7 ms·

Tunnelblick uses OpenVPN under the hood, which means it's using a TUN/TAP virtual NIC. LeoPantera is referring to the new way of creating VPNs in macOS and iOS

Tunnelblick uses OpenVPN under the hood, which means it's using a TUN/TAP virtual NIC. LeoPantera is referring to the new way of creating VPNs in macOS and iOS, the Network Extension framework. You need an entitlement to develop with that framework, and sideloading is not possible. https://developer.apple.com/documentation/networkextension https://developer.apple.com/documentation/networkextension https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_networking_networkextension https://developer.apple.com/documentation/bundleresources/en... I have no idea if Apple is committed to support tun/tap in the future, but I doubt.

alerighi 6y ago
Well the Wireguard app exists both for macOS and iOS so I guess is not that big deal to support VPN on these systems. Also services like this one to circumvent the Apple policy couldn't just give you a Wireguard configuration file and say to you "just install the Wireguard app and import the config"? It would work and of course Apple couldn't do anything (beside removing the whole Wireguard app from the store).
- tgragnato 6y ago
  That’s what I do too. Not having entitlements or not being able to sideload is more of an issue while trying to tweak or patch an existing code base. E.g.: contributing to WireGuard or iCepa, ...
JonathonW 6y ago
After Big Sur deprecated network kexts, I switched over to Viscosity-- which is another OpenVPN client, and supports both tun and tap VPNs without an extension (using only built-in macOS capabilities). It does not require the Network Extension framework, is not App Store distributed, and does not have any entitlements. (It is Developer ID signed and notarized, but that's just for user convenience; it'd work just fine unsigned if the user wanted to click through macOS's warnings to get there.)

alerighi 6y ago

Well the Wireguard app exists both for macOS and iOS so I guess is not that big deal to support VPN on these systems. Also services like this one to circumvent the Apple policy couldn't just give you a Wireguard configuration file and say to you "just install the Wireguard app and import the config"? It would work and of course Apple couldn't do anything (beside removing the whole Wireguard app from the store).

tgragnato 6y ago
That’s what I do too. Not having entitlements or not being able to sideload is more of an issue while trying to tweak or patch an existing code base. E.g.: contributing to WireGuard or iCepa, ...

JonathonW 6y ago

After Big Sur deprecated network kexts, I switched over to Viscosity-- which is another OpenVPN client, and supports both tun and tap VPNs without an extension (using only built-in macOS capabilities). It does not require the Network Extension framework, is not App Store distributed, and does not have any entitlements. (It is Developer ID signed and notarized, but that's just for user convenience; it'd work just fine unsigned if the user wanted to click through macOS's warnings to get there.)