VPNUK - The Virtual Private Network Specialists

Mac OSX Tunnelblick / OpenVPN Setup

Tunnelblick is a simple graphical user interface for the VPN software OpenVPN and higher. It is written in Cocoa and comes in a ready to use distribution with all necessary binaries and drivers. Note: Due to IP allocation issues, OpenVPN should only be configured on Shared IP servers.

The VPNUK config files for use with Tunnelblick are available from here:

UDP Config Files (recommended) - Download Now

TCP Config Files - Download Now

Note: You can connect OpenVPN over two kinds of connection on the VPNUK servers, the only edit required is to line 7 where you need to change 'INSERT-IP-HERE' with your VPNUK server IP.

Installing Tunnelblick

Note: there is no need to install OpenVPN separately - the Tunnelblick application contains both the Tunnelblick GUI and OpenVPN.

First, download the latest disk image from the featured downloads section on the Tunnelblick project page. Double-click the downloaded .dmg file. An icon for a "Tunnelblick” disk will appear on the Desktop, and a window similar to the following will appear:

Double-click the Tunnelblick icon and a new window will appear, similar to the following:

If you are reinstalling, upgrading, or downgrading Tunnelblick, the window will show the version number of the current copy and of the new copy. The current copy of Tunnelblick will be put in the Trash before it is replaced.

Click the "Install" button to copy Tunnelblick to your hard drive at the indicated location.

Once that is done (it may take a couple of seconds), a new window will appear, similar to the following:

If you want to launch Tunnelblick now, click the "Launch" button.

If Tunnelblick is currently running, a window similar to the following will appear:

Click the "Close VPN Connections and Stop Tunnelblick" to continue. After all connections are closed and Tunnelblick has quit, the new version of Tunnelblick will be launched. Continue with the following sections.

The First Time Tunnelblick is Run on a Computer

The first time a new installation of Tunnelblick is run on a computer and after a reinstall, upgrade, or downgrade, it will display the following screen:

Enter the name and password of a computer administrator. Tunnelblick's imbedded OpenVPN needs root privileges because it needs to modify network settings by configuring new network devices, changing routes, and adding and removing nameservers. Because we don't want you to enter your administrator account name and password every time you start a VPN connection, Tunnelblick comes with a setuid root binary that allows it to start a VPN connection with super user rights. Tunnelblick uses your administrator account name and password so it can create this setuid root binary.

The First Time Tunnelblick is Run by Each User

If this is the first time you have run Tunnelblick as a particular user, or the first time after some Tunnelblick upgrades, the following window will appear:

Specify whether or not you wish to have Tunnelblick check for updates each time it is launched. Each time an update is available, you will be given a choice of whether to install the update or not.

When there are no configuration files in ~/Library/Application Support/Tunnelblick/Configurations (which is usually the case the first time Tunnelblick is run), the following window will appear:

When starting Tunnelblick for the first time, you will be warned that no valid configuration file for OpenVPN exists in the openvpn directory. To provide Tunnelblick with the correct file, click 'Install and edit sample configuration file' and a sample configuration text file will open. Simply replace its contents with the contents of the 'vpnuk.ovpn' openvpn configuration file for the particular server you are connecting to and save the file.

The VPNUK config files for use with Tunnelblick are available from here:

UDP Config Files (recommended) - Download Now

TCP Config Files - Download Now

Note: You can connect OpenVPN over two kinds of connection on the VPNUK servers, the only edit required is to line 7 where you need to change 'INSERT-IP-HERE' with your VPNUK server IP.

You should now put the in the vpnuk key and certificate files in the openvpn directory (located in ~/Library/openvpn/ - the openvpn folder is a subfolder of the Library folder located in your home directory). OpenVPN will try to locate the key files in this directory, unless the paths to them are specified in the configuration file in absolute terms.

To launch Tunnelblick after setting up configuration and other files, double-click "Launch Tunnelblick" in the Configurations folder, or double-click Tunnelblick in the Applications folder.

[END]

Connecting to Tunnelblick

Once Tunnelblick has been launched, you control it from the icon in the Status Bar at the top of your screen. The Tunnelblick icon is usually placed between the time and the Spotlight icon. When no VPN connection is active, the icon is dark, indicating a closed tunnel:

If you click on the icon, you'll see a drop down menu similar to the following:

There will be a "Connect” menu item for each .ovpn or .conf file in ~/Library/Application Support/Tunnelblick/Configurations. Click on one to establish the corresponding pre-configured VPN connection. To illustrate the connection being established, three dots will appear in the menu item, and the Tunnelblick icon will darken and lighten repeatedly. If the connection is successfully opened, the icon will change to show an open tunnel:

[END]

Optional Settings and Configuration

Connecting to multiple VPNUK servers

You can put more than one .ovpn file into the Configurations folder. Tunnelblick interprets each .ovpn file in the Configurations folder as a configuration file for a different connection; each of the connections will be available in the drop down menu and shown as a separate tab in the "OpenVPN Log” window.

Automatically Starting Tunnelblick Upon Login

Tunnelblick was designed as a persistent menu icon that survives reboots. To this end, it inserts itself into the login items when it is started and only removes itself from the login items when you choose Quit from the menu or Command-Q from the "OpenVPN Log” window or "About..." window. . So if you just log out, shut down, or restart your computer, or it crashes, the next time you log in, Tunnelblick will automatically start. If you do not want Tunnelblick to start automatically, quit Tunnelblick before you log out, shut down, or restart.

Automatically Opening a VPN Connection When Tunnelblick Starts

You can specify that a connection automatically be opened when Tunnelblick starts by putting a check in the "Automatically connect on launch” checkbox for that connection. The checkbox is located on the connection's tab in the "OpenVPN Log” window.

Uninstalling Tunnelblick

To uninstall Tunnelblick, move Tunnelblick.app from the Applications folder to the Trash. Other than the preferences and configuration files described in "File Locations", there are no other files installed -- OpenVPN, the tun/tap kernel extensions, and up/down scripts are contained within the Tunnelblick.app package and are loaded only when needed directly from there. Tunnelblick may store passphrases or passwords in the Keychain at the user's request.