Newsroom Update

Beginning in May, a special Today at Apple series titled “Made for Business” will offer small business owners and entrepreneurs free opportunities to learn how Apple products and services can support their growth and success. Learn more >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Migrated VPN Service Broken with Catalina

My Mac mini has been working just fine with macOS Mojave as a VPN server following the migration method described in https://developer.apple.com/support/downloads/macOS-Server-Service-Migration-Guide.pdf , but after upgrading to macOS Catalina there is trouble:

The VPN clients connect just fine on the internal network, but not on an external network; which makes the VPN server a bit pointless! I can confirm that all was working well with the server running macOS Mojave, and my iOS 13 and iPadOS 13 clients have been connecting just fine; it is the upgrade to macOS Catalina on the server that has caused this problem.

Here are the log entries for a failed connection:

vpnd.log

Posted on Oct 11, 2019 9:42 AM

Similar questions

120 replies

wa1oui

Level 1

30 points

Apr 14, 2020 7:51 AM in response to e-nando

@e-nando Great find, but how did you copy vend into /usr/sbin?

I made sure my Mojave vpnd had root:wheel ownership, but kept getting errors. I turned off System Integrity Protection and got the error Read-only file system. How did you bypass these copy errors.

Thanks.

Apr 14, 2020 11:50 AM in response to lcrooks

I don't have access to a Mojave vpnd binary, if someone would provide one I'd be happy to provide a step-by-step set of instructions.

Edit: NVM, found one tucked away in a time capsule backup. Instructions incoming.

Apr 14, 2020 1:02 PM in response to ElKoeppe10

Even with the above, I tried a `vpnd` binary pulled from OS X 10.14.2 and 10.14.3 and neither worked for me. Same behavior as Catalina when trying to connect via remote network.

Coincidentally, I only last night got a softether.org VPN setup on my Mac Mini and it supports IPSec/L2TP so you can still use native VPN client built into Apple devices.

lcrooks

Level 1

9 points

Apr 14, 2020 1:04 PM in response to ElKoeppe10

Thanks so much for posting. I am still on Mojave so can send you vpnd if you would like?

Does this actually work? I need VPN access for my current setup so cannot upgrade to Catalina if this is not functional?

Apr 14, 2020 1:24 PM in response to lcrooks

Although I started this thread I'm not trying to get this working anymore but I would like to add why I was initially determined to get vpnd working on a current version of macOS: I wanted to be using the most secure versions of services I connect to via the internet.

Using the Mojave version of vpnd sounds like a good solution because it is quite new, however that means that we are indefinitely using the same version which could at some point in the future compromise security; hopefully the very distant future.

I personally recommend either compiling a recent vpnd from source, or using something like MacPorts to install an easily updatable version.

In POSIX it is convention when installing custom software that it goes into the /usr/local directory for example /usr/local/sbin/vpnd

...so with that you would change your vpnd.plist file to reference /usr/local/sbin/vpnd and that won't interact with the included macOS /usr/sbin/vpnd binary; basically what has just been said for using the Mojave included version.

Good luck everyone.

Apr 14, 2020 3:03 PM in response to clubbyestatedriver

Tried that method back in October and it did not work.

Tried one more time now, copied vpnd from 10.14.6, made sure that everything was correct (vpn.ppp.l2tp.plist updated to specify the new path, macOS asked me if I wanted to open a file when reloading vpnd so the new file was actually used) and it still does not work for external connections.

If anyone else wants to try - please go ahead but don't have your hopes high.

Apr 16, 2020 12:17 PM in response to lcrooks

I'm not convinced that the problem would be at the client/user end, since in my case, only the server changed, not the clients (iPhone and MacBook Pro).

I copied all my server's information into my router's VPN server set-up, turned off port forwarding, and voilà! It worked instantly with both clients, and with no changes to the client/user setup.

Just saying…

Apr 16, 2020 12:36 PM in response to Gib Henry

Oh, come on...

You always could connect to a VPN server running on Catalina from the same local network.

External connections never worked.

Before posting a “solution” here, please make sure that it actually works.

May 20, 2020 2:11 PM in response to clubbyestatedriver

If anyone is looking for an alternative solution to a home VPN server, I would recommend considering setting up a Raspberry PI with strongSwan.

I know that it seems like an obvious answer (I knew about it before too), however, what I did not realise is that you can actually have a better VPN server this way (compared to what we had on macOS).

You can actually use "VPN on demand" rules which are super cool (e.g. you can make your iPhone to connect to your VPN whenever you get on an unknown Wi-Fi network). The downside is that you need to be tech savvy to set it up.

May 20, 2020 2:32 PM in response to Ivan Pavlov

I recently bought a DrayTrek router mainly because I wanted the LTE failover, but as an added perk the router has a highly configurable VPN server. By not forwarding the VPN port to my Mac mini the router is resolved to the same URL and I just duplicated the settings from the Mac mini so that my clients work just as they did. So not only have I gotten rid of an Apple Server but I’ve also demoted the Apple Router to a simple access point.

The Raspberry PI sounds good though, and I think you can power it by USB so it could be a very handy option.

lcrooks

Level 1

9 points

May 21, 2020 9:44 AM in response to clubbyestatedriver

My hats off to all of the highly ingenious 3rd party solutions but one of the key reasons many of us bought a mac mini was to have a simple, integrated, Apple-ecosystem-centric solution to home networking. The fact that Apple has unnecessarily rendered their software solution into obsolescence is highly malicious towards their own customers. Frankly, it is unacceptable and should be "fixed" by Apple. I know that Apple could care less what we think, but I would advocate that we maintain pressure. I can say with 100% certainty this will be my last mac if Apple continues to be so obtuse and unwilling to listen to their own loyal customers.

Jun 25, 2020 1:45 AM in response to lcrooks

I watched the WWDC presentation and paused the video to see just enough: Apple have ported their apps for Apple Silicon and there was definitely a Server icon there, but interestingly no AirPort Utility.

I can almost guarantee you that Big Sur will not fix this VPN issue and I suspect it will break even more services;

There will be more stringent protections of the operating system storage location which will likely prevent editing configuration files for the POSIX services. I was also interested to see the promotion of virtualisation for Apple Silicone and Big Sur. A demonstration included Parallels Desktop running a Debian 10 virtual machine along with the explanation that developers can start a web server in Linux and see it in Safari; this is significant because web services were included in the macOS Server migration guide before the release of macOS Mojave.

Using Parallels Desktop Pro you can run entire operating systems as a system service that starts when the Mac boots, so this would seem to be the preferred way to run servers on a Mac. If you bridge the network for your server vm it appears on the as a separate machine with its own IP address.

I am seriously thinking of getting an Apple Silicon Mac mini when it is eventually released to run all my servers in virtual environments to reduce power consumption. macOS Big Sur and a virtualisation solution might be like having your own little Azure: just make sure you've got plenty of RAM!

Jun 27, 2020 4:05 AM in response to goochrules

Yes, configure your own OpenVPN certificate-based server: https://github.com/essandess/macos-openvpn-server. This has been a rock-solid alternative to a vpnd-based server.

The MacPorts port macos-vpn-server is based on vpnd and therefore has the same issue discussed in this thread.

wa1oui

Level 1

30 points

Jun 27, 2020 8:42 AM in response to goochrules

I've mentioned it before, but it could have gotten lost in this long thread:

I'm successfully using Mojave in a Parallels VM on Catalina running the VPN configuration I used before Catalina broke it.

Maksan

Level 1

4 points

Jul 17, 2020 11:58 PM in response to RadioChuck

Yes. I too paid for Server.app only because I needed VPN. Now I must use 10.13.6 for can use Server.app 5.6.3 with GUI VPN. Where is my VPN, Apple? I want use Server.app with VPN on macOS 10.15, macOS 11+

Migrated VPN Service Broken with Catalina