VPN server on macOS High Sierra & macOS Mojave

Question

According to this blog post by MacMiniVault.com, Apple is no longer including a Virtual Private Network (VPN) server. macOS Server Mojave has been gutted of nearly all the previous “Server” functionality, leaving only 3 things: Profile Manager, Open Directory, and Xsan.

Can someone suggest a secure reliable VPN server that currently runs on macOS Sierra that is likely to also run on macOS Mojave?

My goal is to allow my MacBook Pro, iPhone, iPad, and such make VPN connections directly from the Apple-provided built-in VPN client feature.

I do not want to install any VPN client app. Avoiding 3rd-party VPN layers/apps precludes use of any commercial VPN-as-a-Service provider. Every VPN service provider I have seen insists on using only their own proprietary client installer rather than using Apple’s built-in VPN client. Hence my desire to run a VPN server on a remote Mac mini attached to a fast Internet connection such as at a colo.

I would rather avoid having to install HomeBrew or any other extra Unix-app layering (which I've never really understood, and fear mucking up my macOS).

This Support bulletin from Apple, Prepare for changes to macOS Server, lists three alternatives for the VPN server feature being dropped from macOS Server edition:

• OpenVPN
• SoftEther VPN
• Tcpcrypt

I don’t know how to judge these, except that my understanding is that OpenVPN fails to meet my main criterion: Macs and iOS devices be able to connect using Apple’s built-in VPN client, with no need to install anything.

Answer 1

At my company we had VPN access through macOS Server, and we could follow the steps below to get it operational on Mojave. (NOTE: This response is copy-pasted from another thread I created).

These instructions are largely the same as the ones in the official PDF-file that goes through the migration progress, but with the (hopefully) helpful addition that the the incorrect command is corrected and the other commands are copy:able as-is.

1. Turn off the VPN service in the Server app. (If visible. For me it was not.)

2. Make sure you are in the wheel group. I followed these steps (link )

3. Open Terminal (where the rest of the instructions will be executed) and go to the appropriate directory with:

   cd /Library/LaunchDaemon

4. Create an empty file called vpn.ppp.l2tp.plist in current directory with:

   sudo touch vpn.ppp.l2tp.plist

5. Set the right owner for the file with

   sudo chown root:wheel ./vpn.ppp.l2tp.plist

6. Open the file with nano (to avoid problems with saving that can occur if you use TextEdit or similar):

   sudo nano vpn.ppp.l2tp.plist

7. Copy paste the content below into nano:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
   “http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
     <dict>
       <key>Disabled</key>
       <true/>
       <key>EnableTransactions</key>
       <true/>
       <key>Label</key>
       <string>vpn.ppp.l2tp</string>
       <key>KeepAlive</key>
       <true/>
       <key>Program</key>
       <string>/usr/sbin/vpnd</string>
       <key>ProgramArguments</key>
       <array>
         <string>vpnd</string>
         <string>-x</string>
         <string>-i</string>
         <string>com.apple.ppp.l2tp</string>
       </array>
       <key>EnableTransactions</key>
       <false/>
       <key>EnablePressuredExit</key>
       <false/>
     </dict>
   </plist>
   

8. Save with changes by pressing Control + o, confirm file name with Enter and close nano with Control + q.

9. Load your new file by running:

   sudo launchctl load -w ./vpn.ppp.l2tp.plist

10. Verify with:

    launchctl print system/vpn.ppp.l2tp

These steps worked for me. Hopefully they can help for someone else that, like me, struggled to get the VPN feature up and running again after macOS Mojave update.

The official PDF guide (mentioned above) has some additional information about "Ongoing management":

Settings can be changed after vpnd is configured by editing the /Library/Preferences/SystemConfiguration/ com.apple.RemoteAccessServers.plist file. Refer to the vpnd (5) man page for details on the configuration format. After changes are made, you can have the service reread the configuration file by executing the command sudo killall -HUP vpnd.

Answer 2

OpenVPN is it's own VPN protocol and thus requires a specific client software. For MacOS clients that's Tunnelblick.

A related issue with all of the above mentioned options is integration of user authentication. I believe they all require a separate RADIUS server software for authentication (e.g. FreeRADIUS) against Open Directory.

Configuration of SoftEther seems to require a Windows-based SoftEther VPN Server Manager

Answer 3

I've successfully installed strongSwan via Homebrew and got it working to provide an IKEv2 VPN server connectable by other Macs using their native VPN client.

Unfortunately the setup isn't particularly trivial as it does require a bit of command line knowledge, but it wasn't too bad: I based the setup on the instructions for setting up strongSwan in Ubuntu provided by DigitalOcean, except that I:

• Used brew install strongswan instead in step 1.
• Made sure to use /usr/local/etc/ instead of /etc/ in step 4 & 5.
• Made sure to provide valid values for leftsubnet and rightsourceip in the IPSec configuration.
• Skipped step 6, though you may need to configure your router to port forward.

I had no trouble connecting to the VPN using another Mac, but struggled to connect using iOS I think because of certificate problems. If I didn't have to use a self-signed certificate (by using a real certificate authority) I think it would have worked.

The VPN doesn't seem to start with macOS so I also had to provide a launch daemon to run ipsec start, which took a while to figure out as I also had to add /usr/local/bin to $PATH as part of the command.

I understand the OP doesn't want to use Terminal, so I provide this answer as it would have helped me when I was looking for a VPN server which ran on macOS and provided VPN types native to macOS. Otherwise, there seems to be almost no resources available on the web which described how to do it without resorting to using deprecated tech in macOS Server.

Answer 4

MacOS Server removed the configuration GUI for the VPN server, but the underlying VPN server is still there. There's a product called iVPN that restores the GUI. I'm using iVPN version 7.4.3 on Mojave and it works fine. You can also manually configure and control the underlying VPN server (using Terminal and a text editor), but I find the convenience of iVPN's GUI, along with its monitor that shows the status of the server and clients, to be worth the nominal charge.

iVPN website is https://macserve.org.uk.