Frequently Asked Questions

• If you haven't already, you can download VPN Tracker using this link.
• After the download has completed, launch the app and click the "Login" button in the top left-hand corner of the app home page.
• Enter your equinux ID and password in the space provided. Hint: This is the login you first created when purchasing VPN Tracker in our online store.

Are you a World Connect User?

You will need to download VPN tracker World Connect. You can do so using this link. VPN Tracker World Connect must be installed using the App Store. Once you've installed the app on your device, sign in with your equinux ID and password.

By default, traffic to the remote network cannot be sent through the VPN tunnel if it is using the same network as the local network.

Resolving a Network Conflict using Traffic Control

You can use Traffic Control and VPN Tracker will send non-essential local network traffic over the VPN.

Activate Traffic Control:
> Go to Advanced > Traffic Control
> Check "Force traffic over the VPN if remote networks conflict with local networks"

Note that you will never be able to reach the following addresses over VPN: The IP address of your local router, your DHCP server, and your DNS server(s). If you need to reach those IPs over VPN, you will have to resolve the network conflict instead of using Traffic Control. The same applies for any IPs that you need to reach locally and over VPN.

Resolving a Network Conflict Manually

You have two basic options for resolving a conflict:

1. Change the local network to use a different network address. In most situations, this will entail changing the LAN settings on the local router (including DHCP settings if DHCP is used).
2. Change the remote network to use a different network address. With most setups, this entails changing the LAN on the VPN gateway (including DHCP settings if DHCP is used), and changing the IPs used by devices on the VPN gateway's LAN (or triggering a DHCP refresh, if DHCP is used). If the LAN is used in the VPN settings (such as for policies or firewall rules), these will need to be changed as well. Finally, change the remote network in VPN Tracker to match the new settings

If you decide to change the remote network, it makes sense to choose a private network that less commonly used. According to our informal statistics, conflicts are least likely using these networks:

• Subnets of 172.16.0.0/12
• Subnets of 192.168.0.0/16, excluding 192.168.0.0/24, 192.168.1.0/24 and 192.168.168.0/24

If these are not an option, use a subnet of 10.0.0.0/8, excluding 10.0.0.0/24, 10.0.1.0/24, 10.1.0.0/24, 10.1.1.0/24. However, since wireless network operators sometimes choose to use the entire 10.0.0.0/8 network, the first two options are preferred.

If you have a more sophisticated VPN gateway, in particular a SonicWALL, you may be able to set up an alternative remote network on the VPN gateway that is mapped 1:1 through Network Address Translation (NAT) onto the actual network. Users can then connect to this network instead if they have a conflict of networks. We have a guide available that describes this approach for SonicWALL devices.

If the conflict is caused by virtual network interfaces (e.g. Parallels, VMware), see here for more information.

http://www.vpntracker.com/interop

For a general introduction to computer networking, VPNs and IPsec, there are several excellent introductions available online or as books, see for example here.

If you experience specific configuration problems, our technical engineers are happy to provide support for setting up VPN connections with VPN Tracker. In many cases, connection problems are related to misconfiguration of either VPN Tracker or the VPN gateway.

If you provide

• A problem description and information on what you've already tried
• A Technical Support Report from VPN Tracker ("Help" > "Generate Technical Support Report")
• Screenshots of the VPN gateway configuration
• A log from the VPN gateway

we can usually quickly spot the cause for a problem and provide advice on how to resolve it.

As there are several factors unrelated to VPN Tracker or the VPN gateway that can influence connectivity (e.g. firewalls/routers in between VPN Tracker and the VPN gateway), we cannot guarantee that a connection can be established under any circumstances.

While we try our best, our support options may be limited if

• you use a device which we did not test ourselves (most devices work just fine with VPN Tracker, though, and we're happy to take a look even at issues with untested VPN gateways)
• you do not provide the information we need in order to assist you (see above)
• your network administrator does not cooperate
• you change connection parameters while we're trying to debug the settings

There is a known bug in the Watchguard firmware that is causing a lot of trouble. Currently, we still do not know why VPN Tracker is triggering this bug, as the Windows client seems to not trigger it. We talked with Watchguard, but even they could not tell us what we are doing wrong. Basically the tunnel dies internally in the Watchguard (it's still shown as open and established, but traffic arriving over this tunnel is rejected as if the tunnel was closed).

If you are using a Branch Office VPN at the moment, try switching to a MUVPN if possible. MUVPN works with VPN Tracker as well and usually yields for better results.

Please refer to the following description.

If your credit card is being refused, please check the following information, for possible mistakes or mismatches :

• Please check the credit card number you have entered carefully for possible typos
• Make sure the expiration date entered is correct
• Check whether the security code you entered matches the code on your card: American Express cardholders can find the 4-digit code on the front of their card, other cardholders can usually find a 3-digit code on the back.
• Try another credit card, if you have access to one
• If you are certain your information is correct and your card is still not being accepted, it might be due to a technical issue with our credit card gateway. Please try again later.

You can view a copy of all your invoices in our Online Store:

You will find the invoices for your VPN Tracker 365 purchases in the section "Invoices", here:

http://my.vpntracker.com

You work in accounting and need access to the VPN Tracker invoices for your company? Please ask your VPN Tracker Team manager to invite you to you company's team with the role "Accounting". Afterwards you will receive emails as soon as a new invoice is available and you can dowload this from the web portal

‣ If you would like to save a PDF copy of your invoice, then do the following:
     Press "Command + P"
     Choose "PDF" > "Save as PDF"

Your equinux ID is your personal account at equinux. You can use it to purchase and activate products & licenses.

The first time you shop in our online store, you'll be asked to create an equinux ID. After your purchase, software licenses are automatically linked to your equinux ID and can be activated by simply entering the same equinux ID and password you used during purchase.

You can usually find the password for your equinux ID in the Keychain or your password app, listed under "id.equinux.com".

If you have forgotten your equinux ID and/or password, use our login & password retrieval form.

Our activation process requires that your Mac accepts cookies.

‣ To check this, please open up Safari. 
‣ Click on "Safari" in the main menu at the very top of the screen.
‣ Choose "Preferences." 
‣ Select the "Privacy" tab and verify that cookies are always accepted. 
‣ Make sure JavaScript at "Security" is also activated. 
‣ Please close Safari.
‣ Restart the application and retry the activation.

If you need to transfer a license to another equinux ID, you can easily do this yourself at my equinux.

‣ First log in with your equinux ID and password: http://my.equinux.com
‣ Click the checkboxes for each product that you want to transfer
‣ Click the "Transfer" button below and enter the equinux ID or email address of the new license owner and click next.       
‣ Finally click "Confirm" to complete the transfer. The system will transfer the license, display a message and email both the old and new license owner that the license has been transferred.

Don't worry – it happens to all of us!

Just head on over to our login retrieval page, enter your equinux ID or email address and we'll send you your details.

Recently changed your e-mail address? Send us a message!

Configuration guides for configuring VPN Tracker with Cisco devices are available here.

Configuration guides for Cisco Small Business (Linksys) devices are available here.

Import of Cisco IPsec VPN Client Configuration Files (.pcf)

Cisco VPN Client configuration files that use group password authentication can be imported into VPN Tracker:

‣ "File" > "Import 3rd Party Configuration" > "Cisco .pcf"

With one of the more recent firmware updates Secure Computing changed their implementation of the VPN related standards. These changes break VPN Tracker's ability to successfully establish a phase 2.

The problem has been resolved by Secure Computing in firmware 7.0.0.07. (epatch 7.0.0.06.E35)

For a certificate to be available in the "Local Certificate" list, it must be present in the Mac OS X Keychain with its corresponding private key.

You can easily check this in the Keychain Access application: If a certificate is listed under "My Certificates" (and not just "Certificates"), its private key is available and you will be able to select it in VPN Tracker as the "Local Certificate".

Important note for CheckPoint VPN users:

The Mac OS X Keychain Access application currently does not understand how to read private keys from some CheckPoint generated certificates.

To properly import the certificate into the Mac OS X Keychain, first convert it using the openssl command line tool:

1. Open a Terminal ("Applications" > "Utilities" > "Terminal")
   
   
2. Convert the certificate to PEM format:

     openssl pkcs12 -in /Users/joe/Desktop/MyCheckPointCert.p12 -out /tmp/out.pem
   

   Replace /Users/joe/Desktop/MyCheckPointCert.p12 with the path to the actual certificate that you want to convert.

   You will first be asked for the password that the certificate is encrypted with. If you do not know it, please ask the administrator who has created your certificate for you. You will then be asked twice for the password that will be used to protect the exported PEM file. You can use the same password that the original certificte was encrypted with. Note that no characters will appear on screen while you type in your passwords. Simply type the password and press the return key.

3. Convert the PEM file back to PKCS#12 (.p12) format:

     openssl pkcs12 -in /tmp/out.pem -export -out ~/Desktop/MyFixedCheckPointCert.p12
   

   Replace /Users/joe/Desktop/MyFixedCheckPointCert.p12 with the path where you want the fixed certificate to be stored.

   You will first be asked for the password that you have just used for exporting to the PEM file, and then for a password to protect the fixed .p12 file with. You can again use the same password for everything.

Now double-click your fixed certificate file to import it into the Mac OS X keychain.

The following article describes where VPN Tracker stores its data in case you need to make manual backups instead of using Time Machine.

VPN Tracker stores all its data files in the standard system locations as recommended by Apple. Depending on the fact if these are system-wide or per-user files, they are either found in /Library (system-wide) or ~/Library (per-user), where ~ is a placeholder meaning "home of the current active user".

To access the system-wide library folder:

• In Finder Choose "Go" > "Go to Folder ..."
• Enter /Library

To access the user library folder:

• In Finder Choose "Go" > "Go to Folder ..."
• Enter ~/Library

VPN shortcuts, all information related to your equinux ID, accounting data, scanner results, and window positions are per-user settings.

For a full backup of all your settings, you need to backup the following files and folders:

• /Library/Application Support/VPN Tracker 365
• /Library/Preferences/com.vpntracker.365mac.plist
• ~/Library/Application Support/VPN Tracker 365
• ~/Library/Preferences/com.vpntracker.365mac.plist

Backup your keychain
Please note that passwords in VPN Tracker are usually not stored in any of the locations named above but in your keychain. If you have no external backup of all your passwords, be sure to also backup your keychains which can be found in ~/Library/Keychains

Current Firmware (Fireware XTM)

WatchGuard Firebox X Edge e-Series devices with Fireware XTM (Fireware 11) are fully supported in current versions of VPN Tracker. For details please see our configuration guide.

Older Firmware

Devices running an older firmware may often work using the following setup. Please note however that we can't guarantee that this setup will work in all cases.

Start by creating a new user on the Firebox Edge and then configure MUVPN support for this user.

In VPN Tracker, use a "Custom Connection" device profile as the basis for your new connection.

Map the WatchGuard settings to your VPN Tracker configuration as shown in the table below:

The following settings are independent of your specific MUVPN configuration:

• Local Identifier Type: Email (even if it is a name and not an email address)
• Exchange Mode: Aggressive
• Phase 1 Diffie-Hellman Group: Group 2 (1024 bit)
• Perfect Forward Secrecy (PFS): off

Finally make sure the that VPN Tracker's "Network" setting is set to "Host to Network", and the correct Remote Network (i.e. the network that you want connect to through the VPN) is used (e.g. 192.168.1.0/255.255.255.0).

If you're running FortiOS 3, please make sure you are running at least MR6 patch 2. Previous firmware releases have an issue that will cause the device to respond incorrectly to VPN Tracker's attempts to use XAUTH in combination with an Aggressive Mode based connection.

SonicWALL Simple Client Provisioning with VPN Tracker is available with all SonicWALLs running SonicOS 4.0 or newer and all editions of VPN Tracker.

If you are still using VPN Tracker 6 or earlier, Professional or Player Edition is required.

SonicWALL Simple Client Provisioning requires VPN Tracker to send an initial data packet to the VPN gateway that is so large that it may be split ("fragmented") into two IP packets. Some routers are known to not let these packets pass.

If a router between VPN Tracker and the SonicWALL is affected by this problem, you (or your SonicWALL's admin) will notice no connection attempt arriving at the SonicWALL when Simple Client Provisioning is turned on (i.e. there will be nothing in the SonicWALL's log, and a packet trace will show no packets from VPN Tracker), but everything will work fine with DHCP over IPsec.

Routers known to have these problems:

• AirPort Extreme with firmware versions prior to 7.3.1, works when upgraded to 7.3.1

SonicWALL Simple Client Provisioning enables VPN Tracker to automatically retrieve the settings for the VPN connection from supported SonicWALL VPN gateways. For most users, it is only necessary to configure the SonicWALL's WAN IP address in VPN Tracker – everything else happens automatically.

For a list of supported SonicWALL devices, please refer to this FAQ.

For a list of compatible devices, please refer to this page.

If you router is not in the list please refer to this FAQ and the VPN Tracker manual for help determining compatibility.

Please note that the local router (i.e. the router at the location where your Mac with VPN Tracker is) in most cases does not have to be specifically compatible with VPN or VPN Tracker. Almost all routers work fine with VPN Tracker.

One of our customers has kindly provided instructions on how to integrate Cisco EasyVPN and VPN Tracker with a DMVPN setup:

EasyVPN Server and DMVPN Hub on 1 Cisco router tutorial

Using VPN Tracker 5 with a Cisco Easy VPN Server

When connecting via SonicWall SCP or SonicWall IKEv1 with DHCP, VPN Tracker 365 for Mac requests an IP address from the SonicWall gateway using the DHCP protocol. For this request, VPN Tracker 365 modifies the MAC address slightly, making it different from the actual MAC address of your device. This allows administrators to assign a fixed IP address when your Mac is connected via LAN or WiFi and a different IP when it’s connected through VPN.

This modification sets a specific bit in the MAC address, marking it as a self-assigned address rather than a factory-assigned one.

Example:
Original MAC address: 00:1B:63:B7:42:23
VPN Tracker MAC address: 02:1B:63:B7:42:23

Starting with macOS 15 Sequoia, Apple defaults to using a rotating MAC address for WiFi connections, labeled as a “Private Wi-Fi Address” in System Settings. To prevent connectivity issues related to this feature, VPN Tracker 365 reports the actual hardware address (with the minor modification described above) instead of the one used in “Rotating” or “Fixed” modes.

On iOS, VPN Tracker cannot retrieve a MAC address directly. Instead, it generates a random value once and stores it for future use. VPN Tracker for iOS then uses this stored value as the MAC address.

You need to enter your equinux ID and password to activate most equinux applications. However sometimes applications will also require you to enter your Mac OS X user password in order to access certain required system components.

So if you see a window like the one below, you'll need to enter the username and password of an Administrator account on your Mac to proceed, not your equinux ID and password.

Parallels

Go to "Preferences" > "Network" in Parallels and change the DHCP ranges for Shared and/or Host-Only Networking so they no longer conflict with your VPN's remote network.

VMware Fusion

A PDF with instructions can be downloaded from the VMware community forums:

• VMware Fusion 3.x
• VMware Fusion 1.x/2.x

IPsec VPN uses a different protocol (ESP) for the actual data transfer than for establishing the connection (IKE). Since the ESP protocol does not use network ports, NAT (Network Address Translation) routers may have difficulties handling it correctly. Only NAT routers that support "IPSec Passthrough" (sometimes also named "VPN Passthrough" or "ESP Passtrhough") and where this option is also enabled, can handle ESP data packets.

To work around this problem, two alternative tunneling methods exist:

• NAT-Traversal (old, RFC draft version)
• NAT-Traversal (new, RFC standard version)

Which of these methods will work with your connection depends on two properties:

1. Which of these methods allows traffic to pass through your local Internet router.
2. Which of these methods are supported by your VPN remote gateway.

To test for the first property, VPN Tracker will automatically establish three VPN test connections to a VPN gateway hosted by us whenever it detects a new router that has not been tested before. One connection uses plain ESP, the other two either NAT-T method mentioned above. It will remember the test results for this router and take them into account whenever you start a connection from the network location. The reason we are testing with our own gateway is simply that the test requires a gateway supporting all three methods, with a known configuration and a simply way to verify if traffic did arrive at that gateway.

The second property is not tested in advance, VPN Tracker will become aware of that information when it actually tries to connect to your VPN gateway. VPN Tracker will compare the methods your gateway supports with the stored test results. If there is a match, a method that your gateway supports and that was also working during the test, this method will be used. If there is no match, VPN Tracker will immediately stop and show an appropriate error in the log, explaining the situation.

If you suspect a NAT-Traversal issue or you think the previous test results may be wrong or outdated, simply re-run the test:

‣ Make sure NAT-Traversal (Advanced tab) is set to Automatic
‣ Go to "Tools" > "Test VPN Availability"
‣ Click "Test Again"
‣ Wait until the test has completed, then connect to your VPN

The test dialog also allows you to tell VPN Tracker to not test the current location and forget any previously created test results. This is rarely needed and also not recommended but there might be situation where the test results are wrong because access to our VPN gateway is not possible (e.g. it is blocked) and thus the test result are just bogus and say nothing about the true capabilities of your VPN gateway.

VPN Tracker supports X.509 certificates (RSA Signatures) and smart cards using X.509 certificates (PKI tokens) for authentication.

For more information, see the VPN Tracker manual.

Are you seeing a 'Server certificate' error message whilst activating your equinux software?

One likely cause is your system's date & time: Make sure your system clock is set correctly by checking 'Set date & time automatically' under System Preferences > Date & Time.

We also use a fairly new security certificate to protect your data. However, older versions of OS X might not immediately recognize the certificate.

To make sure OS X will recognize the certificate, you could try one of the following two fixes:

Run Software Update

‣ Go to the System Preferences and select "Software Update"
‣ Install any available system updates 
‣ Afterwards, restart and try activating again

Disable your firewall

Please make sure you are not running any firewalls which may block access to our activations server. Applications you may wish to disable temporarily include:

• Mac OS X Firewall
• LittleSnitch (Litte Snitch Configuration - Preferences … - General - Stop)
• Intego NetBarrier

Disable your proxy

In some cases the use of proxies may interfere with certain certificates stored in your Keychain.

‣ Open System Preferences
‣ Go to the "Network" section
‣ Choose your network connection and click "Advanced…"
‣ Uncheck any proxies you may have configured and click "Ok"

Check your Keychain

‣ Open: "Application" > "Utilities" > "Keychain Access" 
‣ Select "Keychain Access" > "Keychain First Aid"
‣ Enter your OS X account password, select Repair on the right and hit Start

Install the root certificate manually

• Download the latest Let's Encrypt root certificates
• Double-click to add the certificate to your Mac's keychain
  Tip: If you have multiple users on the Mac, add it to the 'System' keychain to fix this problem for all users
• Double-click the new entry "ISRG Root X1" to open the trust settings
  
  
  
  
• Under "Trust", choose "Always trust"
  
  
  
  
• Close the window and confirm with your Mac user password

You should now be able to activate your software using your equinux ID and password.

VPN Tracker 9 & VPN Tracker 10