SSL VPN on macOS used to often be set up with Tunnelblick or other OpenVPN clients. This is still possible, but is no longer the only obvious option: Since Sophos Connect 2.0, Sophos also supports Remote Access SSL VPN on macOS.

The article describes the current standard path with Sophos Connect on macOS and classifies Tunnelblick as an alternative. When deciding between Sophos Connect, SSL VPN, IPsec, mobile clients and ZTNA, the first thing that fits is Sophos Connect or SSL VPN: Which remote access solution is right?.

Which macOS VPN article fits?

These instructions apply to Sophos Firewall with SFOS and SSL VPN on macOS. Depending on the task, a different approach is appropriate:

• Install Sophos Connect generally on macOS: Install Sophos Connect Client on macOS.
• Configure SSL VPN on the firewall side: Set up Sophos Firewall SSL VPN Remote Access.
• Set up SSL VPN on macOS with Sophos Connect: This article.
• Set up SSL VPN on Windows: Set up Sophos SSL VPN with Sophos Connect on Windows.
• Set up SSL VPN on iPhone, iPad or Android: iPhone/iPad or Android.
• Maintain Sophos Connect client versions and profiles: Check and safely update Sophos Connect Client version.
• VPN is connected but traffic is not working: Test firewall rules with Log Viewer, Policy Test and Packet Capture.

Mobile platforms such as iOS and Android are not directly supported by Sophos Connect for IPsec and SSL VPN. OpenVPN-compatible clients or operating system functions remain relevant there.

Requirements

• Sophos Firewall with SSL VPN remote access configuration set up
• Users authorized for SSL VPN
• Access to the VPN portal or an administratively provided .ovpn file
• Sophos Connect 2.0 or newer
• macOS Ventura 13 or later with Sophos Connect 2.0+
• Mac with Intel processor or Apple Silicon via Rosetta 2
• MFA/OTP set up if remote access is protected with it
• Firewall rules for traffic from the VPN zone

If the firewall-side SSL VPN configuration is not yet in place, Set up Sophos Firewall SSL VPN Remote Access should be implemented first.

Before upgrading SFOS 22 MR1, you should also check whether old remote access IPsec configurations still exist. SSL VPN is not directly affected by this, but many environments are reevaluating remote access at this moment. The process is in Migrate legacy remote access IPsec before SFOS 22 MR1.

Sophos Connect or Tunnelblick?

For new macOS rollouts, Sophos Connect should be checked first because Sophos Connect is Sophos’ own client and has supported SSL VPN on macOS since version 2.0. Tunnelblick remains an OpenVPN alternative, but should not emerge as a second unplanned standard.

• Sophos Connect: managed Macs, unified support process, current SFOS environment. Version, macOS requirements, Rosetta 2 at Apple Silicon and current .ovpn profile.
• Tunnelblick or other OpenVPN client: existing OpenVPN process, special cases, deliberate deviation from Sophos Connect. Clearly document OpenVPN version, profile maintenance, DNS behavior and support responsibility.

The client name is less important than the operation: it should be clear which client is supported, which version is distributed, where the profile comes from and when users need to import a new profile.

1. Deploy Sophos Connect for macOS

Sophos Connect can be deployed via the Sophos Firewall, VPN Portal or the Sophos Download Page depending on your environment. In managed environments, it should be clear which client version is being rolled out and whether Rosetta 2 is present on Apple Silicon devices.

SSL VPN on macOS requires Sophos Connect 2.0 or later. Older internal instructions or installation packages should therefore not be used without checking them. Sophos Connect 2.0 MR1 brings several macOS-specific fixes, including DNS settings for SSL VPN connections and the option to save credentials. After an upgrade, the profile must be reimported if this option is to be used.

2. Obtain OVPN configuration

The SSL VPN configuration is provided as a .ovpn file. Depending on the operating model, users download them from the VPN portal or receive them controlled via the admin process.

Typical process in the VPN portal:

1. Open the VPN portal of the Sophos Firewall.
2. Log in with the VPN user.
3. Switch to the VPN area.
4. Download SSL VPN configuration for the profile.
5. Store the .ovpn file securely and only use it for the authorized user.

If the browser warns about the portal’s certificate, the cause should be checked. In productive environments, a valid certificate for the VPN portal is cleaner than a persistent browser exception. Device Access and Local Service ACL on Sophos Firewall is suitable for hardening.

After any changes to the gateway, port, certificate, DNS, lease range, authentication, or SSL VPN policy, the profile should be redownloaded and imported. A client update alone does not update an old .ovpn profile.

3. Import connection into Sophos Connect

Open Sophos Connect and import the .ovpn file. The connection should then appear in the connection list. If you have multiple profiles, it’s important to have a unique name so that users and support don’t accidentally use the wrong profile.

If the import does not work, first check the client version, file type and origin of the configuration file. SSL VPN on macOS requires Sophos Connect 2.0 or later.

4. Establish a VPN connection

Select the imported connection and click Connect. Then log in with the VPN user. If MFA or OTP is active, the second factor must be confirmed according to the firewall configuration.

After the connection has been established, not only the status in the client should be checked. What is crucial is whether the required internal goals can be achieved.

Check after installation

At least these points should be checked with a test user:

• Sophos Connect shows the connection as connected.
• User receives an IP address from the expected SSL VPN pool.
• Internal DNS names are resolved correctly.
• Required servers and applications are accessible.
• Internet behavior corresponds to the design: split tunnel or full tunnel.
• The expected firewall rule for traffic from the VPN zone is visible in the log viewer.
• MFA is queried as planned.
• Disconnection and re-login work.

If the connection is established but no access works, the cause is often not the client, but rather firewall rules, DNS, routing or NAT. Test firewall rules with Log Viewer, Policy Test and Packet Capture is suitable for the analysis.

Acceptance test on macOS

After setup, you should document a real test case, not just the green client status.

• Check Sophos Connect version: Client version matches macOS version and SSL VPN support.
• Test Apple Silicon: Rosetta 2 is available and the client starts reliably.
• Check profile import: .ovpn profile comes from the current firewall configuration.
• Test MFA: Login with the right and wrong factor behaves comprehensibly.
• Test DNS: Internal names resolve correctly, not just IP addresses.
• Test access: Allowed targets work, unauthorized targets remain blocked.
• Check Log Viewer: Traffic from the VPN zone hits the expected firewall rule.
• Test reconnect: Disconnecting and reconnecting works without changing profiles.

If multiple macOS versions are used in the company, at least one Intel Mac and one Apple Silicon Mac should be tested. For mixed clients, you should also check that Sophos Connect and Tunnelblick are not using different profiles or DNS results.

Alternative: Tunnelblick or other OpenVPN client

Tunnelblick can still be useful if Sophos Connect is not to be used or if an existing OpenVPN process is deliberately retained. However, this variant should be documented as a separate operating standard so that Sophos Connect, Tunnelblick and old profiles are not in circulation at the same time.

With Tunnelblick the .ovpn file is imported. After that, OpenVPN version, profile, user login and DNS behavior must be checked. Old blanket specifications for a specific OpenVPN version should not be adopted without checking; The decisive factors are the currently used firewall version, the client version and the specific profile.

Operations and Security

SSL VPN is a publicly available remote access service. That’s why you should not only document the installation, but also the operation:

• Update Sophos Connect or OpenVPN client regularly.
• Activate and test MFA for Remote Access.
• Check VPN groups regularly.
• Limit portal access via Device Access and Local Service ACL where possible.
• Keep firewall rules tight for the VPN zone and log.
• Remove old .ovpn files and outdated profiles.
• If logs are stored for a longer period of time, plan for syslog or central evaluation.

For MFA basics, Enable MFA for Sophos Firewall WebAdmin, VPN Portal and Remote Access fits. For log files and service logs, Sophos Firewall Troubleshooting: Services and Logs is useful.

macOS rollout checklist

• Supported default client is defined: Sophos Connect or deliberately an OpenVPN client.
• Sophos Connect version is suitable for macOS Ventura 13 or later.
• Apple Silicon devices have included Rosetta 2 in the rollout.
• .ovpn profile comes from the current SSL VPN configuration.
• VPN Portal uses a valid certificate.
• User is included in the correct SSL VPN policy.
• MFA behavior is documented and tested with a test user.
• DNS, search domain and internal target systems were tested on macOS.
• Firewall rules for the VPN zone log test traffic.
• After profile changes, it is clear who will inform users about the new import.

Troubleshooting

Sophos Connect does not import the OVPN file

First you should check whether Sophos Connect 2.0 or newer is installed and whether the file really comes from the current SSL VPN configuration. Then reload the file from the VPN portal or redeploy it administratively.

Internal names are not resolved

Check DNS servers, search domains and SSL VPN configuration on the firewall. For Sophos Connect on macOS, the client status should also be checked because Sophos fixed a DNS problem with SSL VPN connections on macOS in version 2.0 MR1.

If IP addresses work but names don’t, it’s a DNS or search domain problem. If IP addresses also don’t work, routing, firewall rules or return path are more likely.

Connection is established, but internal systems cannot be reached

Check firewall rules, routing, NAT and return path. Traffic from the VPN zone should be visible in the log viewer. If no logs appear, traffic is probably not reaching the expected rule or logging is disabled.

If small accesses work, but larger file transfers or certain applications hang, MTU/MSS should also be checked: Check Sophos Firewall MTU and MSS for VPN problems.

Connection no longer works after profile change

After changes to the gateway, certificate, port, DNS, lease range or authentication, the .ovpn profile should be reimported. If only the client has been updated but an old profile remains in use, old destinations, ports or DNS values ​​can still be used.

Save access data is not visible

Sophos has re-enabled the option to save credentials in Sophos Connect 2.0 MR1 for macOS. After the update, the configuration must be reimported so that the option can be used. In environments with MFA, you should still check whether storing access data fits with the security concept.

Connection breaks in foreign networks

SSL VPN is often more tolerant than IPsec, but is not immune to restrictive networks, captive portals, proxy coercion or unstable WLANs. In such cases, test with a second network and check whether split tunnel, port, protocol or ZTNA is a better fit.

Collect support data

If the error is not immediately visible, you should document client logs, time, user, source network and target system. On the firewall side, Log Viewer, sslvpn.log, openvpn-status*.log and the appropriate firewall rule help in parallel. The assignment of the log files is in Sophos Firewall Troubleshooting: Services and Logs.

FAQ