The WireGuard protocol itself does not support 2-Factor Authentication (2FA) for VPN connections. However, when using WireGuard connections with VPN Tracker, you can enhance your overall security by enabling 2FA for your VPN Tracker account.

This means your VPN configuration and access are protected with an additional layer of security, while your WireGuard connections remain end-to-end encrypted for maximum protection.

Using VPN Tracker is the best way to benefit from the performance and security of WireGuard, along with modern account-level protections like 2FA.

Absolutely. VPN Tracker is the macOS alternative to Windows-based VPN clients like Cisco AnyConnect, Shrew Soft VPN, FortiClient, GlobalProtect (Palo Alto Networks), SonicWall Mobile Connect, WatchGuard Mobile VPN, OpenVPN, Check Point Endpoint Security VPN, and F5 BIG-IP Edge Client, and others, with added features tailored for Apple devices.

Yes, absolutely! Our support team is happy to assist you. Click here to open the contact form.

No, macOS does not support establishing a VPN tunnel within an existing VPN connection (“tunnel-in-tunnel”). If you’re already connected to a VPN, the system typically prevents setting up a second VPN tunnel through that connection.

Background:
This is a limitation of macOS itself, not of VPN Tracker. It affects use cases such as:
• Trying to connect to a second VPN through an already active VPN tunnel.
• Attempting to route site-to-site connections through an existing user VPN session.

Disabling this behavior entirely is not possible. VPN Tracker waits a certain amount of time for a response from the authentication server. If there’s no response, the app cannot know whether the password was incorrect or if the server is simply slow to respond—so it asks for the password again, just in case.

Possible alleviation of the problem:
Increase the timeout value to give VPN Tracker more time to wait for a server response. You can adjust this under:
“Credential Prompt Timeout” (German: Anzeigedauer für Authentifizierungsdialoge).

This helps reduce unnecessary password prompts when connecting to slow or overloaded servers.

VPN Tracker offers detailed setup guides and import tools to help migrate VPN configurations from Windows clients to Mac quickly and securely.

No, that’s not possible. Due to how WireGuard works, each person needs their own personal connection. Sharing a connection between multiple users is not allowed and will lead to connection issues. Similarly, if an employee wants to use the VPN on more than one device (e.g. Mac and iPhone), they will need a separate connection for each device.

With my.vpntracker.com, you can manage all your connections centrally: For example, you can create 100 WireGuard connections in advance, upload them, and assign them to employees and their devices as needed (e.g. Mr. Miller/Mac and Mr. Miller/iPhone).

Stationery Pack was previously activated using the equinux ID shown in the activation dialogue. Additional Stationery Packs need to be activated using the same equinux ID.

To activate an additional Stationery Pack, please log in to the equinux ID shown using your password. If you forgot your password, please try click here

When prompted, enter the activation code you received in your order confirmation email.

If your software has already been activated using a different equinux ID, you must use this same ID to activate further stationery packs.

E.g. If you already own Stationery Pack and have recently bought Summer Spirit Cards using a different equinux ID, you won't be able to use both stationery packs at once.

If you want to use both at once, simply transfer your new stationery pack license from your new equinux ID to your old equinux ID (or vise-versa) using your equinux License Manager.

If you've forgotten your password, you can retrieve your login details here.

Alternatively, if you no longer own the previous stationery pack installed, please uninstall it. You can then install your new stationery pack with your new equinux ID.

If you're experiencing issues with your World Connect connection in VPN Tracker, here's what to do:

1. Contact Support

In VPN Tracker, go to the Help menu and select "Contact Support".
In the window that opens:

• Enter "World Connect Issue" in the subject line.
• Describe the problem you're having so our support team can help you quickly.

2. Try These Steps in the Meantime

• If you're using a country-specific connection (e.g. "United States"), try unchecking the "Fastest Destination" option.
• Once unchecked, you can manually choose from the available cities (e.g. New York, Los Angeles, Miami, etc.).
• Try connecting to a different city to see if the issue is specific to one location.

These steps often help resolve temporary connection issues.

There are a number of possible causes for such a behavior. This FAQ will help you to find out what is causing the problem in your specific situation. In this FAQ we will be using destination device as a generic term for the device you are trying to connect to. The destination device can be anything from a normal computer, to a server, to a network printer.

1. Are you trying to connect to the destination device using a host name?

If you are using a host name, please try once using its IP address instead. If that works, the problem has to do with DNS resolution. Please make sure DNS is enabled for the VPN connection and correctly configured. Note that using Bonjour or NETBIOS hostnames is generally not possible over VPN.

2. Is the IP address you are connecting to really part of the remote network?

For example, if your remote network is 192.168.13.0/24, you should be able to connect to IPs starting with 192.168.13.x, but connections to IPs starting with 192.168.14.x will not work as they are outside the address range of traffic tunneled through the VPN.

3. Is the local address in VPN Tracker part of the remote network?

Using a local address in VPN Tracker (Basic > Local Address) that is part of the remote network is not possible with most VPN gateways. Please use a local address that is outside all remote networks. For example, if your remote network is 192.168.13.0/24, do not use an address starting with 192.168.13. If you are using an automatic configuration method (e.g. Mode Config, EasyVPN, DHCP over VPN) you may be able to assign a local address to VPN Tracker that is part of the remote network. Refer to the configuration guide for your VPN gateway for more information.

4. Could multiple VPN users use the same local address?

If multiple VPN users exist, pleas make sure no two users are using the same local address (Basic > Local Address), otherwise one of them will not be able to use the tunnel anymore whenever both of them are connected. If that field is empty in your configuration, VPN Tracker will just use the IP address of your primary network interface as local address, and of course, this can also cause an address conflict with another user, that’s why we do not recommend to leave that field empty if there are multiple VPN users.

5. Can you ping the LAN address of the VPN gateway?

You can find a ping tool directly in VPN Tracker under Tools > Ping Host. The LAN address of the VPN gateway is special in the regard that this address doesn’t need to be routed at all. So if you can ping that address but no other remote address, it is most likely a routing issue at the remote end.

6. If you can't ping anything, try re-running the VPN Availability Test

The VPN Availability Test can be found in the menu: Tools > VPN Availability Test. Then try connecting the VPN again. The results of this test depend on the capabilities of your local Internet router/modem or the Internet connection itself and they influence how the VPN tunnel is established. VPN Tracker automatically runs the test for every new Internet connection it is able to detect but even if a connection has been tested before, there are various reasons why the behavior of that connection may have changed in the meantime.

7. Is your VPN gateway the default gateway (router) of its network?

If the VPN gateway is not the default gateway, you will in many cases need a suitable routing setup in order for responses to reach you. Whenever a device doesn’t know how to reach an IP address directly, it forwards its reply to its default gateway and if that isn’t the VPN gateway, it won’t know what to do with that reply data. In that case its important to configure the default gateway to forward replies to VPN users to the VPN gateway.

8. Is your VPN gateway the default gateway (router) of its network?

For more details, we would like to direct you to the following FAQ entry.

The Pre-Shared Key (sometimes called shared secret) is basically a form of password for your VPN gateway which is set up on your device.

Configuring the Pre-Shared Key for a new VPN connection

VPN Tracker provides setup guides for all major gateway manufacturers. In these setup guides, you will also find information on how to set up a secure Pre-Shared Key for your specific device.

You can access all guides on this page.

I have lost my Pre-Shared Key - how can I get it back?

Here are a few tips for you to try and restore your Pre-Shared Key:

1. Check if you have stored the affected connection in your Personal Safe. If so, you may be able to download the connection again.
2. Check the Keychain (Applications > Utilities > Keychain Access). The Pre-Shared Key is usually saved here. Enter "Shared Secret" into the search bar to view a list of all your saved PSKs.
3. Are you using Time Machine Backup? You could try restoring an older connection with the Pre-Shared-Key.
4. Check your firewall or ask the relevant VPN Administrator. Refer to your device handbook to find out where to obtain this information on your specific firewall.

VPN Tracker may prompt you for different passwords depending on the action you're performing. This guide explains what each prompt means and which password you should enter.

1. Your Mac Password

When is it needed?
– Installing VPN Tracker
– Approving system extensions

Why?
macOS requires your administrator password to authorize changes on your system.

Where do I find it?
This is your local Mac password – the one you use to log in when your Mac starts up.

2. Your equinux ID (VPN Tracker Account)

When is it needed?
– Logging into the VPN Tracker app (Mac or iOS)
– Accessing your account at my.vpntracker.com

Why?
This is your personal VPN Tracker account, giving you access to your plan, team, connections, and device settings.

Where do I find it?
This password is usually saved in your Keychain or Passwords app under “id.equinux.com”.

3. Pre-Shared Key (PSK) / Shared Secret

When is it needed?
– When setting up or connecting to a VPN connection

Why?
Some VPNs use a PSK to authenticate users. This key must match what’s configured on the VPN gateway.

Tip for Teams: Admins can share pre-configured VPN connections via TeamCloud to avoid PSK confusion.

Where do I find it?
This is usually set by your company’s VPN admin and stored in the connection. You typically don’t need to know it yourself.

4. Your Company Login (XAUTH Credentials)

When is it needed?
– When connecting to a company VPN

Why?
You may need to enter your company login (often the same credentials you use at work) to authenticate with the VPN.

Where do I find it?
You should have received it from your IT team — and hopefully not written it on a Post-it under your keyboard.

VPN Tracker automatically stores a backup of all your VPN connections on your Mac. If you have inadvertently deleted a connection, or wish to revert to an earlier copy of a connection, you can manually restore the backup copy.

Restore from your Backup

• Open Finder and choose "Go" > "Go to Folder…" from the menu bar
• Enter this path and press Return:
  /Library/Application Support/VPN Tracker 365
• Rename your "etc" folder to "etc-backup" – for safekeeping
• Go into the "backup" folder

Here you'll see a number of backup folders, all organized and named by date.

• Move the "etc-date" folder you want to restore up one level into the main "VPN Tracker 365" folder
• Rename the folder your just moved to just "etc" (deleting the date)
• Open VPN Tracker 365

All of your connections will now be restored to their backed-up state.

Download VPN Tracker free

Such a setup is called “Host to Everywhere” in VPN Tracker. All non-local traffic will be sent through the VPN. For this setup to work, it must be properly configured in VPN Tracker and on the VPN gateway:

1. The Network Topology must be set to “Host to Everywhere” in VPN Tracker
2. The VPN gateway must accept an incoming VPN connection with a 0.0.0.0/0 (= everywhere) endpoint

Once these are configured, it should already be possible to establish the VPN connection. However, it is very likely that Internet access will not yet work. For Internet access to work, several more things need to be configured on the VPN gateway:

1. The VPN gateway must route VPN traffic not destined for its local networks out on the Internet
2. This traffic must be subject to Network Address Translation (NAT) in order for replies to reach the VPN gateway
3. In many cases, a suitable remote DNS setup is necessary for DNS resolution to continue to work

Note that not alll VPN gateways can be configured for Host to Everywhere connections. Most devices designed for small office or home networks (e.g. devices by NETGEAR or Linksys) are not capable of dealing with Host to Everywhere connections.

Setting up VPN on your Mac

VPN Tracker is the leading VPN client for macOS and works seamlessly on all the latest macOS operating systems.
You can download and test VPN Tracker here free.

Launching VPN Tracker for Mac

The first time you launch VPN Tracker on your Mac, you may need to grant it permission to create VPN connections for you.

First please make sure VPN Tracker is in your Applications folder and complete these steps locally on the Mac (e.g. not over Screen Sharing, Remote Desktop or other remote access tool).

IMPORTANT: macOS notices when you run remote desktop systems like TeamViewer, Apple Remote Desktop, VNC or similar. and hides these buttons. You MUST be local to the Mac.

Then do this:

‣Open System Preferences

‣Go to Security

‣Click "Allow"

Now you'll be able to set up VPN Tracker.

Troubleshooting VPN Setup on macOS

If the "Allow" button can not be clicked, please make sure you are not using a 3rd party mouse or tablet input device, as these can look like remote desktop software to your Mac. If you are using e.g. a Wacom input tablet or mouse utility tool, try disabling those, reboot your Mac and then try clicking the button again.

In case the button doesn't even appear in the dialog, please note that if your Mac has a MDM profile installed, the MDM profile can forbid users to approve their own System Extensions. In that case the profile itself has to approve our extension. Please see technical notes below.

Technical note for Enterprise Rollouts:
VPN Tracker for Mac uses a System Extension to create a secure VPN tunnel and manage network traffic. macOS High Sierra and newer macOS versions now require users to manually approve all System Extensions. For Enterprise rollouts via MDM, you can also pre-approve the VPN Tracker Kernel Extension using a special profile. Our Team IDs are CPXNXN488S and MJMRT6WJ8S.
Please see Apple's Support Document for more details.

Not using an MDM managed Mac?
If your Mac is not MDM managed, please try rebooting, as macOS occasionally can get tripped up with System Extensions. After the reboot, VPN Tracker should work fine.

If you have already purchased one or more Stationery Packs via the equinux Store, please follow these steps to install your templates on your Mac:

‣ Download the Stationery Pack Application here.
‣ Please double click the .dmg file.
‣ Double-click the Stationery Pack you have purchased. If you bought more than one Stationery Pack, please double click one of your Stationery Packs.
‣ Follow the on screen steps to finish the installation.
‣ Afterwards choose in the app "Stationery Greeting Cards" > "Preferences" from the top menu bar and log in using your equinux ID and password.
‣ All of your licenses are now activated and you can use your templates.

There are two types of IP addresses:

• Private IP Addresses, and
• Public IP Addresses

Private IP addresses can be used by any person or organisation for their private network.

The two most commonly used private network ranges (range of IP Addresses) are:

• 192.168.0.x, and
• 192.168.1.x

When for example your home network and your company network both use the same Private IP Range, there will be problems because you will see multiple devices with the same IP Adress and your computer will get confused.

Your Company Network:
When setting up a company network, most companies try to avoid the above listed IP ranges, which is also recommended by us, in order to not cause conflicts with people connecting over VPN. However, there are still some companies that use one of these popular network ranges.

Your Home Network:
A lot of popular home routers like Netgear, Asus, Google, D-Link, TP-Link, Linksys, Trendnet, AVM all use an IP Range of 192.168.0.x.

If your company Network uses the same IP Range as your home network you are going to run into problems.


Here are two possible solutions:

1. Change your local network to a different range (Preferred)

   
   Possible Ranges are:
   
   • 10.250.250.x
   • 172.30.30.x
   • 192.168.250.x
   
   Advantage: Once you have made this change on your home network, you will never have conflicts in this network.
   Disadvantage: You will need to change the settings on your private network router once, this requires access and can take some time.
   What to do:
   
   • Login to your home router
   • Find the setup section with “DHCP” settings.
   • Change your router to a different IP adress (for example an address from one of the ranges listed above, for example 172.30.30.1)
   • Change the DHCP Server Settings to the same range of your router (If your router IP is 172.30.30.1, your range could be 172.30.30.10 to 172.30.30.253)
   
   After you have made these changes, there will be no more conflicts between your home and company network.

2. Force Traffic over VPN

   
   There may be situations where it's not possible to use the first option (for example if you're in a coffee shop or hotel) In this case you have the option to force the traffic over your VPN Network, this means your VPN Network (company network) will always win.
   Advantage: This setting is global, meaning no matter what network you are in you will always be able to connect.
   Disadvantage: Once you are connected to your company’s VPN, you can not access local service, like home router, local storages or printers.
   What to do:
   
   • Configure your VPN Tracker connection
   • Select the "Advanced" Tab at the top
   • In the "Traffic control" section, activate the Checkbox "Force traffic over the VPN if remote networks conflict with local networks"
   
   

Download VPN Tracker free

• If you haven't already, you can download VPN Tracker using this link.
• After the download has completed, launch the app and click the "Login" button in the top left-hand corner of the app home page.
• Enter your equinux ID and password in the space provided. Hint: This is the login you first created when purchasing VPN Tracker in our online store.

Are you a World Connect User?

You will need to download VPN tracker World Connect. You can do so using this link. VPN Tracker World Connect must be installed using the App Store. Once you've installed the app on your device, sign in with your equinux ID and password.

All equinux accounts support secure two-factor authentication (2FA) as an additional layer of security for your sensitive data.

To set up 2FA for your account, log in to id.equinux.com and go to the tab Multifactor Authentication. Here you will find the QR code / authentication key needed to set up 2FA for your equinux account with your OTP solution.




equinux 2FA supports all major authentication and password apps, including:

• Google Authenticator
• Microsoft Authenticator
• Twilio Authy
• 1Password
• FreeOTP
• Bitwarden