The WireGuard protocol itself does not support 2-Factor Authentication (2FA) for VPN connections. However, when using WireGuard connections with VPN Tracker, you can enhance your overall security by enabling 2FA for your VPN Tracker account.

This means your VPN configuration and access are protected with an additional layer of security, while your WireGuard connections remain end-to-end encrypted for maximum protection.

Using VPN Tracker is the best way to benefit from the performance and security of WireGuard, along with modern account-level protections like 2FA.

VPN Tracker is a professional VPN client for macOS and iOS, designed for businesses. It provides secure and reliable remote access to internal company networks from any Mac, iPhone and iPad.

Absolutely. VPN Tracker is the macOS alternative to Windows-based VPN clients like Cisco AnyConnect, Shrew Soft VPN, FortiClient, GlobalProtect (Palo Alto Networks), SonicWall Mobile Connect, WatchGuard Mobile VPN, OpenVPN, Check Point Endpoint Security VPN, and F5 BIG-IP Edge Client, and others, with added features tailored for Apple devices.

As businesses transition away from Windows 10, many are adopting macOS. VPN Tracker ensures these organizations can maintain secure, enterprise-grade VPN access for remote work, IT administration, and field staff.

Yes, VPN Tracker is fully optimized for Apple Silicon Macs, including M1 and M2 chips, offering high performance and long battery life.

No, macOS does not support establishing a VPN tunnel within an existing VPN connection (“tunnel-in-tunnel”). If you’re already connected to a VPN, the system typically prevents setting up a second VPN tunnel through that connection. Background: This is a limitation of macOS itself, not of VPN Tracker. It affects use cases such as: • Trying to connect to a second VPN through an already active VPN tunnel. • Attempting to route site-to-site connections through an existing user VPN session.

Usually not. VPN Tracker works with your existing VPN infrastructure. It supports configurations for SonicWall, Fortinet, Cisco, Sophos, and many others out of the box.

Yes, absolutely! Our support team is happy to assist you. Click here to open the contact form.

Disabling this behavior entirely is not possible. VPN Tracker waits a certain amount of time for a response from the authentication server. If there’s no response, the app cannot know whether the password was incorrect or if the server is simply slow to respond—so it asks for the password again, just in case. Possible alleviation of the problem: Increase the timeout value to give VPN Tracker more time to wait for a server response. You can adjust this under: “Credential Prompt Timeout” (German: Anzeigedauer für Authentifizierungsdialoge). This helps reduce unnecessary password prompts when connecting to slow or overloaded servers.

Yes, VPN Tracker offers team management features including configuration deployment, license control, and access auditing for IT admins.

Yes. VPN Tracker is built for modern IT environments with support for certificate-based authentication, MFA, and integration with enterprise-grade security policies.

Yes, VPN Tracker supports a wide range of protocols including IPsec, L2TP, Cisco EasyVPN, OpenVPN, IKEv2, and SSL VPNs — fully compatible with most enterprise-grade firewalls and routers.

VPN Tracker offers detailed setup guides and import tools to help migrate VPN configurations from Windows clients to Mac quickly and securely.

There are a number of possible causes for such a behavior. This FAQ will help you to find out what is causing the problem in your specific situation. In this FAQ we will be using destination device as a generic term for the device you are trying to connect to. The destination device can be anything from a normal computer, to a server, to a network printer.

1. Are you trying to connect to the destination device using a host name?

If you are using a host name, please try once using its IP address instead. If that works, the problem has to do with DNS resolution. Please make sure DNS is enabled for the VPN connection and correctly configured. Note that using Bonjour or NETBIOS hostnames is generally not possible over VPN.

2. Is the IP address you are connecting to really part of the remote network?

For example, if your remote network is 192.168.13.0/24, you should be able to connect to IPs starting with 192.168.13.x, but connections to IPs starting with 192.168.14.x will not work as they are outside the address range of traffic tunneled through the VPN.

3. Is the local address in VPN Tracker part of the remote network?

Using a local address in VPN Tracker (Basic > Local Address) that is part of the remote network is not possible with most VPN gateways. Please use a local address that is outside all remote networks. For example, if your remote network is 192.168.13.0/24, do not use an address starting with 192.168.13. If you are using an automatic configuration method (e.g. Mode Config, EasyVPN, DHCP over VPN) you may be able to assign a local address to VPN Tracker that is part of the remote network. Refer to the configuration guide for your VPN gateway for more information.

4. Could multiple VPN users use the same local address?

If multiple VPN users exist, pleas make sure no two users are using the same local address (Basic > Local Address), otherwise one of them will not be able to use the tunnel anymore whenever both of them are connected. If that field is empty in your configuration, VPN Tracker will just use the IP address of your primary network interface as local address, and of course, this can also cause an address conflict with another user, that’s why we do not recommend to leave that field empty if there are multiple VPN users.

5. Can you ping the LAN address of the VPN gateway?

You can find a ping tool directly in VPN Tracker under Tools > Ping Host. The LAN address of the VPN gateway is special in the regard that this address doesn’t need to be routed at all. So if you can ping that address but no other remote address, it is most likely a routing issue at the remote end.

6. If you can't ping anything, try re-running the VPN Availability Test

The VPN Availability Test can be found in the menu: Tools > VPN Availability Test. Then try connecting the VPN again. The results of this test depend on the capabilities of your local Internet router/modem or the Internet connection itself and they influence how the VPN tunnel is established. VPN Tracker automatically runs the test for every new Internet connection it is able to detect but even if a connection has been tested before, there are various reasons why the behavior of that connection may have changed in the meantime.

7. Is your VPN gateway the default gateway (router) of its network?

If the VPN gateway is not the default gateway, you will in many cases need a suitable routing setup in order for responses to reach you. Whenever a device doesn’t know how to reach an IP address directly, it forwards its reply to its default gateway and if that isn’t the VPN gateway, it won’t know what to do with that reply data. In that case its important to configure the default gateway to forward replies to VPN users to the VPN gateway.

8. Is your VPN gateway the default gateway (router) of its network?

For more details, we would like to direct you to the following FAQ entry.

If you're experiencing issues with your World Connect connection in VPN Tracker, here's what to do:

1. Contact Support

In VPN Tracker, go to the Help menu and select "Contact Support".
In the window that opens:

• Enter "World Connect Issue" in the subject line.
• Describe the problem you're having so our support team can help you quickly.

2. Try These Steps in the Meantime

• If you're using a country-specific connection (e.g. "United States"), try unchecking the "Fastest Destination" option.
• Once unchecked, you can manually choose from the available cities (e.g. New York, Los Angeles, Miami, etc.).
• Try connecting to a different city to see if the issue is specific to one location.

These steps often help resolve temporary connection issues.

If you’re setting up a VPN connection, you’ll often come across the term “pre shared key” or “VPN shared secret.” This guide explains what it means, how to set it up, and what to do if you lose it — so you can get your VPN running smoothly on your Mac.

What is a pre shared key VPN, or what is a pre-shared key for VPN?

A VPN pre shared key (also called VPN shared secret, VPN PSK, shared key, or preshared key) is like a password that secures your VPN connection. This IPsec pre shared key is configured on your VPN gateway — such as a firewall or router — and must match on your device to establish a secure VPN tunnel.

Without the correct key, your device cannot connect, ensuring that your VPN connection stays protected from unauthorized access.

Note: Some VPN gateways require the shared secret key to contain up to 512 alphanumeric characters. Check your device’s manual or use a pre shared key generator tool if needed.

How to Set Up a Pre Shared Key

VPN Tracker makes setting up your VPN simple and secure. It provides step-by-step setup guides for all major VPN gateway manufacturers, showing you exactly how to:

• Create and configure a pre shared key or shared secret key on your firewall or router
• Enter the VPN PSK on your Mac in VPN Tracker
• Check that your VPN connection is working securely

Browse VPN setup guides here

To get started, download VPN Tracker here: Download VPN Tracker

How to Recover a Lost Pre Shared Key

If you’ve lost your pre shared key or VPN shared secret, here’s how you can recover it:

• Check VPN Tracker Personal Safe: If you saved the connection in your Personal Safe, you can redownload it with the key.
• Search Your Mac Keychain: Go to Applications > Utilities > Keychain Access, search for “Shared Secret,” and find your saved VPN PSKs.
• Restore from Backup: If you use Time Machine Backup, you can try restoring an older connection version that contains the pre shared key.
• Check Your Firewall or Contact Your VPN Administrator: Refer to your device manual or ask your network administrator to retrieve the shared key from your VPN gateway or firewall.

Need help with your VPN setup?

Visit VPN Tracker — the #1 VPN client for Mac for expert tools and guides to get your VPN running smoothly.

VPN Tracker may prompt you for different passwords depending on the action you're performing. This guide explains what each prompt means and which password you should enter.

1. Your Mac Password

When is it needed?
– Installing VPN Tracker
– Approving system extensions

Why?
macOS requires your administrator password to authorize changes on your system.

Where do I find it?
This is your local Mac password – the one you use to log in when your Mac starts up.

2. Your equinux ID (VPN Tracker Account)

When is it needed?
– Logging into the VPN Tracker app (Mac or iOS)
– Accessing your account at my.vpntracker.com

Why?
This is your personal VPN Tracker account, giving you access to your plan, team, connections, and device settings.

Where do I find it?
This password is usually saved in your Keychain or Passwords app under “id.equinux.com”.

3. Pre-Shared Key (PSK) / Shared Secret

When is it needed?
– When setting up or connecting to a VPN connection

Why?
Some VPNs use a PSK to authenticate users. This key must match what’s configured on the VPN gateway.

Tip for Teams: Admins can share pre-configured VPN connections via TeamCloud to avoid PSK confusion.

Where do I find it?
This is usually set by your company’s VPN admin and stored in the connection. You typically don’t need to know it yourself.

4. Your Company Login (XAUTH Credentials)

When is it needed?
– When connecting to a company VPN

Why?
You may need to enter your company login (often the same credentials you use at work) to authenticate with the VPN.

Where do I find it?
You should have received it from your IT team — and hopefully not written it on a Post-it under your keyboard.

The Unifi Dream Machine (UDM) configures OpenVPN by default with the topology "Host to all networks". This means that the entire network traffic, including your internet traffic, is redirected to the VPN tunnel. This can happen that you no longer have access to devices or services in your local network-because all data traffic runs via the VPN connection to the UDM. Solution: If you only want to access the distant network (e.g. in the office) and at the same time want to continue using your local network, simply change the topology setting: Select the affected connection in VPN Tracker Click on "Edit". Change the topology from "Host to all networks" to "Host to Network". Save the connection. The next time you establish a connection, your remote networks will be automatically accessible.

If you’ve signed up for a free or discounted VPN Tracker trial and don’t wish to continue with a paid subscription, you can cancel it easily from your account.

How to cancel your VPN Tracker trial:

1. Log in to your account at my.vpntracker.com.
2. Go to “My Plans and Billing” in the sidebar.
3. Locate your active trial plan.
4. Click “Cancel Trial”.

Important information about trial cancellations:

• If you signed up for a free or discounted trial and don’t want to be charged, make sure to cancel at least 24 hours before your trial ends.
• Canceling your trial will end your access to the trial immediately.

Once canceled, the plan will no longer renew, and your payment method will not be charged.

Having trouble with your connection setup?

We're happy to help you get your connection up and running. Just contact our Support Team

Such a setup is called “Host to Everywhere” in VPN Tracker. All non-local traffic will be sent through the VPN. For this setup to work, it must be properly configured in VPN Tracker and on the VPN gateway:

1. The Network Topology must be set to “Host to Everywhere” in VPN Tracker
2. The VPN gateway must accept an incoming VPN connection with a 0.0.0.0/0 (= everywhere) endpoint

Once these are configured, it should already be possible to establish the VPN connection. However, it is very likely that Internet access will not yet work. For Internet access to work, several more things need to be configured on the VPN gateway:

1. The VPN gateway must route VPN traffic not destined for its local networks out on the Internet
2. This traffic must be subject to Network Address Translation (NAT) in order for replies to reach the VPN gateway
3. In many cases, a suitable remote DNS setup is necessary for DNS resolution to continue to work

Note that not alll VPN gateways can be configured for Host to Everywhere connections. Most devices designed for small office or home networks (e.g. devices by NETGEAR or Linksys) are not capable of dealing with Host to Everywhere connections.