There are a number of possible causes for such a behavior. This FAQ will help you to find out what is causing the problem in your specific situation. In this FAQ we will be using destination device as a generic term for the device you are trying to connect to. The destination device can be anything from a normal computer, to a server, to a network printer.

1. Are you trying to connect to the destination device using a host name?

If you are using a host name, please try once using its IP address instead. If that works, the problem has to do with DNS resolution. Please make sure DNS is enabled for the VPN connection and correctly configured. Note that using Bonjour or NETBIOS hostnames is generally not possible over VPN.

2. Is the IP address you are connecting to really part of the remote network?

For example, if your remote network is 192.168.13.0/24, you should be able to connect to IPs starting with 192.168.13.x, but connections to IPs starting with 192.168.14.x will not work as they are outside the address range of traffic tunneled through the VPN.

3. Is the local address in VPN Tracker part of the remote network?

Using a local address in VPN Tracker (Basic > Local Address) that is part of the remote network is not possible with most VPN gateways. Please use a local address that is outside all remote networks. For example, if your remote network is 192.168.13.0/24, do not use an address starting with 192.168.13. If you are using an automatic configuration method (e.g. Mode Config, EasyVPN, DHCP over VPN) you may be able to assign a local address to VPN Tracker that is part of the remote network. Refer to the configuration guide for your VPN gateway for more information.

4. Could multiple VPN users use the same local address?

If multiple VPN users exist, pleas make sure no two users are using the same local address (Basic > Local Address), otherwise one of them will not be able to use the tunnel anymore whenever both of them are connected. If that field is empty in your configuration, VPN Tracker will just use the IP address of your primary network interface as local address, and of course, this can also cause an address conflict with another user, that’s why we do not recommend to leave that field empty if there are multiple VPN users.

5. Can you ping the LAN address of the VPN gateway?

You can find a ping tool directly in VPN Tracker under Tools > Ping Host. The LAN address of the VPN gateway is special in the regard that this address doesn’t need to be routed at all. So if you can ping that address but no other remote address, it is most likely a routing issue at the remote end.

6. If you can't ping anything, try re-running the VPN Availability Test

The VPN Availability Test can be found in the menu: Tools > VPN Availability Test. Then try connecting the VPN again. The results of this test depend on the capabilities of your local Internet router/modem or the Internet connection itself and they influence how the VPN tunnel is established. VPN Tracker automatically runs the test for every new Internet connection it is able to detect but even if a connection has been tested before, there are various reasons why the behavior of that connection may have changed in the meantime.

7. Is your VPN gateway the default gateway (router) of its network?

If the VPN gateway is not the default gateway, you will in many cases need a suitable routing setup in order for responses to reach you. Whenever a device doesn’t know how to reach an IP address directly, it forwards its reply to its default gateway and if that isn’t the VPN gateway, it won’t know what to do with that reply data. In that case its important to configure the default gateway to forward replies to VPN users to the VPN gateway.

8. Is your VPN gateway the default gateway (router) of its network?

For more details, we would like to direct you to the following FAQ entry.

The Pre-Shared Key (sometimes called shared secret) is basically a form of password for your VPN gateway which is set up on your device.

Configuring the Pre-Shared Key for a new VPN connection

VPN Tracker provides setup guides for all major gateway manufacturers. In these setup guides, you will also find information on how to set up a secure Pre-Shared Key for your specific device.

You can access all guides on this page.

I have lost my Pre-Shared Key - how can I get it back?

Here are a few tips for you to try and restore your Pre-Shared Key:

1. Check if you have stored the affected connection in your Personal Safe. If so, you may be able to download the connection again.
2. Check the Keychain (Applications > Utilities > Keychain Access). The Pre-Shared Key is usually saved here. Enter "Shared Secret" into the search bar to view a list of all your saved PSKs.
3. Are you using Time Machine Backup? You could try restoring an older connection with the Pre-Shared-Key.
4. Check your firewall or ask the relevant VPN Administrator. Refer to your device handbook to find out where to obtain this information on your specific firewall.

• If you haven't already, you can download VPN Tracker using this link.
• After the download has completed, launch the app and click the "Login" button in the top left-hand corner of the app home page.
• Enter your equinux ID and password in the space provided. Hint: This is the login you first created when purchasing VPN Tracker in our online store.

Are you a World Connect User?

You will need to download VPN tracker World Connect. You can do so using this link. VPN Tracker World Connect must be installed using the App Store. Once you've installed the app on your device, sign in with your equinux ID and password.

Some kinds of software may cause issues with VPN Tracker:

1. Personal Firewalls / Desktop Firewalls
2. Protection Software (e.g Virus Scanners, Malware Protection)
3. Other VPN Clients / VPN Software (for example NCP Client)

Personal Firewalls usually ask the user, if an app should be allowed to send network traffic. It’s important to grant VPN Tracker full network access. If you have already added rules for VPN Tracker, please whitelist VPN Tracker.

Protection Software often sees VPN traffic as a potential source of threat, as it isn’t able to analyze that traffic because of its very strong encryption. Please ensure VPN Tracker is ignored by any protection software running on your Mac and allow VPN traffic to pass through.

Other VPN clients should not be a problem, if they are designed to co-exist with othe VPN apps. Unfortunately, not all other clients are and some capture all VPN traffic as soon as they are installed, even if the app is not running.
In these situations, you may need to uninstall the VPN client - we also suggest asking the vendor to improve its “cooperation” with other VPN apps.

Here are some common examples of the types of apps mentioned above. If you are uncertain whether any of these applications may be installed on your system, try the following:

• Open the app “Terminal”
• Copy and paste the following command: kextstat | grep -v com.apple

You’ll get a list of all kernel extensions that are not from Apple. Just compare that list with the identifiers in parenthesis below:

• Little Snitch
  (at.obdev.nke.LittleSnitch)
   
• TripMode
  (ch.tripmode.TripModeNKE)
   
• Sophos Anti Virus
  (com.sophos.kext.oas, com.sophos.nke.swi)
   
• Symantec Endpoint Protection / Norton AntiVirus
  (com.symantec.kext.SymAPComm, com.symantec.kext.internetSecurity, com.symantec.kext.ips, com.symantec.kext.ndcengine, com.symantec.SymXIPS)
   
• Kaspersky Internet/Total Security
  (com.kaspersky.nke ,com.kaspersky.kext.kimul, com.kaspersky.kext.klif, com.kaspersky.kext.mark)
   
• Intego Mac Internet Security
  (com.intego.netbarrier.kext.network, com.intego.virusbarrier.kext.realtime, com.intego.netbarrier.kext.process, com.intego.netbarrier.kext.monitor)
   
• Fortinet FortiClient
  (com.fortinet.fct.kext.avkern2, com.fortinet.fct.kext.fctapnke)
   
• Cisco Advanced Malware Protection (AMP)
  (com.cisco.amp.nke, com.cisco.amp.fileop)
   
• TUN/TAP based VPN Clients
  (net.sf.tuntaposx.tap, net.sf.tuntaposx.tun)
   
• eset Security Products
  (com.eset.kext.esets-kac, com.eset.kext.esets-mac und com.eset.kext.esets-pfw)
   

Disclaimer: Please be aware that resetting your Personal Safe will delete all of your VPN connections and passwords.

If you have your Personal Safe recovery key or can retrieve your old equinux ID password, follow the recovery steps in VPN Tracker instead.

1. If you have connections or Shortcuts on your Mac that are stored in your Personal Safe, deactivate Personal Safe in preferences and create a local copy of your connections
2. Go to your Personal Safe webpage and delete your user keys: https://my.vpntracker.com/user/sync/keys
3. Sign out from your VPN Tracker account on your Mac, open Keychain Access, and delete the entry "Connection Safe Master Key."
4. Then sign back in and add a connection to your safe.
5. Don't forget to write down the new recovery key and keep it in a safe place. This will enable you to log in if you ever lose your login details.

VPN Tracker has three settings that can speed up connecting to Cisco devices and improve compatibility.

• Establish a shared tunnel to 0.0.0.0/0 for split-tunneling
• Send Cisco firewall attribute
• Use ... as the application version during Mode Config

Note: All settings described on this page require VPN Tracker 6.2 or newer.
 

Establish a shared tunnel to 0.0.0.0/0 for split-tunneling

What does this setting do?
In a split-tunneling setup using EasyVPN, VPN Tracker will no longer establish an IPsec Security Association (SA) to each remote network, but establish a single SA to 0.0.0.0/0. Split-tunneling is achieved only through an appropriate routing setup. This can speed up the connection processes significantly for connections with multiple remote networks.

When should I use this setting?
The setting works with most Cisco devices that use EasyVPN and a split-tunneling setup.

How can I try it?

On the Advanced tab, uncheck the box “Establish a separate tunnel for each remote network” (see screenshot)
Make sure the box “Establish a shared tunnel to 0.0.0.0/0 for split tunneling” is checked (see screenshot)

If your connection does not work with this new setting, simply revert back to your previous setup by checking the box “Establish a separate tunnel for each remote network”.

Send Cisco firewall attribute

What does this setting do?
This setting causes VPN Tracker to send a special attribute during EasyVPN indicating the presence of a firewall.

When should I use this setting?
You can try enabling this setting if your current EasyVPN-based connection to a Cisco device gets dropped at phase 2 (“The VPN gateway asked VPN Tracker to disconnect...” error).

Use ... as the application version during Mode Config

What does this setting do?
This setting causes VPN Tracker to send a different application version than the default “VPN Tracker 6” during EasyVPN and Mode Config.

When should I use this setting?
You can try setting a different application version, e.g. “Cisco Systems VPN Client 4.8.0:Linux” if your current EasyVPN-based connection to a Cisco device gets dropped at phase 2 (“The VPN gateway asked VPN Tracker to disconnect...” error).

{S_107}

VPN Tracker offers complete support for OpenVPN connections, as well as IPsec (IKEv1 + IKEv2), PPTP, L2TP, SSL (including SonicWALL, Cisco AnyConnect & Fortinet), SSTP (Windows) and WireGuard® (Beta - learn more).

To find out how to set up an OpenVPN connection on your Mac, iPhone or iPad, please refer to our OpenVPN configuration guide.

WireGuard is a registered trademark of Jason A. Donenfeld.

If you are an existing VPN Tracker customer and want to upgrade to VPN Tracker 365, you can simply install VPN Tracker 365 and your connections will automatically be imported:

Download VPN Tracker 365

Once you have VPN Tracker 365, you can purchase a VPN Tracker 365 plan.

There is a known bug in the Watchguard firmware that is causing a lot of trouble. Currently, we still do not know why VPN Tracker is triggering this bug, as the Windows client seems to not trigger it. We talked with Watchguard, but even they could not tell us what we are doing wrong. Basically the tunnel dies internally in the Watchguard (it's still shown as open and established, but traffic arriving over this tunnel is rejected as if the tunnel was closed).

If you are using a Branch Office VPN at the moment, try switching to a MUVPN if possible. MUVPN works with VPN Tracker as well and usually yields for better results.

Please refer to the following description.

IPsec VPN uses a different protocol (ESP) for the actual data transfer than for establishing the connection (IKE). Since the ESP protocol does not use network ports, NAT (Network Address Translation) routers may have difficulties handling it correctly. Only NAT routers that support "IPSec Passthrough" (sometimes also named "VPN Passthrough" or "ESP Passtrhough") and where this option is also enabled, can handle ESP data packets.

To work around this problem, two alternative tunneling methods exist:

• NAT-Traversal (old, RFC draft version)
• NAT-Traversal (new, RFC standard version)

Which of these methods will work with your connection depends on two properties:

1. Which of these methods allows traffic to pass through your local Internet router.
2. Which of these methods are supported by your VPN remote gateway.

To test for the first property, VPN Tracker will automatically establish three VPN test connections to a VPN gateway hosted by us whenever it detects a new router that has not been tested before. One connection uses plain ESP, the other two either NAT-T method mentioned above. It will remember the test results for this router and take them into account whenever you start a connection from the network location. The reason we are testing with our own gateway is simply that the test requires a gateway supporting all three methods, with a known configuration and a simply way to verify if traffic did arrive at that gateway.

The second property is not tested in advance, VPN Tracker will become aware of that information when it actually tries to connect to your VPN gateway. VPN Tracker will compare the methods your gateway supports with the stored test results. If there is a match, a method that your gateway supports and that was also working during the test, this method will be used. If there is no match, VPN Tracker will immediately stop and show an appropriate error in the log, explaining the situation.

If you suspect a NAT-Traversal issue or you think the previous test results may be wrong or outdated, simply re-run the test:

‣ Make sure NAT-Traversal (Advanced tab) is set to Automatic
‣ Go to "Tools" > "Test VPN Availability"
‣ Click "Test Again"
‣ Wait until the test has completed, then connect to your VPN

The test dialog also allows you to tell VPN Tracker to not test the current location and forget any previously created test results. This is rarely needed and also not recommended but there might be situation where the test results are wrong because access to our VPN gateway is not possible (e.g. it is blocked) and thus the test result are just bogus and say nothing about the true capabilities of your VPN gateway.

The import password is the password with that an exported connection is encrypted on disk. You need to provide it otherwise VPN Tracker won't be able to read the encrypted file. The intention of that password is to prevent that unauthorized users will be able to import or use that connection.

The unlock password is a password that locks the exported connection from being edited. This password can be set in the export settings of your connection. If no password is entered, the exported connection will be locked for all users and can never be edited. The intention of this password is to prevent unauthorized users from modifying a connection.

Please see this FAQ for further details: {FQ647}

One of our customers has kindly provided instructions on how to integrate Cisco EasyVPN and VPN Tracker with a DMVPN setup:

EasyVPN Server and DMVPN Hub on 1 Cisco router tutorial

Using VPN Tracker 5 with a Cisco Easy VPN Server

For a list of tested ZyXEL devices, please refer to this page VPN Tracker may also work with additional IPsec capable devices from ZyXEL, please contact support if you have any questions.

Such a setup is called “Host to Everywhere” in VPN Tracker. All non-local traffic will be sent through the VPN. For this setup to work, it must be properly configured in VPN Tracker and on the VPN gateway:

1. The Network Topology must be set to “Host to Everywhere” in VPN Tracker
2. The VPN gateway must accept an incoming VPN connection with a 0.0.0.0/0 (= everywhere) endpoint

Once these are configured, it should already be possible to establish the VPN connection. However, it is very likely that Internet access will not yet work. For Internet access to work, several more things need to be configured on the VPN gateway:

1. The VPN gateway must route VPN traffic not destined for its local networks out on the Internet
2. This traffic must be subject to Network Address Translation (NAT) in order for replies to reach the VPN gateway
3. In many cases, a suitable remote DNS setup is necessary for DNS resolution to continue to work

Note that not alll VPN gateways can be configured for Host to Everywhere connections. Most devices designed for small office or home networks (e.g. devices by NETGEAR or Linksys) are not capable of dealing with Host to Everywhere connections.

Symptom

When using Personal Safe, a data conflict may arise. E.g. if a connection is altered on machine A and also updated in the safe, and then the same connection is altered on machine B before it had a chance to update the connection from the safe, VPN Tracker has a problem: The connection now exists in two different versions, the version in the safe and the local one.

Solution

We decided that at all times, there can only be one “truth”, and as VPN Tracker is not able to tell who’s speaking the truth, it will show a conflict state and ask the user to please resolve it. Three options are available.

1. Do nothing; the conflict will persist until resolved.
2. The safe is right; the version from the safe is downloaded.
3. VPN Tracker is right; the version of VPN Tracker is written to the safe.

Reasoning

The reasoning behind that is in fact very simple. You can change option A of a connection without breaking it and that change may also be meaningful. You can also change option A of a connection without breaking it and that change may be meaningful, too. However, changing both of these option may not be meaningful at all, these options may now even contradict with each other and that can easily break the connection. That’s why we decided to never merge individual changes into a single one.

For detailed information and list of compatible WatchGuard devices, please refer to this page.
Guides for this router can be found in our Configuration Guides.
Here is a list of products that are compatible with VPN Tracker:
{S_406}

VPN Tracker is designed as a user license. One license can be used by only one person.

A company counts as a group of users. Each user of the VPN Tracker software needs their own personal VPN Tracker user account as well as their own user license. The information about the VPN Tracker account, may only be used by the owner of the account. A sharing of login and password (for example between members of an organization or others) is not permitted.

Managing multiple users in an organization via team management
Employees or users in an organization are managed using VPN Tracker Team Management. With this, an administrator can assign VPN Tracker user licenses to individual VPN Tracker user accounts and also withdraw them. Usage of the team management is mandatory for the use of VPN Tracker in organizations. It is designed to meet the security demands in organizations.

Team Management Guide →

Accounts with suspicious behavior
VPN systems are security systems which regulate confidential access on a personal level. The sharing of logins and passwords will inadvertently lead to an insecurity in the entire system, for example when an employee leaves the company. An ex-employee would still be able to gain full access to the VPN Tracker main account. Accounts which display suspicious behavior may be automatically blocked by our system. This is to safeguard the security of your account.

First, log in to VPN Tracker with your equinux account. If VPN Tracker still asks you to buy the software, then:

‣ Go to "VPN Tracker" > "Refresh My Account"

{S_523_30%}

Then, try to activate your VPN Tracker again.

Are you using virtualization software, such as VMware, Parallels or VirtualBox? These software products create network interfaces for their internal networking needs, and sometimes the network addresses they choose happen to conflict with the remote network of a VPN connection. Even if you are not currently using this software (but have it installed or not completely uninstalled) their network interfaces exist and can cause conflicts.

To find out which network interface is causing the conflict:

1. Attempt to connect to your VPN (so the error message appears in the VPN Tracker log)
2. Set the log level in VPN Tracker to “verbose”
3. Look for a line that says
   Remote network ... conflicts with local network ... of interface ...

This is the network interface that is causing the problem. On most Macs, “en0” will correspond to the Ethernet interface and “en1” to the AirPort interface. Any other enX interfaces are either from virtualization software, or from additional network hardware (e.g. USB network adapters/modems). Network interfaces whose names start with “vboxnet” generally belong to VirtualBox and network interfaces starting with “vmnet” to VMware.

• If the network interface is a "real" interface, see this FAQ for more information.
• If the interface is virtual, change the network address(es) used by the virtualization software. More information can be found in this FAQ.

There are a couple of restrictions in the demo version of VPN Tracker 365. Please keep in mind the following:

• A demo license is only valid for 30 days.
• A demo license allows you to use all the Pro Edition features except the export feature.
• A demo license restricts tunnel traffic up to 500 kb in either direction.
• Once the 500 kb limit has been reached, a demo license allows you to stay connected for another 3 minutes.