Set up Sophos SSL VPN with Sophos Connect on macOS

SSL VPN on macOS was previously often set up with Tunnelblick or other OpenVPN clients. That remains possible, but it is no longer the only obvious option: since Sophos Connect 2.0, Sophos has also supported Remote Access SSL VPN on macOS.

This article describes the current standard approach using Sophos Connect on macOS and explains where OpenVPN-compatible clients fit as an alternative. To decide between Sophos Connect, SSL VPN, IPsec, mobile clients and ZTNA, start with Sophos Connect or SSL VPN: Which remote access solution is right?.

Decision and requirements

Which macOS VPN article is relevant?

These instructions apply to Sophos Firewall with SFOS and SSL VPN on macOS. Depending on the task, a different starting point may be more appropriate:

• Install Sophos Connect on macOS generally: Install Sophos Connect Client on macOS.
• Configure SSL VPN on the firewall: Set up Sophos Firewall SSL VPN Remote Access.
• Set up SSL VPN on macOS with Sophos Connect: This article.
• Set up SSL VPN on Windows: Set up Sophos SSL VPN with Sophos Connect on Windows.
• Set up SSL VPN on iPhone, iPad or Android: iPhone/iPad or Android.
• Maintain Sophos Connect client versions and profiles: Check and safely update the Sophos Connect Client version.
• The VPN is connected, but traffic is not working: Test firewall rules with Log Viewer, Policy Test and Packet Capture.

Sophos Connect does not directly support mobile platforms such as iOS and Android for IPsec and SSL VPN. OpenVPN-compatible clients or operating system features remain relevant on those platforms.

Requirements

• Sophos Firewall with a configured SSL VPN remote access setup
• User authorised for SSL VPN
• Access to the VPN Portal or an administratively provided .ovpn file
• Sophos Connect for macOS 2.0 or later
• Sophos Connect 2.0: macOS Ventura 13+; from 2.1: macOS Sonoma 14+
• Intel Mac or Apple Silicon: with 2.0 through Rosetta 2, from 2.1 with native ARM
• no other VPN client installed in parallel; Sophos explicitly rules out parallel operation
• MFA/OTP configured if remote access is protected by it
• firewall rules for traffic from the VPN zone

If the firewall-side SSL VPN configuration is not yet in place, set up Sophos Firewall SSL VPN Remote Access first.

Before an SFOS 22 MR1 upgrade, also check whether any legacy remote access IPsec configurations remain. SSL VPN is not directly affected, but many organisations reassess remote access at this point. The process is described in Migrate legacy remote access IPsec before SFOS 22 MR1.

Version status on 7 September 2026: Our Sophos Connect version and update guide lists 2.0 MR1 for macOS and 2.5 MR1 for Windows. The higher Windows version number is not a macOS update. Sophos confirms SSL VPN on Intel Macs and Apple Silicon through Rosetta 2 from Sophos Connect 2.0 and macOS Ventura 13. The SFOS 22 VPN Portal documentation reviewed at the time lists macOS 13.0 and later as supported.

Update on 9 October 2026: Sophos Connect 2.1 for macOS is documented in the release notes dated 6 October 2026: macOS 14+, Intel and native ARM support on Apple Silicon, .pro provisioning and Microsoft Entra ID SSO. The September snapshot describes 2.0/Rosetta, not the new 2.1 features. The canonical version matrix and update planning separates these branches. Package availability in your own portal and device approval must be checked separately; this article reports no device test and infers no GA approval.

Sophos Connect or an OpenVPN-compatible client?

For new macOS rollouts, evaluate Sophos Connect first because it is the Sophos client and has supported SSL VPN on macOS since version 2.0. OpenVPN Connect or Tunnelblick remain alternatives, but they should not inadvertently become a second, unplanned standard.

• Sophos Connect: Suitable for managed Macs, a consistent support process and current SFOS environments. Important factors are the version, macOS requirements, Rosetta 2 on Apple Silicon with 2.0, native ARM support from 2.1, and a current .ovpn profile or approved provisioning.
• OpenVPN Connect, Tunnelblick or another OpenVPN client: Suitable for an established OpenVPN process, special cases or a deliberate alternative to Sophos Connect. Important factors are the OpenVPN version, the correct download format, profile maintenance, DNS behaviour and clearly documented support ownership.

The client name matters less than the operating model: it should be clear which client is supported, which version is deployed, where the profile comes from and when users must import a new profile.

Set up Sophos Connect on macOS

1. Deploy Sophos Connect for macOS

For SFOS, obtain the macOS package provided on the firewall through a pattern update from the VPN Portal or distribute it centrally in a controlled manner. Check the version actually available: 2.0 MR1 requires Rosetta 2 on Apple Silicon and macOS 13+; from 2.1, macOS 14+ and native ARM support apply. A Windows package is not a macOS update. Test every production combination in a pilot before a broad rollout.

SSL VPN on macOS requires Sophos Connect 2.0 or later. Do not continue using older internal instructions or installation packages without checking them. An existing old Sophos SSL VPN Client must be removed before installation because it cannot run in parallel with Sophos Connect.

Sophos Connect 2.0 MR1 includes several macOS-specific fixes, including DNS settings for SSL VPN connections (NCL-2961) and the option to save credentials (NCL-2956). After an upgrade, reimport the profile if this option is required.

Installation is short: open the installer, choose a destination with enough free space, click Install, then Finish. The current Sophos installation guide does not prescribe a blanket additional approval under macOS Privacy & Security. Approve only prompts actually shown by the signed installer or macOS; do not add invented system-extension steps to the rollout.

2. Obtain the OVPN configuration

The SSL VPN configuration is provided as an .ovpn file. Depending on the operating model, users download it from the VPN Portal or receive it through a controlled administrative process.

For Sophos Connect on macOS, follow these steps in the VPN Portal:

1. Open the Sophos Firewall VPN Portal. The default address is https://<Firewall-FQDN>:443 unless the port has been changed.
2. Sign in as the VPN user.
3. Go to VPN.
4. Under Sophos Connect client, select Download for macOS if the client has not already been centrally deployed.
5. Under VPN configuration, select Download configuration for Windows, macOS, Linux for the required SSL VPN configuration, then Use with Sophos Connect and OpenVPN Connect v2 clients. The separate v3 option is for OpenVPN Connect 3.0 clients.
6. Store the .ovpn file securely and use it only for the authorised user.

The .ovpn file is user-specific: it contains that user’s unique certificate and private key. Do not share or reuse it for another user. Revoke or replace the affected user’s access if a profile is exposed.

Documented for SFOS 22: The client documentation associates the SSL profile generated during import and its certificates with the user identity, authentication method and domain. The SFOS 22 troubleshooting help identifies import with a different authentication method or domain as a cause of Login failed. Wrong fingerprint of certificate. and recommends a separate import of a .pro file or the user’s own .ovpn file. This does not establish that download and import create the same binding.

The saved SFOS 23 troubleshooting help omits this fingerprint section without describing a runtime change. That proves neither relaxed reuse nor unchanged binding on every version; SFOS 23 behaviour has not been independently verified here. Pending authoritative clarification for the target version, keep generated SSL imports separate by identity, authentication method and domain as a precaution, not a verified SFOS 23 rule. This concerns generated SSL profiles, not reusable raw .pro metadata or IPsec .scx profiles.

Direct .ovpn import works from Sophos Connect 2.0 on macOS; it does not automatically update subsequent policy changes. From macOS client 2.1, .pro provisioning is documented as an alternative for SSL VPN and IPsec, not with 2.0. .pro is a retrieval configuration for the VPN Portal, not a tunnel profile. Sophos Connect Provisioning describes the file, schema and controlled profile maintenance. For manual profiles, download and import a current .ovpn file after relevant changes.

If the browser warns about the portal certificate, investigate the cause. In production environments, a valid VPN Portal certificate is preferable to a permanent browser exception. For hardening guidance, see Device Access and Local Service ACL on Sophos Firewall.

For directly imported .ovpn profiles: after changes to the gateway, port, certificate, DNS, lease range, authentication or SSL VPN policy, the profile should be downloaded and imported again. Updating the client alone does not update an old .ovpn profile.

3. Import the connection into Sophos Connect

Open Sophos Connect and click Import connection on the Connections page. If connections already exist, open the menu and choose Import connection there. Select the .ovpn file. The connection must then appear under Connections. If there are several profiles, use a clear name so that users and support staff do not accidentally select the wrong one.

If the import fails, first check the client version, file type and source. Direct SSL VPN import on macOS requires Sophos Connect 2.0 or later and a current .ovpn file from Download configuration for Windows, macOS, Linux. .scx belongs to IPsec, not this SSL VPN import. .pro is the alternative provisioning route on macOS from 2.1; it is not supported with macOS 2.0.

Entra ID SSO is documented on macOS from Sophos Connect 2.1, not with 2.0. A greyed-out SSO option in 2.0 is not activated by signing in to the portal. For 2.1, first check the firewall-side Entra ID setup and current client configuration. Use the complete macOS SSO browser workflow with fallback and compliance.

4. Establish the VPN connection

Select the imported connection and click Connect, or double-click the connection. Then sign in as the VPN user. The username is case-sensitive. If MFA or OTP is enabled, confirm the displayed verification code as configured on the firewall. With Entra ID SSO from 2.1, complete sign-in in the embedded or system browser opened by Sophos Connect and then return to Sophos Connect. Directly imported .ovpn profiles use the automatic browser workflow; if the required switch does not occur, use IT-approved .pro provisioning with the system browser. Complete compliance measures or contact IT; never weaken Conditional Access.

After connecting, do not rely solely on the client status. What matters is whether the required internal destinations are reachable.

Verify the connection

Checks after installation

Test at least the following points with a test user:

• Sophos Connect shows the connection as connected.
• The user receives an IP address from the expected SSL VPN pool.
• Internal DNS names resolve correctly.
• Required servers and applications are reachable.
• Internet behaviour matches the design: split tunnel or full tunnel.
• Log Viewer shows the expected firewall rule for traffic from the VPN zone.
• MFA is requested as planned.
• Disconnecting and signing in again work.

If the connection is established but access does not work, the cause is often not the client but firewall rules, DNS, routing or NAT. For analysis, see Test firewall rules with Log Viewer, Policy Test and Packet Capture.

Acceptance test on macOS

After setup, document a genuine test case rather than only the green client status.

1. Check the Sophos Connect version: The client version is compatible with the macOS version and supports SSL VPN.
2. Test Apple Silicon: With 2.0, Rosetta 2 is available; from 2.1, ARM is native. The client starts reliably on the macOS version actually in use.
3. Check the profile import: The .ovpn profile comes from the current firewall configuration.
4. Test MFA: Sign-in with the correct and an incorrect factor behaves as expected.
5. Test DNS: Internal names resolve correctly, not only IP addresses.
6. Test access: Permitted destinations work and non-permitted destinations remain blocked.
7. Check Log Viewer: Traffic from the VPN zone matches the expected firewall rule.
8. Test reconnecting: Disconnecting and reconnecting work without changing profiles.
9. Test Entra SSO from 2.1: Check browser selection, required fallback, complete sign-in and the return to the client; a compliance error keeps access blocked until the required measures have been completed.

If the organisation uses several macOS versions, test at least one Intel Mac and one Apple Silicon Mac. In mixed-client environments, also check that Sophos Connect and Tunnelblick do not use different profiles or produce different DNS results.

For a reproducible DNS test in macOS Terminal, first check the public resolver path and then an internal name:

nslookup www.sophos.com
nslookup intranet.example.internal

Replace intranet.example.internal with an internal FQDN that the user is allowed to access. The first command must return an address even without the VPN. After the tunnel is up, the second must show the expected internal DNS server and address. If the first test already fails, check the local network or ISP first. If only the second fails, check DNS servers and Domain name under Remote access VPN > SSL VPN > SSL VPN global settings, and Administration > Device access > DNS > VPN.

Upgrade, rollback and clean removal

The current Sophos upgrade guide describes downloading and installing the new macOS package, not a general requirement to uninstall first. Use the remove-and-reinstall procedure here only for an explicitly approved reinstall or rollback; this does not establish universal support for in-place updates either. Before rollout, confirm the method for the source and target versions, securely retain the installer source and current .ovpn file, and start with a test Mac. If the new client causes a problem, reinstall the previously approved macOS version; reuse the old profile only if its corresponding firewall configuration is still valid. Rolling back to macOS client 2.0 does not retain native ARM execution, .pro provisioning or Entra ID SSO. If these 2.1 features are required, 2.0 is not an equivalent rollback option; approve and test a supported alternative in advance.

If Sophos Endpoint is installed, do not turn off its tamper protection as a precaution. The current uninstall guide no longer lists this as a prerequisite; the troubleshooting help still identifies protection as a possible reason why Sophos Connect processes fail to unload and recommends a restart. If you encounter this issue, save the logs, restart during a maintenance window and check again. If removal remains blocked, clarify the specific Endpoint/client combination with IT or Sophos. Only with explicit approval for this case should you temporarily change protection in Sophos Fusion (formerly Sophos Central). For the approved uninstall, with local or secondary administrative access available, run the following from macOS Terminal with administrator rights:

sudo /Library/Sophos\ Connect/uninstall.sh

The expected message is Sophos Connect has been uninstalled. Verify that the client no longer starts. If tamper protection was explicitly disabled for this procedure, turn it back on and verify its active status both on the endpoint and in the management console—even if removal fails. Do not delete an existing working connection until the new import and access test have succeeded.

Alternative: OpenVPN-compatible client

OpenVPN Connect or Tunnelblick can still be appropriate when Sophos Connect is not required or an existing OpenVPN process is deliberately retained. Document this approach as a separate operating standard so that Sophos Connect, several OpenVPN clients and old profiles do not circulate in parallel.

In the VPN Portal, the downloaded configuration option must match the client in use. Then check the .ovpn file, user sign-in and DNS behaviour. Do not adopt old blanket requirements for a particular OpenVPN version without verification; the current firewall version, client version and specific profile are what matter.

Operations and security

SSL VPN is a publicly accessible remote access service. Documentation should therefore cover not only installation but also ongoing operation:

• Update Sophos Connect or the OpenVPN client regularly.
• Enable and test MFA for remote access.
• Review VPN groups regularly.
• Restrict portal access through Device Access and Local Service ACL where possible.
• Keep firewall rules for the VPN zone narrowly scoped and enable logging.
• Remove old .ovpn files and outdated profiles.
• Plan for syslog or central analysis if logs must be retained for longer periods.

For MFA fundamentals, see Enable MFA for Sophos Firewall WebAdmin, VPN Portal and Remote Access. For log files and service logs, see Sophos Firewall troubleshooting: services and logs.

macOS rollout checklist

• The supported default client is defined: Sophos Connect or a deliberately selected OpenVPN client.
• Sophos Connect 2.0 is suitable for macOS 13+; from 2.1, macOS 14+ is required.
• With 2.0, Rosetta 2 has been included in the rollout for Apple Silicon; from 2.1, native ARM execution is checked.
• The .ovpn profile comes from the current SSL VPN configuration.
• The SFOS 22 Download configuration for Windows, macOS, Linux file is used.
• Direct .ovpn profiles are maintained manually; .pro provisioning is used only with macOS client 2.1 or later.
• The VPN Portal uses a valid certificate.
• The user is included in the correct SSL VPN policy.
• MFA behaviour is documented and tested with a test user.
• DNS, the search domain and internal target systems have been tested on macOS.
• Firewall rules for the VPN zone log the test traffic.
• After profile changes, it is clear who informs users that they must reimport the profile.

Troubleshooting

Sophos Connect does not import the OVPN file

First check whether Sophos Connect for macOS 2.0 or later is installed and whether the file really comes from the current SSL VPN configuration. If the client reports Connection with name … already exists, inspect the existing connection and delete it only when it is meant to be replaced. Then download the file again from the VPN Portal or redeploy it through the administrative process.

Internal names do not resolve

Check the DNS servers, search domains and SSL VPN configuration on the firewall. For Sophos Connect on macOS, also check the client version because Sophos fixed a DNS issue affecting SSL VPN connections on macOS in version 2.0 MR1.

If IP addresses work but names do not, the issue concerns DNS or the search domain. If IP addresses do not work either, routing, firewall rules or the return path are more likely causes.

The connection is established, but internal systems are unreachable

Check firewall rules, routing, NAT and the return path. Traffic from the VPN zone should be visible in Log Viewer. If no logs appear, the traffic probably does not reach the expected rule or logging is disabled.

If small requests work but larger file transfers or certain applications stall, also check MTU/MSS: Check Sophos Firewall MTU and MSS for VPN problems.

The connection no longer works after a profile change

For an .ovpn connection, Policy mismatch error. Import a new policy for this connection. is explicit: after changes to the gateway, certificate, port, DNS, lease range, authentication or policy, download and import a new .ovpn file and reconnect. Received connection reset from gateway can also indicate changed SSL VPN settings, a manual disconnect or a firewall restart. Updating the client alone does not update an old profile.

The dashboard does not open or internet DNS remains broken after disconnecting

If the dashboard does not respond, open Activity Monitor, open the Sophos Connect process, select Force Quit, and restart the app from Launchpad. If web browsing fails after disconnecting a full-tunnel profile, macOS may not have restored the physical adapter’s DNS servers. Disconnect and reconnect the local network, then repeat the public nslookup test.

Management port is unavailable

Sophos Connect requires local TCP port 25340 to communicate with OpenVPN. If another application occupies the port, review and exit that application, then reconnect. Sophos Connect 2.0 cannot run while this local port remains unavailable.

The option to save credentials is not visible

Sophos re-enabled the option to save credentials in Sophos Connect 2.0 MR1 for macOS. After the update, reimport the configuration to make the option available. In environments with MFA, still check whether storing credentials fits the security model.

The connection drops on external networks

SSL VPN is often more tolerant than IPsec, but it is not immune to restrictive networks, captive portals, enforced proxies or unstable Wi-Fi. In these cases, test with a second network and assess whether split tunnel, the port, the protocol or ZTNA is a better fit.

Collect support data

If the problem is not immediately apparent, document the client logs, time, user, source network and target system. In the Sophos Connect Client, use three-dot menu > About > Generate technical support report to create a support package. The file is named scvpntsr.zip and contains connection events, VPN configurations, provisioning details, SSO authentication information, browser details and endpoint data. WebView2 information in scgui.log applies only to Windows, not to the macOS browser. Share the archive only through the approved transfer channel with authorised recipients; never copy passwords, OTPs or private keys into the ticket text.

On the firewall, Log Viewer, sslvpn.log, openvpn-status*.log and the relevant firewall rule provide additional evidence. The log file mapping is documented in Sophos Firewall troubleshooting: services and logs.

FAQ