Omnitun 0.4.4 (1c9f839)

New

• VPNs come back after an update. The VPNs that were connected before an update are reconnected afterwards, in the same mode: directly or through their chain, in split mode or not. A profile that asks for a code or a browser login asks again. To turn it off, uncheck Settings › General › "Reconnect VPNs after an update". The app keeps only which VPNs were up and how, never a secret (#49). This works from the next update on: the version you are updating from does not record anything yet.

Fixed

• Chains with routes by domain: a VPN that routes names by domain no longer takes addresses inside the networks of a VPN chained through it.
• An address the system has cached: an address held back while another VPN routed it now gets its route once that VPN disconnects, even though the system does not ask the name again.
• Reconnecting a chained VPN alone: disconnecting a chained VPN no longer removes the other VPN's route to its gateway, when that route is in the other VPN's routes. Before, the chained VPN could not reconnect until both were reconnected (#51).

Signed with a Developer ID and notarized by Apple. macOS 14 or later.

Omnitun 0.4.3 (b2bf8f1)

New

• Import from OpenVPN Connect: its profiles, under the names it shows, in Manage VPNs › Import › From OpenVPN Connect…, in the welcome window and with omnitunctl import openvpn-connect. Its passwords are not read. Thanks @n-rodriguez (#29).
• Imports flag a profile whose server is already added under another name ("Same server as …, already added"), and no longer preselect it.

Signed with a Developer ID and notarized by Apple. macOS 14 or later.

Omnitun 0.4.2 (3b3477f)

New

• Network tab: three modes, As the gateway decides, Everything through the VPN and Only these networks, with one list of the VPN's networks, kept when the mode changes. A split tunnel either replaces the gateway's networks or adds to them; a full tunnel can also be offered in split mode.
• In As the gateway decides, the tab shows what the gateway announced at the last connection (networks, all traffic, DNS domains).
• Networks added to the gateway's (extra_routes) work with every protocol, not only OpenVPN. Existing profiles are unchanged.
• The README maps each mode to its keys in profiles.toml.

Signed with a Developer ID and notarized by Apple. macOS 14 or later.

Omnitun 0.4.1 (2ea82a9)

Fixed

• Routes by domain (macOS): a domain included with the VPN's own DNS domain under it (*.corp.example when the VPN pushes corp.example) is now routed; its names were resolved by the VPN's DNS without the routes.

New

• omnitunctl status lists the addresses routed by domain, the name each was resolved for and how long it stays.

Signed with a Developer ID and notarized by Apple. macOS 14 or later.

Omnitun 0.4.0 (2d617f0)

New

• Routes by domain (dynamic split tunneling): a list of networks may also hold domains, *.corp-saas.com for every name under it. Their addresses go through the VPN as soon as they are resolved, even when they change. A VPN that takes all traffic can keep domains outside it ("Outside the VPN", excluded_domains): video calls, say.
  • Only a VPN with such domains runs the small DNS proxy that does it, unprivileged and sandboxed. It relays to the DNS servers already in place, so DNS filtering (an antivirus) keeps working, and if it fails, the DNS goes back to how it was.
  • omnitunctl status counts the addresses routed by domain. See README, "Routes by domain", for the limits (browsers' own encrypted DNS, IPv4 only).
• Notes on networks and domains: every network and domain list of the editor is now a table, with a note per entry to remember what it is for, and Paste Lines to add several at once. Notes show in the split mode menu, in a received profile and in omnitunctl import file.

Notes

• Profiles with notes or domains cannot be read by an older version: update the app and omnitunctl together (the package does).

Signed with a Developer ID and notarized by Apple. macOS 14 or later.

Omnitun 0.3.9 (501bfe7)

Fixed

• omnitunctl connect keeps signing with a client certificate (OpenVPN, Fortinet SSL VPN) while it runs: renegotiations and reconnections no longer drop the VPN when the app is not running. It says so, and Ctrl-C stops it.
• Stopping a connection while it asks a question (password, code, client certificate signature) stops it at once.
• A company VPN that runs alone now offers to disconnect the VPN in its way and try again.
• Changing the type of a VPN in the app keeps it in its folder, with its settings.
• Received profiles: omnitunctl import file shows what the profile makes you trust for every protocol: certificate authorities, pinned certificates, the OpenVPN server name and shared key.
• The command line hides one-time codes as they are typed; export -o keeps an existing file private; watch follows --config.
• Passwords, codes and keys are erased from memory once used, in every VPN engine.
• Faster data paths: fewer copies and allocations per packet for IPsec, OpenVPN, WireGuard and Fortinet SSL VPN.
• IKEv1, Fortinet SSL VPN and OpenVPN: small protocol fixes (a failed Quick Mode, an oversized reject, DNS servers pushed twice).

Notes

• README: a development section, and the limit of the browser (SAML) login.

Signed with a Developer ID and notarized by Apple. macOS 14 or later.

Omnitun 0.3.8 (fbae5f6)

Fixed

• The window that offers to install an update stays in front once the administrator password is given, instead of going behind the other apps' windows.
• Release notes are formatted in the update window (headings, lists, code), instead of running together in one paragraph.

Signed with a Developer ID and notarized by Apple. macOS 14 or later.

Omnitun 0.3.7 (b36bd36)

New

• Shell completions for omnitunctl (bash and zsh), with the names of your VPNs: omnitunctl connect <TAB>. The package installs them; zsh needs compinit in .zshrc, bash needs bash-completion 2 (Homebrew). From source or on Linux, omnitunctl completions bash|zsh prints them. Thanks to Nicolas Rodriguez.

Fixed

• The app and omnitunctl no longer overwrite each other's changes to the profiles file when both change it at the same time.
• Settings written by a newer version are kept when an older one saves a profile.
• A profiles file that is a symbolic link (dotfiles) stays a link when saved.
• Requests made while connecting (client certificate signatures, certificates to trust) can no longer be cut in the middle.
• Imports: an OpenVPN static key after a comment that names its end is read correctly; a Cisco IPSec group name from System Settings becomes the right local identity; out-of-range ports and unknown IKE versions fall back to the defaults with a note; invisible names are replaced.
• Export: a Fortinet SSL VPN profile whose CA is a file now carries the CA itself.
• Typos are refused before connecting: a certificate fingerprint that is not a SHA-256, an IKE version other than 1 or 2. Pinning a certificate already pinned under another spelling no longer adds it twice.
• Diagnostic report: file paths, realms and certificate names are left out, and making the report never changes the profiles file.
• Installer: an installation that cannot create the engines' account or start the service now says it failed, instead of reporting success.
• Linux: the systemd unit is locked down further (system calls, address families, kernel protections, fewer capabilities), and the README's steps to install from source now create the account the engines run as.

Notes

• An OpenVPN profile keeps its client key and its tls-auth or tls-crypt key in profiles.toml (readable by you only), as in the .ovpn file it came from: do not sync or share that file.
• Building from source needs Rust 1.95 or later.

Signed with a Developer ID and notarized by Apple. macOS 14 or later.

Omnitun 0.3.6 (907e593)

New

• omnitunctl app start and omnitunctl app restart open or relaunch the menu bar app from a terminal, for instance when it is stuck or gone from the menu bar. The VPNs stay connected during a restart.

Fixed

• OpenVPN: falling back to the next server works. A profile with several servers could not connect through any but the first one.
• A DNS answer that changes during a long login (one-time code, browser login) no longer makes the connection fail, with gateways behind DNS load balancing or a dynamic DNS name.
• Disconnecting and reconnecting a VPN at once no longer leaves a tunnel running that is missing from the list and cannot be disconnected.
• Two VPNs to the same gateway: the route to the gateway is no longer lost when one of them fails to connect or disconnects while the other connects.
• FortiGate: a connection stopped or failing after the login now logs out, instead of leaving the session open on the gateway.
• The app's list of VPNs no longer stays out of date after a burst of changes.
• A missing VPN engine (during an update) is now reported as such.
• One user can no longer use up every connection to the VPN service and lock other users out.

Signed with a Developer ID and notarized by Apple. macOS 14 or later.

Omnitun 0.3.5 (2aa1e91)

Fixed

• FortiGate connections no longer stay "connecting" forever. A gateway that accepts the connection and then goes silent now ends the attempt with a timeout (10 s to connect, 120 s for TLS and for each portal answer, enough to approve a push or a Keychain signature).
• A one-time code is never sent twice to a FortiGate. A login form is sent again only when the gateway closed the connection without answering.
• WireGuard tunnels survive a server restart. Network errors (ICMP unreachable) no longer tear the tunnel down: WireGuard recovers by itself, as with wg-quick.
• IPsec tunnels ride out Wi-Fi roaming and full interface queues instead of dropping, and accept gateway messages with long certificate chains (up to 64 KiB).
• IKEv2: a gateway refusing a key renewal is no longer flooded with new attempts; the client retries a minute later, and the connection ends cleanly when the keys expire.
• IKEv1: the gateway deleting its previous session after a re-authentication no longer disconnects you.
• L2TP: a malformed packet no longer disconnects you, and retransmissions during setup happen even when the server is chatty.
• OpenVPN: a connection could stop carrying traffic after a key renewal following an earlier one with key 7; a server ending a TLS session could freeze the connection; a forged first packet could make the connection attempt fail.

Signed with a Developer ID and notarized by Apple. macOS 14 or later.