• If you haven't already, you can download VPN Tracker using this link.
• After the download has completed, launch the app and click the "Login" button in the top left-hand corner of the app home page.
• Enter your equinux ID and password in the space provided. Hint: This is the login you first created when purchasing VPN Tracker in our online store.

Are you a World Connect User?

You will need to download VPN tracker World Connect. You can do so using this link. VPN Tracker World Connect must be installed using the App Store. Once you've installed the app on your device, sign in with your equinux ID and password.

If your renewal payment is failing because your card was declined, please update the card on file by entering the same card details again as a new payment method.

Even if the card information has not changed, re-adding the card can trigger a different verification process with your bank or card provider. This may help the renewal payment go through if the previous attempt was incorrectly flagged as fraud.

If the payment still fails after updating the card, please contact your bank to confirm that the transaction is legitimate and that online or subscription payments are allowed for this card.

Apple sends this email if there is a billing issue. Apple provides information on how to resolve this issue at https://support.apple.com/de-de/HT203005

Some kinds of software may cause issues with VPN Tracker:

1. Personal Firewalls / Desktop Firewalls
2. Protection Software (e.g Virus Scanners, Malware Protection)
3. Other VPN Clients / VPN Software (for example NCP Client)

Personal Firewalls usually ask the user, if an app should be allowed to send network traffic. It’s important to grant VPN Tracker full network access. If you have already added rules for VPN Tracker, please whitelist VPN Tracker.

Protection Software often sees VPN traffic as a potential source of threat, as it isn’t able to analyze that traffic because of its very strong encryption. Please ensure VPN Tracker is ignored by any protection software running on your Mac and allow VPN traffic to pass through.

Other VPN clients should not be a problem, if they are designed to co-exist with othe VPN apps. Unfortunately, not all other clients are and some capture all VPN traffic as soon as they are installed, even if the app is not running.
In these situations, you may need to uninstall the VPN client - we also suggest asking the vendor to improve its “cooperation” with other VPN apps.

Here are some common examples of the types of apps mentioned above. If you are uncertain whether any of these applications may be installed on your system, try the following:

• Open the app “Terminal”
• Copy and paste the following command: systemextensionsctl list

You’ll get a list of all system extensions installed on your system. Just compare that list with the identifiers in parenthesis below:

• Little Snitch
  (at.obdev.littlesnitch.networkextension)
   
• TripMode
  (ch.tripmode.TripMode.FilterExtension, com.alix-sarl.TripMode.FilterExtension)
   
• Sophos Anti Virus
  (com.sophos.endpoint.networkextension, com.sophos.endpoint.scanextension)
   
• Symantec Endpoint Protection / Norton AntiVirus
  (com.symantec.mes.systemextension)
   
• Kaspersky Internet/Total Security
  (com.kaspersky.kav.systemextension, com.kaspersky.kav.networkextension)
   
• Intego Mac Internet Security
  (com.intego.netbarrier.extension, com.intego.virusbarrier.extension)
   
• Fortinet FortiClient
  (com.fortinet.forticlient.macos.systemextension, com.fortinet.forticlient.macos.networkextension)
   
• Cisco Advanced Malware Protection (AMP) / Cisco Secure Endpoint
  (com.cisco.amp.endpointsecurity.extension, com.cisco.amp.networkextension)
   
• eset Security Products
  (com.eset.endpointsecurity.systemextension, com.eset.networkextension)
   

VPN Tracker may prompt you for different passwords depending on the action you're performing. This guide explains what each prompt means and which password you should enter.

1. Your Mac Password

When is it needed?
– Installing VPN Tracker
– Approving system extensions

Why?
macOS requires your administrator password to authorize changes on your system.

Where do I find it?
This is your local Mac password – the one you use to log in when your Mac starts up.

2. Your equinux ID (VPN Tracker Account)

When is it needed?
– Logging into the VPN Tracker app (Mac or iOS)
– Accessing your account at my.vpntracker.com

Why?
This is your personal VPN Tracker account, giving you access to your plan, team, connections, and device settings.

Where do I find it?
This password is usually saved in your Keychain or Passwords app under “id.equinux.com”.

3. Pre-Shared Key (PSK) / Shared Secret

When is it needed?
– When setting up or connecting to a VPN connection

Why?
Some VPNs use a PSK to authenticate users. This key must match what’s configured on the VPN gateway.

Tip for Teams: Admins can share pre-configured VPN connections via TeamCloud to avoid PSK confusion.

Where do I find it?
This is usually set by your company’s VPN admin and stored in the connection. You typically don’t need to know it yourself.

4. Your Company Login (XAUTH Credentials)

When is it needed?
– When connecting to a company VPN

Why?
You may need to enter your company login (often the same credentials you use at work) to authenticate with the VPN.

Where do I find it?
You should have received it from your IT team — and hopefully not written it on a Post-it under your keyboard.

Parallels

Go to "Preferences" > "Network" in Parallels and change the DHCP ranges for Shared and/or Host-Only Networking so they no longer conflict with your VPN's remote network.

VMware Fusion

A PDF with instructions can be downloaded from the VMware community forums:

• VMware Fusion 3.x
• VMware Fusion 1.x/2.x

By default, traffic to the remote network cannot be sent through the VPN tunnel if it is using the same network as the local network.

Resolving a Network Conflict using Traffic Control

You can use Traffic Control and VPN Tracker will send non-essential local network traffic over the VPN.

Activate Traffic Control:
> Go to Advanced > Traffic Control
> Check "Force traffic over the VPN if remote networks conflict with local networks"

Note that you will never be able to reach the following addresses over VPN: The IP address of your local router, your DHCP server, and your DNS server(s). If you need to reach those IPs over VPN, you will have to resolve the network conflict instead of using Traffic Control. The same applies for any IPs that you need to reach locally and over VPN.

Resolving a Network Conflict Manually

You have two basic options for resolving a conflict:

1. Change the local network to use a different network address. In most situations, this will entail changing the LAN settings on the local router (including DHCP settings if DHCP is used).
2. Change the remote network to use a different network address. With most setups, this entails changing the LAN on the VPN gateway (including DHCP settings if DHCP is used), and changing the IPs used by devices on the VPN gateway's LAN (or triggering a DHCP refresh, if DHCP is used). If the LAN is used in the VPN settings (such as for policies or firewall rules), these will need to be changed as well. Finally, change the remote network in VPN Tracker to match the new settings

If you decide to change the remote network, it makes sense to choose a private network that less commonly used. According to our informal statistics, conflicts are least likely using these networks:

• Subnets of 172.16.0.0/12
• Subnets of 192.168.0.0/16, excluding 192.168.0.0/24, 192.168.1.0/24 and 192.168.168.0/24

If these are not an option, use a subnet of 10.0.0.0/8, excluding 10.0.0.0/24, 10.0.1.0/24, 10.1.0.0/24, 10.1.1.0/24. However, since wireless network operators sometimes choose to use the entire 10.0.0.0/8 network, the first two options are preferred.

If you have a more sophisticated VPN gateway, in particular a SonicWALL, you may be able to set up an alternative remote network on the VPN gateway that is mapped 1:1 through Network Address Translation (NAT) onto the actual network. Users can then connect to this network instead if they have a conflict of networks. We have a guide available that describes this approach for SonicWALL devices.

If the conflict is caused by virtual network interfaces (e.g. Parallels, VMware), see here for more information.

Current Firmware (Fireware XTM)

WatchGuard Firebox X Edge e-Series devices with Fireware XTM (Fireware 11) are fully supported in current versions of VPN Tracker. For details please see our configuration guide.

Older Firmware

Devices running an older firmware may often work using the following setup. Please note however that we can't guarantee that this setup will work in all cases.

Start by creating a new user on the Firebox Edge and then configure MUVPN support for this user.

In VPN Tracker, use a "Custom Connection" device profile as the basis for your new connection.

Map the WatchGuard settings to your VPN Tracker configuration as shown in the table below:

Watchguard	VPN Tracker
Account Name	Local Identifier
Shared Key	Preshared Key
Virtual IP Address	Local Address
Authentication Algorithm	Phase 1 and Phase 2 Hash/Authentication Algorithms
Encryption Algorithm	Phase 1 and Phase 2 Encryption Algorithms
Key expiration in hours	Phase 1 and Phase 2 Lifetime

The following settings are independent of your specific MUVPN configuration:

• Local Identifier Type: Email (even if it is a name and not an email address)
• Exchange Mode: Aggressive
• Phase 1 Diffie-Hellman Group: Group 2 (1024 bit)
• Perfect Forward Secrecy (PFS): off

Finally make sure the that VPN Tracker's "Network" setting is set to "Host to Network", and the correct Remote Network (i.e. the network that you want connect to through the VPN) is used (e.g. 192.168.1.0/255.255.255.0).

A Technical Support Report contains your VPN Tracker settings and relevant network and system settings that our technical support team needs to be able to assist you quickly. Confidential data (e.g passwords, pre-shared keys, private keys) are not included in a Technical Support Report (TSR).

How to create a Technical Support Report on a Mac:

‣ Click on your VPN connection in VPN Tracker 365.
‣ In the bottom right corner under the "Status" tab, you will see the TSR button.
‣ Click the button to generate the report and follow the instructions to send to our support team.

How to create a Technical Support Report on an iPhone/iPad:

‣ Tap on the connection. The connection card appears.
‣ Tap on “Feedback”
‣ Provide a short description of the connection problem
‣ Tap on Send

If you have an issue connecting to the VPN in the first place, please make a connection attempt right before creating the Technical Support Report, then create the Technical Support Report as soon as the connection attempt has failed.

If you can connect to the VPN, but something is not working right after the connection has been established, please establish the VPN connection, then create the Technical Support Report while the VPN is connected.

You can either email the report directly to our support team from VPN Tracker 365, or save it to email later or from a different computer, or to upload it using the contact form on our website:

Whenever possible, also include screenshots of the VPN setup on your VPN gateway.

Setting up VPN on your Mac

VPN Tracker is the leading VPN client for macOS and works seamlessly on all the latest macOS operating systems.
You can download and test VPN Tracker here free.

Launching VPN Tracker for Mac

The first time you launch VPN Tracker on your Mac, you may need to grant it permission to create VPN connections for you. First please make sure VPN Tracker is in your Applications folder and complete these steps locally on the Mac (e.g. not over Screen Sharing, Remote Desktop or other remote access tool).
IMPORTANT: macOS notices when you run remote desktop systems like TeamViewer, Apple Remote Desktop, VNC or similar. and hides these buttons. You MUST be local to the Mac.
Then do this:

‣Open System Preferences
‣Go to Security
‣Click "Allow"

Now you'll be able to set up VPN Tracker.

Troubleshooting VPN Setup on macOS

If the "Allow" button can not be clicked, please make sure you are not using a 3rd party mouse or tablet input device, as these can look like remote desktop software to your Mac. If you are using e.g. a Wacom input tablet or mouse utility tool, try disabling those, reboot your Mac and then try clicking the button again. In case the button doesn't even appear in the dialog, please note that if your Mac has a MDM profile installed, the MDM profile can forbid users to approve their own System Extensions. In that case the profile itself has to approve our extension. Please see technical notes below. Technical note for Enterprise Rollouts: VPN Tracker for Mac uses a System Extension to create a secure VPN tunnel and manage network traffic. macOS High Sierra and newer macOS versions now require users to manually approve all System Extensions. For Enterprise rollouts via MDM, you can also pre-approve the VPN Tracker Kernel Extension using a special profile. Our Team IDs are CPXNXN488S and MJMRT6WJ8S.
Please see Apple's Support Document for more details. Not using an MDM managed Mac? If your Mac is not MDM managed, please try rebooting, as macOS occasionally can get tripped up with System Extensions. After the reboot, VPN Tracker should work fine.

VPN Tracker supports industry standard OpenVPN, IPsec (IKEv1 + IKEv2), L2TP, PPTP, SSL, SSTP, and WireGuard® protocols. This means that it will work with almost all devices supporting these types of VPN connections.

A list of tested devices is available on our website

What if my device is not on this list?

There are hundreds of VPN devices available on the market, and we'd love to offer device profiles for all of them. Unfortunately, it is impossible to test all devices. If your gateway is not in the list, it will probably still work with VPN Tracker.

Tip: Try out one of our custom protocol profiles to test your VPN connection free in VPN Tracker on Mac, iPhone or iPad.

Luckily, this is an incorrect report. The XCSSET malware is a trojan that replicates project files via Xcode; it targets mostly developers. To get it, you would need to download an infected Xcode project and build it. It creates fake apps and also downloads and installs payload (adware and similar things). So it does not infect existing apps. An interesting property of XCSSET is that it's mostly implemented in AppleScript. The generated fake apps contain a folder "Contents/Resources/Scripts" in which those AppleScript files reside. You can right-click on VPN Tracker 365 or Mail Designer 365 in Finder, then click on "Show Package Contents" to check whether this Scripts folder or any AppleScript files (*.scpt) can be found; VPN Tracker 365 and Mail Designer 365 do not contain AppleScript files.

You purchased VPN Tracker 365, VPN Tracker World Connect or Mail Designer 365? You can use the app on up to three personal devices per license. To do so, simply sign in to your account to use your plan on your Macs (or your iOS device where applicable) using just your equinux ID and password. You may use the software in parallel on one computer per license. If you want to use the software on multiple devices in parallel, or other family members or colleagues also want to use the software on their computers, you will need a separate license for each person or each parallel use. A VPN Tracker 10, VPN Tracker 9 or Spot Maps license can be active on one Mac at the same time. If you want to use the Software on multiple devices, you will need an separate license per device.

To enable VPN Tracker to load its required system extensions via your MDM system, follow these steps:

1. Add a System Extension Policy

Create or edit a System Extension Policy payload in your MDM system.

Required values:

• Team Identifier: CPXNXN488S
• Allowed System Extension Types: Depending on your configuration, you can choose to allow all or specify only Network Extensions.

2. Apply the Team Identifier Rule

The Team Identifier CPXNXN488S should be added under the allowed team identifiers. This setting ensures that all system extensions signed by the VPN Tracker team are trusted.

Important: The Team Identifier rule takes precedence over global "Allow All" settings. If a Team Identifier is present, the system will only allow extensions signed by listed identifiers—even if "Allow All" is enabled.

3. Push the Configuration

Save and deploy the updated configuration profile to your target Macs. After installation, VPN Tracker should be able to load its system extensions without requiring user approval.

Such a setup is called “Host to Everywhere” in VPN Tracker. All non-local traffic will be sent through the VPN. For this setup to work, it must be properly configured in VPN Tracker and on the VPN gateway:

1. The Network Topology must be set to “Host to Everywhere” in VPN Tracker
2. The VPN gateway must accept an incoming VPN connection with a 0.0.0.0/0 (= everywhere) endpoint

Once these are configured, it should already be possible to establish the VPN connection. However, it is very likely that Internet access will not yet work. For Internet access to work, several more things need to be configured on the VPN gateway:

1. The VPN gateway must route VPN traffic not destined for its local networks out on the Internet
2. This traffic must be subject to Network Address Translation (NAT) in order for replies to reach the VPN gateway
3. In many cases, a suitable remote DNS setup is necessary for DNS resolution to continue to work

Note that not alll VPN gateways can be configured for Host to Everywhere connections. Most devices designed for small office or home networks (e.g. devices by NETGEAR or Linksys) are not capable of dealing with Host to Everywhere connections.

We use analytics to help us improve the app and your overall VPN experience. All measurements are completely anonymous and we never evaluate any personal information or any data going through your connection.

What is measured

• Generic connection settings (e.g. what type of connection it is, which options are being used etc.)
• Which features are used (e.g. is auto-connect enabled, are any actions configured etc.)
• How many connections you have

Your data, your privacy

• Your specific network settings or credentials are never read, captured or transmitted
• Your VPN traffic is never analyzed, captured or accessible

You’re in control

If you’d prefer not to share any anonymous usage information with equinux, you can deactivate this option at any time in VPN Tracker’s preferences by unchecking 'Share diagnostics data'.

Beta versions are soon to be released versions of VPN Tracker 365. We like to release beta versions to allow users to give us feedback on new features we've been developing before we roll them out to the general public. If you would like to become part of our beta testing program, you will need to activate access to early release versions in the app.

Open the VPN Tracker 365 app and go to "VPN Tracker 365" > "Preferences"
Next to "Update", check the box "Get early access to Pre-Release versions"
From the drop down menu, select "Beta versions"

Tip: Next to "Update" you can also check "Automatically check for updates". This way, VPN Tracker 365 will inform you whenever a new beta version is available for testing. Are you an experienced IT admin wanting to take things one step further? Check out our Nightly builds... If you run into issues on a beta version and want to get back to an older build, you can always find our latest official release on the version history page. Please also note that you can deactivate beta testing at any time by unchecking the box in your app preferences.

SonicWALL Simple Client Provisioning with VPN Tracker is available with all SonicWALLs running SonicOS 4.0 or newer and all editions of VPN Tracker.

If you are still using VPN Tracker 6 or earlier, Professional or Player Edition is required.

Please check if it is possible to open the address https://my.vpntracker.com in Safari. This problem tends to occur if our website is blocked through a firewall or another content filter.

For a Zyxel IKEv2 VPN connection on Mac, VPN Tracker needs the access details and technical settings configured on your Zyxel gateway. This usually includes the public IP address or hostname of the VPN gateway, the authentication method, the Pre-Shared Key or user login, and in some cases remote network, DNS, and identifier settings.

For many Zyxel devices, setup can be easier if your IT team exports a .mobileconfig file. According to the VPN Tracker guide, Zyxel ATP, USG Flex, and Nebula devices can export VPN configuration profiles as mobileconfig files. VPN Tracker can import these via Apple Configuration Profile import and extract compatible VPN settings automatically. This helps avoid typos and is especially useful when the same VPN setup needs to be rolled out to multiple teachers or team members. More details are available in Zyxel Mobileconfig: How to Export and Use Your VPN Profile.

If your school uses a Zyxel ATP gateway, the VPN setup can also be prepared with the Zyxel Connection Wizard. The article set up Zyxel VPN on Mac and iOS describes IKEv2 IPSec, Split Tunnel, a dedicated IP address pool for VPN clients, and VPN users created in the wizard. Make sure you save the Pre-Shared Key, as you will need it later in VPN Tracker.

If no mobileconfig file is available, enter the settings manually in VPN Tracker. The important part is that the gateway address, authentication method, Pre-Shared Key, username, remote network, and identifiers match the Zyxel gateway configuration exactly. The general guide connect to IKEv2 VPN on Mac, iPhone, and iPad explains which information is required for IKEv2 connections and when local identifiers, DNS, remote networks, and Phase 1 / Phase 2 settings may be relevant.

In practice, the easiest option is often for the VPN gateway administrator to create and test the connection once in VPN Tracker, then share it with the relevant users through the team management features. This means individual teachers or team members do not have to recreate technical gateway, identifier, or Phase 1 / Phase 2 settings manually. The guide to share VPN connections with VPN Tracker Team explains how to share a verified connection with the team.

If you do not manage the VPN gateway yourself, ask your IT team for a mobileconfig file or, alternatively, for the gateway address, VPN protocol, authentication method, username, password, Pre-Shared Key, remote network, identifier type, and any Phase 1 / Phase 2 requirements.