Tunnelblick VPN Details Window

Tunnelblick's VPN Details Window shows information about a configuration and provides a way to change the configurations settings. On the left side of the window is a list of configurations and buttons to act on the selected configuration. On the right side of the window there are tabs for the configuration's log and settings and buttons to connect and disconnect the configuration.

Configuration List

The left side of the window contains a list of the configurations. Below the list are three buttons for operating on the configurations:

• The "add configuration" button, which looks like a plus sign, guides the user through the process of adding a configuration.

• The "delete configuration button", which looks like a minus sign, deletes the selected configuration

• The "manage configurations" button, which looks like a gear with a triangle next to it, displays configuration management options:

- Rename Configuration… renames the selected configuration
- Duplicate Configuration… duplicates the selected configuration, including it's settings
- Make Configuration Private/Shared… makes the selected configuration private or shared
- Revert Configuration… reverts the selected configuration to the version that was last secured
- Do Not Show Configuration on Tunnelblick Menu prevents the configuration from appearing on the menu that drops down when you click the Tunnelblick icon. (The configuration will always appear in the list on the left of the VPN Details window.)
- Edit/Examine OpenVPN Configuration File… Opens the OpenVPN configuration file (.ovpn or .conf) file for the selected configuration in TextEdit for editing or in a new window for examination. Only "private" configurations may be edited; shared and Deployed configurations may be examined.
- Show OpenVPN Log in Finder opens a Finder window with the OpenVPN log file for the selected configuration selected
- Delete Configuration's Credentials in Keychain… removes all credentials (username, password, and/or private key) from the user's Login Keychain for the selected configuration(s).

Connect, Disconnect, and Copy Diagnostic Info to Clipboard Buttons

The Connect and Disconnect buttons may be used at any time to connect or disconnect the configuration selected in the left section.

The Copy Diagnostic Info to Clipboard button copies the following diagnostic information to the Mac Clipboard:

- The versions of macOS and Tunnelblick being used.
- The contents of the configuration file. ("Sanitized" by removing inline keys and certificates.)
- A list of any unusual files found in the Tunnelblick VPN Configuration.
- A list of relevent Tunnelblick preferences.
- The contents of the Tunnelblick log.
- The last 200 Tunnelblick entries in the previous six hours from the Console log.
- A list of non-Apple kernel extensions ("kexts") that are loaded.

Log Tab

The Log tab contains the contents of the Tunnelblick log for the configuration selected in the left section. The Tunnelblick log contains the OpenVPN log along with entries about Tunnelblick's operations

Settings Tab

The Settings tab contains commonly-used settings for the selected connection:

- Connect determines when the configuration is connected: Manually, When Tunnelblick launches, and When computer starts. Note: When computer starts may only be selected if a configuration is Shared or Deployed.
- Set DNS/WINS determines the up/down scripts that Tunnelblick uses to modify DNS and WINS network settings for the selected configuration.
  - Do not set nameserver: Tunnelblick will not use up/down scripts and will not modify DNS and WINS network settings
  - Set nameserver: Tunnelblick will use its standard up/down scripts or scripts provided in the Tunnelblick VPN Configuration (.tblk)
  - Set nameserver (3.1): Tunnelblick will use its standard up/down scripts from Tunnelblick version 3.1
  - Set nameserver (3.0b10): Tunnelblick will use its standard up/down scripts from Tunnelblick version 3.0b10
  - Set nameserver (alternate 1): Tunnelblick will use its alternate up/down scripts from Tunnelblick version 3.1

- OpenVPN version determines which version of OpenVPN will be used to connect the selected configuration.
  - If you choose the "Default" version, the earliest version of OpenVPN will be used.
  - If you choose the "Latest" version, the latest version of OpenVPN will be used.
  - If you choose a specific version of OpenVPN, that version will be used. You will be warned if that version is not available.

- VPN log level determines which messages from Tunnelblick and OpenVPN are stored and displayed in the "Log" tab.
  - No OpenVPN or Tunnelblick VPN logging Nothing is stored or displayed.
  - OpenVPN logging level set by the configuration will store and display all Tunnelblick messages, and messages from OpenVPN as specified by the OpenVPN configuration file.
  - OpenVPN levels 0-11 will store and display all Tunnelblick messages, and messages from OpenVPN as specified by the level. The higher the level, the more messages are stored and displayed. Normally level 3 (the default) is the best level for diagnosing problems connecting to a VPN. Levels higher than 5 are usually needed only to debug OpenVPN itself. At the highest levels tens of megabytes of messages per second are handled, which can slow down your computer.

- On expected disconnect specifies what Tunnelblick does when the VPN is disconnected normally (by a menu command or button):
  - Do nothing
  - Reset primary interface: Tunnelblick resets the primary network service by issuing 'ipconfig down; ipconfig up' on its interface. This can be helpful when certain configuration problems cause a failure to restore network routing properly after a disconnection.
  - Disable network access ("Kill Switch"): Tunnelblick cuts off all network access (local and Internet) by turning off Wi-Fi and disabling all other network services. This can insure that nothing leaks out of the computer except through the VPN. If Tunnelblick has disabled network access a menu command to re-enable all access that was disabled will be available from the Tunnelblick icon in the menu bar. You can also re-enable Wi-Fi by turning it on, or re-enable other network services in System Preferences : Network. This setting may not work properly when more than one VPN is connected simultaneously.

- On unexpected disconnect specifies what Tunnelblick does when the VPN is disconnected unexpectedly (for example, if OpenVPN crashes or is unable to connect to the VPN and is set up to stop if that happens):
  - Do nothing
  - Reset primary interface: Tunnelblick reset the primary network interface, done by issuing 'ipconfig down; ipconfig up' on the interface. This can be helpful when certain configuration problems fail to restore network routing properly after a disconnection.
  - Disable network access ("Kill Switch"): Tunnelblick cuts off all network access (local and Internet) by turning off Wi-Fi and disabling all other network services. This can insure that nothing leaks out of the computer except through the VPN. If Tunnelblick has disabled network access a menu command to re-enable all access that was disabled will be available from the Tunnelblick icon in the menu bar. You can also re-enable Wi-Fi by turning it on, or re-enable other network services in System Preferences : Network. This setting may not work properly when more than one VPN is connected simultaneously.

- Monitor network settings determines whether or not Tunnelblick will monitor network settings for changes while the selected configuration is connected. This may be done to react to DHCP renewals or other network changes.
- Route all IPv4 traffic through the VPN. When checked, a '--redirect-gateway def1' option is sent to OpenVPN, causing routing to be set up to route all IPv4 traffic through the VPN. If this is not checked, all IPv4 traffic may still be sent through the VPN because the OpenVPN configuration file may contain the option, or the option may be "pushed" from the VPN server.
- Disable IPv6 (tun only). When checked, Tunnelblick will disable IPv6 traffic on all active interfaces (those set to use IPv6 "automatically") while the selected configuration is connected and restore it when the configuration is disconnected. This may only be done on "Tun" connections, not "Tap" connections.
- Check if the apparent public IP address changed after connecting. Usually when connected to a VPN all IPv4 traffic is routed through the VPN server and the computer's apparent public IP address changes. When connected from home to an office VPN, for example, the IP address would change from your home network's public IP address to a public IP address from your office network. Some configurations of VPNs do not route all VPN traffic through the VPN server, however, so Tunnelblick can make an independent check of whether or not the address changed. If it did not change, and you want it to, contact your VPN service provider and ask them to change their configuration files, or check the "Route all IPv4 traffic through the VPN".

The Advanced… button opens a window with settings that are less commonly used for the selected configuration or configurations.