Newsroom Update

Beginning in May, a special Today at Apple series titled “Made for Business” will offer small business owners and entrepreneurs free opportunities to learn how Apple products and services can support their growth and success. Learn more >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Migrated VPN Service Broken with Catalina

My Mac mini has been working just fine with macOS Mojave as a VPN server following the migration method described in https://developer.apple.com/support/downloads/macOS-Server-Service-Migration-Guide.pdf , but after upgrading to macOS Catalina there is trouble:

The VPN clients connect just fine on the internal network, but not on an external network; which makes the VPN server a bit pointless! I can confirm that all was working well with the server running macOS Mojave, and my iOS 13 and iPadOS 13 clients have been connecting just fine; it is the upgrade to macOS Catalina on the server that has caused this problem.

Here are the log entries for a failed connection:

vpnd.log

Posted on Oct 11, 2019 9:42 AM

Similar questions

120 replies

lcrooks

Level 1

9 points

Oct 31, 2019 1:06 PM in response to clubbyestatedriver

Hi Everyone,

The very intrepid Bernard Tao of VPN Enabler may have come up with a solution. I have already rolled back to Mjoave, but if someone is brave enough to try and test his solution, I would be eternally grateful! I am not going to upgrade Catalina until we have a 100% solution for this massive problem. Loss of VPN is incredibly disruptive to my workflow.

http://cutedgesystems.com/software/openvpnenablerforcatalina/

Thanks!

Oct 31, 2019 7:40 PM in response to lcrooks

I gave it a try and had zero luck.

I'm currently working on Wireguard. I've had a little success with it, as in I can connect to the server but can't do anything else. I'll probably be reverting back to Mojave probably this weekend.

Nov 5, 2019 2:00 PM in response to clubbyestatedriver

Apple can kiss my ***. I am so sick of their shenanigans regarding SERVER.. First they completely GUTTED a fine suite which we PAID for, made it completely useless, there WAS a workaround to at least get VPN working, but now after Catalina, no more.

Seriously, W T F Apple?? W T F ???

Nov 15, 2019 1:54 AM in response to clubbyestatedriver

I have tried VPN Enabler mention by lcrooks earlier and have managed to get the connection working back to my Catalina OS Mac Mini. I have done this locally from another desktop and remotely from my iphone. The later needed the OpenVPN app installed.

I also needed to edit the config file created by VPN Enabler as it didn't want to work by default. This was a bit of trial and error really as I am certainly no expert on this, but noticed when using the client part of VPN Enabler that the config file didn't seem to reference my server url but the port number instead. I simply replaced the port number with my url and it worked. The lines I changed are below

<key>RemoteAddress</key>

<string>xxx.ddns.net</string> This simply contained "REMOTE"

<key>remote</key>

<string>xxx.ddns.net</string> Note: this is where the port number 1194 was

Nov 20, 2019 2:45 PM in response to clubbyestatedriver

It does not look like this is going to be fixed in the next release of macOS 10.15.

Please submit a bug report to Apple via http://feedbackassistant.apple.com and post your feedback number here. This is the only way to get attention from Apple. It is not enough to just rant about it on the forums.

Nov 20, 2019 3:52 PM in response to clubbyestatedriver

Been running with ZyXEL ZYWALL USG series firewalls and the embedded VPN server, FWIW.

There are other similar options, from other vendors.

Not a huge fan of host-based VPN servers, and for various reasons.

But been migrating off of Server for a while too, with the Mojave Server release having discontinued the interesting bits.

lcrooks

Level 1

9 points

Nov 30, 2019 10:14 AM in response to clubbyestatedriver

iVPN has also officially stated that their software is not compatible with Catalina due to vpnd not working. There are a number of blogs/forums complaining about this horrendous issue. Honestly, I don't think Apple will fix this problem in Catalina or future OSX releases. Incredibly frustrating. Bernard Tao's VPN Enabler / OpenVPN workaround may be the only solution.

https://macserve.org.uk/ivpn/help.php

Nov 30, 2019 4:20 PM in response to lcrooks

I migrated to a firewall-based VPN server a decade ago, and that’s just been vastly easier than wrestling with a host-based VPN server and host-based IP routing.

Even back when Mac OS X Server cost a thousand dollars, and had a VPN server.

No need to deal with NAT-passthrough, and the firewall can be accessible when the target server (and VPN server) isn’t.

Using a Mac as an expensive IP router just isn’t “fun”. Never has been.

Dec 2, 2019 9:26 AM in response to VDalto

Thanks for your input but unfortunately it doesn't help us in this thread:

Our problem is that we used macOS as a VPN server and upgrading our server computers to Catalina has broken our ability to connect from anywhere that is not our internal network.

I suspect quite a few of us might move to Windows Server or a POSIX style system other than macOS.

Dec 3, 2019 1:45 PM in response to lcrooks

The first link looks like what we've done following Apple's migration guide and it does work, but in Catalina it only works with clients inside the same network as the server; in other words it works but is completely useless due to a fault with Catalina.

I've now given up on this issue and I bought a 2011 Mac mini on eBay and I've setup High Sierra with Server.app and connected it to the upgraded directory on my Catalina server for user authentication. I've changed the port mapping on my AirPort router to point the VPN ports to my new old Mac mini, and that's me fully functional again. In addition it turns out that my old Mac OS X Clients can't connect to AFP shares on Catalina so there's something else that Apple has broken: I now use my new old Mac mini with High Sierra to host my AFP share points too.

Good luck to everyone holding out for a fix, and although I doubt Apple will fix the issue, I suggest keep using the feedback page and contacting support.

lcrooks

Level 1

9 points

Dec 5, 2019 8:37 AM in response to clubbyestatedriver

This is really a sad state of affairs. None of these options are really facile and provide a long-term solution for future Apple updates. Apple should really fix this issue. I am astounded at Apple's lack of regard for this problem.

Dec 5, 2019 9:55 PM in response to clubbyestatedriver

Does anyone know what the change to /usr/sbin/racoon was from Mountain Lion (10.8) to Mavericks (10.9)?

A work-around decribed on https://macminicolo.net/racoon details copying /usr/sbin/racoon from an old system to fix an issue that prevented L2TP VPN connectivity in Server 3.0.1. Any ideas if the current issue with Catalina is related?

Dec 20, 2019 2:34 AM in response to Ivan Pavlov

I have, but I'm not expecting to see a fix at this stage. I've reported issues with migrated server services before and including this one, and been in e-mail contact with support and nothing seems to get fixed. Given that Apple removed the DNS service that Profile Manager depends on I suspect they want us to use and ISP hosting solution for things like DNS and VPN's which is something I won't be spending money on. I also don't want to surrender my security and privacy to an external provider. I suppose one solution would be to replace macOS with an open source alternative and running Linux systems on Mac's was quite popular at a time.

I'm using an older mac now for my VPN but if this issue does get resolved I'd appreciate it if somebody posted here if that happened.

Thanks

Machist

Level 3

639 points

Jan 7, 2020 12:15 PM in response to lcrooks

Bug reported also.

I use iVPN (https://macserve.org.uk)

I also test to connect directly to ip in my local network and then VPN connect.

If I use my VPN host name xxxxx.com "Server not responding" but I see "hits" in my VPN log.

2020-01-07 14:09:40 EET Incoming call... Address given to client = 10.0.xx.xx

Tue Jan 7 14:09:40 2020 : publish_entry SCDSet() failed: Success!

Tue Jan 7 14:09:40 2020 : L2TP incoming call in progress from '85.xx.xxx.xxx'...

Tue Jan 7 14:09:40 2020 : L2TP received SCCRQ

Tue Jan 7 14:09:40 2020 : L2TP sent SCCRP

2020-01-07 14:09:41 EET --> Client with address = 10.0.1.70 has hungup

2020-01-07 14:09:42 EET --> Client with address = 10.0.1.71 has hungup

2020-01-07 14:09:44 EET --> Client with address = 10.0.1.72 has hungup

Jan 13, 2020 5:47 PM in response to Machist

I could no longer wait for Apple to fix this solution.

I ended up purchasing a Cisco RV325 VPN Router and installed it in our office so that I could reach macOS Server, all of the machines on the network and all of the services. It actually works a thousand times better than the software VPN that macOS Server provided in the past as you basically have unlimited control with monitoring of who accesses your network.

Migrated VPN Service Broken with Catalina