Big Sur and macOS 12 Monterey: System Preferences > Security & Privacy, scroll down and choose “Allow” in the confirmation box.

1. VPN Tracker 365: Download here
2. An internet connection
3. A VPN Router/Gateway

Create a new connection

‣ Click on the plus symbol in the bottom left corner:

{S_1234}

‣ Choose: "New Company Connection"

Choose your VPN Router

‣ In the list of VPN Gateway vendors, choose the manufacturer and model of your VPN router. In case your VPN router does not appear in the list, try the following:

‣ Choose "Use custom device profile." 

‣ Click on "Create" to add your VPN connection.

{S_1236}

Your configuration guide

1. VPN Tracker 365: Download here
2. An internet connection
3. A VPN Router/Gateway

Create a new connection

‣ Click on the plus symbol in the bottom left corner:

{S_1234}

‣ Choose: "New Company Connection"

Choose your VPN Router

‣ In the list of VPN Gateway vendors, choose the manufacturer and model of your VPN router. In case your VPN router does not appear in the list, try the following:

‣ Choose "Use custom device profile." 

‣ Click on "Create" to add your VPN connection.

{S_1236}

Your configuration guide

• Multiprotocol VPN support
• High speed connections
• Zero-config VPN - thanks to TeamCloud & Personal Safe technology

• As a single address, e.g. "192.168.10.4",
• as a single remote network, e.g. "192.168.10.0" (VPN Tracker will use the most typical subnet),
• in CIDR notation, e.g. "192.168.10.0/24",
• or with the full subnet, e.g. "192.168.10.0 / 255.255.255.0", which VPN Tracker will then convert to CIDR notation.

• {FAQ_1195}
• {FAQ_1196}
• {FAQ_1197}
• {FAQ_1198}
• {FAQ_1199}

Availability of pre-release testing

Important information for pre-release testers

Getting back to the main branch:

The Remote Connection Wipe functionality is available for all VPN Tracker 365 plans.
Please note that you will need a VPN Tracker 365 Pro plan to export a VPN connection.

In our white paper you will find all information to set up Remote Connection Wipe:

http://equinux.com/goto/vpnt365/whitepaper

• Log in to your my.vpntracker.com account
• Select your team in the top left corner
• On the left side choose "Team Cloud"
• In the Invite section at the top, enter your new Team Member's name and company email address, then click "Send invitation". {S_1324}
• The invited team member will then receive an automatic email invitation with a personalised link to click on and join your team.
• Tip: Each VPN Tracker 365 user needs their own, personal equinux ID. After the user receives a team invitation from you and clicks the invite link, they can either create a new equinux ID or log in using their existing account.
• In case the user does not receive the invitation email, you can access the invitation link by clicking on "Details" next to the user name
  {S_1386}
  {S_1387_50%}
• Once a team member has accepted your email invitation, you will be notified via email
  {S_1325}

1. What are connection drops during rekeying?

   Connection drops during rekeying occur when the VPN connection is interrupted during the key update (rekeying). This causes traffic to not be processed for a short period, which is particularly problematic for stable connections such as video conferences.

2. Why does the problem occur during rekeying?

   The problem arises because, when using TCP with OpenVPN, the firewall does not accept any traffic during the rekeying process. This leads to an interruption of the traffic.

3. What impact do connection drops have on a video conference?

   During a video conference, connection drops during rekeying can result in a complete interruption of the traffic. This causes the connection to break, disrupting or even ending the video conference.

4. Why is TCP susceptible to this problem?

   According to OpenVPN, TCP is problematic for VPN connections because it is more sensitive to traffic congestion during network disruptions or the rekeying process. OpenVPN therefore recommends using UDP instead, as it can better handle rekeying processes.

5. What solution does VPN Tracker provide for the problem?

   VPN Tracker offers a particularly user-friendly solution: when establishing a connection, VPN Tracker automatically sets the rekeying timer to 24 hours. This significantly minimizes connection drops due to rekeying processes, keeping the connection especially stable. Additionally, VPN Tracker supports switching to UDP, which allows for an even more reliable connection.

6. Why should the rekeying timer be set to 24 hours?

   A longer rekeying cycle reduces the frequency of connection drops. By setting the timer to 24 hours— as VPN Tracker does by default— the likelihood of the rekeying process being triggered during a critical phase, such as a video conference, is decreased.

7. What advantages does VPN Tracker have when using UDP over TCP?

   VPN Tracker makes it easy to configure UDP, which offers faster connections and less sensitivity to packet loss. UDP is more efficient and resilient to interruptions during the rekeying process, which is particularly beneficial for bandwidth-intensive applications like video conferencing or streaming.

8. What recommendations does VPN Tracker provide for companies to optimize their VPN connections?

   For companies relying on stable connections, VPN Tracker offers simple and effective solutions:

   • By default, the rekeying timer is set to 24 hours to minimize connection drops.
   • It is recommended to use UDP instead of TCP whenever possible to further enhance performance.

Please follow these steps:

1. Your Mac may not be remotely controlled during installation. Further details can be found here: {FQ1398} Be sure to perform the initial setup locally on the computer.
    
2. There may be a problem with launchd, which is responsible for installing and starting the background processes of VPN Tracker. In the easiest case, this problem can be solved by just restarting your computer.
    
3. In case a restart did not solve the problem, start the program Terminal (from Applications → Utilities → Terminal) and perform (copy and paste) the following commands:
    

   sudo launchctl bootout system/com.vpntracker.365mac.agent
   sudo rm /Library/PrivilegedHelperTools/com.vpntracker.365mac.agent
   sudo rm /Library/LaunchDaemons/com.vpntracker.365mac.agent.plist
   sudo rm /var/run/com.vpntracker.365mac.agent.socket

   Confirm commands with your password when being prompted for it (note you won't see the password being typed). Afterwards, please restart your computer.
    
4. If none of the above did solve the problem, see if you can locate any crash logs Start the App "Console" ( from Applications → Utilities → Terminal) and open /Library/Logs on the left, then select DiagnosticReports. Search for a current entry of com.vpntracker.365mac.agent. In case there is a new entry for every start of the app, please send us one of these reports for analysis.

• Read the setup guide for TP-Link SafeStream routers
• See all supported devices and protocols

1. In the VPN Tracker for Mac App

‣ Go to "VPN Tracker" > "Preferences"

‣ Select "Personal Safe"

‣ Uncheck the connections and/or shortcuts you would like to delete from the list

‣ Press update

‣ This will delete all connection info from our servers. 

2. In a browser at my.vpntracker.com

‣ Open my.vpntracker.com  and log in with your equinux ID and password

‣ Select "Personal Safe" in the sidebar

‣ Here you will see all connections and Shortcuts which are saved in your Personal Safe.

‣ When you press the delete button next to any connection, this will instantly be deleted from your Personal Safe

• Two-factor (2FA) or multi-factor authentication (MFA)
• Certificate-based authentication

• Main Mode exchange
• 3DES or AES encryption
• Perfect-Forward-Secrecy needs to be used

• SSL and TLS 1.0 are probihibited

The Blowfish and CAST-128 encryption algorithms have been removed in OS X 10.8 Mountain Lion. They continue to be available when VPN Tracker is running on OS X 10.7 Lion and earlier.

• Visa Secure
• Mastercard Identity Check
• American Express SafeKey

As a reseller you can purchase VPN Tracker 365 plans and resell them to your customers.

VPN Tracker does not maintain VPN connections when the computer goes to sleep for the following reasons:

1. Immediately after waking up, the system may have different network settings than when it went to sleep, e.g. because the network cable was replugged while the computer was asleep, or the computer was moved to another location where a different WLAN is available, or a DHCP lease has expired and the DHCP server has to assign a new IP address to the computer after waking up because it has already given the old one to someone else, or the network interface no longer exists, e.g. if a USB network adapter was unplugged. In these cases, not only would the connection immediately stop working after waking up, VPN Tracker would also no longer be able to log off correctly from the remote peer.

   VPN Tracker would also not be directly aware of some of these events, as applications do not receive network events while the system is asleep and would therefore have to compare all network configurations after waking up with those before sleeping and decide whether the connection could still work or not, because with some VPN protocols there is no way to actively test this, with others only if certain options are used (e.g. DPD). A misjudgement leads to a tunnel being kept up that can actually no longer work and the user would then have to restart it manually before it works again.

2. NAT gateways remember in a table how they map private IP addresses to public ones and how they rewrite ports for a limited time only. Depending on the protocol, this time span can be in the range of seconds or minutes (some gateways only remember this for 20 seconds with UDP). If such a table entry is lost, this does not result in an error, but a new entry is created for the next packet, which often results in a different mapping, which the remote station cannot cope with, because it now looks to them as if someone else is trying to hijack the connection, as the packets are suddenly coming from a different sender. VPN Tracker cannot know or check when it wakes up whether the previous table entry still exists or has already been lost and will not receive an error from the NAT gateway in the latter case, but the connection will still no longer work, which leads to the same problems as in the first case. It does not matter whether a local NAT gateway is used (as in most home routers or modems) or a carrier grade NAT gateway, which is located at the ISP and via which several customers can share a single public IPv4 address. The latter is increasingly the case, as there are no longer any free IPv4 addresses and therefore not every customer can get an own one.

3. VPN protocols that use some form of Dead Peer Detection (DPD) expect regular data traffic from the other side. If this fails to occur, they send DPD packets and expect these DPD requests to be answered. If they are not answered, the other side considers the connection to be dead and deletes it. VPN Tracker is also unaware of this while the computer is asleep and cannot respond to these requests. After waking up, the connection would again no longer be functional, but even with DPD in use, this would often only be noticed after about a minute and until then the system would try to continue using this connection without the slightest chance of success, so that various applications would run into errors or disconnects.

4. If a VPN connection is disconnected without the client logging off from the VPN gateway and without the gateway being aware of this, the client may not be able to re-establish this connection immediately or a connection error may occur the first time it is established. In the worst case, the client may even be locked out for a few minutes. This can occur in the first two cases if the network settings have changed after the sleep phase or if a NAT table entry has been lost.

• Download the VPN Tracker.zip file
• Open Terminal and run the following command:
• shasum -a 256 ~/Downloads/VPN\ Tracker \ 365.zip
  (note the exact path may differ, depending on which version of VPN Tracker you’ve downloaded
• Compare the calculated checksum to the checksum published on the Version History page.

Step One: Add a connection

1. Open VPN Tracker 365
2. Click on File > New > Company Connection
3. Click on IPSec/L2TP/OpenVPN/SSL/PPTP
4. Select “Connection based on OpenVPN protocol”
5. Click “Create”
   {S_1225_60%}

Step Two: Configure your VPN connection

1. Click on “Configure” and go to the “Basic” tab
2. Drag and drop your ovpn file into the grey space "Drop OpenVPN configuration file here", or click on the space to browse for your file in Finder
3. Your device’s unique configuration settings will be automatically filled out by VPN Tracker 365
4. Click “Done” to save your settings
   {S_1226}

Connect to your VPN

1. Check first of all that your internet connection is working as it should be
2. Use this link as a test: http://www.equinux.com
3. Start the VPN Tracker 365 app.
4. Click on the On/Off slider to turn on your connection.
   {S_1227}

1. Copy the first characters of your order number before the "..." {S_1197}
2. Go to your products view and search for this number. The corresponding number can be found under "Plan ID". {S_1198}
3. To add licenses, klick on the "Add licenses" Link.

• Log in to your my.vpntracker.com account
• Select your team in the top left corner
• On the left side choose "Team Cloud"
• Scroll down to the section "Rename your team"
• Enter your new Team Name and press "Rename" {S_1320}

If you are using an older copy of VPN Tracker 9 and a supported macOS version, please update to the last release.

If you are using a current macOS release, or plan to soon, we recommend moving to VPN Tracker 365. It offers support for new macOS releases, improved security, Connection Safe backup and sync and more.

If you used an earlier VPN Tracker 365 beta, you may run into a Connection Safe sync issue with the following error message:

• Sign out of VPN Tracker 365
• Quit VPN Tracker 365
• Open Applications > Utilities > Keychain Access
• Search in the top right for VPN Tracker entries mentioning "master key", "sync master key", or "connection safe"
• Delete these entries (Edit > Delete
• Launch VPN Tracker
• Sign in again and wait for your Connection Safe to sync (check under VPN Tracker > Preferences > Connection Safe)

• Log in to you your account at my.vpntracker.com
• Go to "My Subscriptions" in the sidebar, where you will see your current active plan(s)
• To activate automatic renewal, flip the switch from grey to green {S_1142}
• After activating auto renewal, you will receive an email confirming the activation.