The Future of Tun and Tap VPNs on macOS

tunnelblick.net

4 pointsfh9732 comments

We (ZeroTier) figured out a workaround that still works as of Big Sur.

https://www.zerotier.com/2019/08/21/how-zerotier-eliminated-...

Figuring that out required reading Darwin source code. It was not easy. We are investigating a DriverKit approach for the long term in the hope of eventually getting rid of this weird hack.

If you don't need L2 "tap," then there's utun which is wrapped by the VPN network extension API. That is more standard, but also more limited. Not only is it L3 only but more importantly it's hard-blacklisted for Bonjour/mDNS and has other issues doing multicast.

Apple proposes that programs such as Tunnelblick be modified to use a different method to accomplish the function that the system extensions currently perform. The current Tunnelblick developers do not have the time or expertise to use the new method Apple proposes and have no plans to do so. It is possible that someone else will develop such an alternative method and make it publicly available, but there is no way to know if or when that will happen.

This is what undermaintained open source looks like.

Reply on news.ycombinator.com