I assume it's not a permissions problem – Tunnelblick doesn't try to repair Modify configurations, or make other changes that require Tunnelblick toĪsk for a computer admin's username/password. That happens when you originally install Tunnelblick, when you install or That folder (/var/log/Tunnelblick) should be created (if it doesn't exist)Įach time Tunnelblick runs its 'installer'. System files directly because of possible race conditions andĬonflicts with other programs that my make modifications to them. Pfctl? It looks to me like I have to define an anchor in pf.conf (withĭirectives like you describe) before manipulating it with pfctl, but One basic question: Must I modify pf.conf, or can I do everything via Server you want it to be active at boot and never deactivate, but on aĬlient you want to be able to activate and deactivate it dynamically. It's probably obvious, but what I'm looking to do is for an OpenVPNĬlient, not a server, although I do understand that the pf mechanism If you haven't gotten my response, here it is:

I've already received this info two times (and responded once) in private emails that you sent, so there is definitely a problem somewhere. Now that I'm thinking about it, maybe Tunnelblick should have an option in it Info on using scripts is available at Using Scripts. The catch there is that that script isn't given any info about the device (or anything else!), so it would have to hard-code the 'utun0' or 'utun1' or whatever. At some point you may have told Tunnelblick to not use openvpn-down-root otherwise it would ask you each time you try to connect a configuration with 'user nobody / group nobody'.īut I am not completely sure that it is OK for the down script to delete the device - it would not be OK if OpenVPN does anything else with the device, I don't think it does but I don't really know.Īs an alternative, you could use a custom 'post-disconnect.sh' script that deletes the utun device.

If you use the 'openvpn-down-root' plugin (which will be used by Tunnelblick automatically if you agree to that), then the down script runs as root.

I don't know about obtaining the routing information, though - or rather the 'unrouting' information. I think the arguments to the down script include the device name that the connection used (such as 'utun0'), which would make it easy to delete that device. See the OpenVPN documentation for info on environment variables that the down script can use and the arguments it is invoked with.

Take Tunnelblick's standard down script (/Applications/Tunnelblick.app/Contents/Resources/) and modify it to do the additional cleanup that must be done as root.

Originally I was thinking you could use a custom 'down' script

Mtu for vpn mac