siraj/macosvpn

Create Mac OS VPNs programmatically

This is a command-line tool written in Objective-C that can create VPN network configurations on your Mac.

It supports both L2TP over IPSec and Cisco IPSec.

Requirements

Mac OS Yosemite or Mavericks (I have not tested it on older versions, it might work)
Administrator privileges (i.e. you've got to run it with sudo)

Download

Start a Terminal and run this curl command to get the executable:

sudo bash -c "curl -L https://github.com/halo/macosvpn/releases/download/0.1.0/macosvpn > /usr/local/bin/macosvpn"
sudo chmod +x /usr/local/bin/macosvpn

You can always run macosvpn --version to see the version currently installed on your system and compare it to the latest available version on Github.

Usage

Creating a single L2TP over IPSec VPN Service:

macosvpn create --l2tp Atlantic --endpoint atlantic.example.com --username Alice --password p4ssw0rd --shared-secret s3same

Replace --l2tp with --cisco to create a Cisco IPSec instead.

Shortcuts

The same command but shorter:

macosvpn create l2tp Atlantic endpoint atlantic.example.com username Alice password p4ssw0rd shared-secret s3same

The same command even shorter (replace -l with -c for Cisco IPSec):

macosvpn create -l Atlantic -e atlantic.example.com -u Alice -p p4ssw0rd -s s3same

The same command as short as possible:

macosvpn create -leups Atlantic atlantic.example.com Alice p4ssw0rd s3same

Creating multiple VPNs at once

Repeat the arguments for creating multiple Services at once (no matter which short version you use :)

macosvpn create -leups Atlantic atlantic.example.com Alice p4ssw0rd s3same \\
                -leups Northpole northpole.example.com Bob s3cret pr1v4te

Global default values

Assign default values which will be applied to every service. Say you want to create the following VPN services:

no name      endpoint              user  password sharedsecret
--------------------------------------------------------------
1  Australia australia.example.com Alice p4ssw0rd s3same
2  Island    island.example.com    Alice p4ssw0rd s3same

You could do that with the following command:

macosvpn create --default-username Alice --default-password p4ssw0rd --default-endpoint-suffix .example.com \\
                --l2tp Australia --endpoint-prefix australia --shared-secret s3same \\
                --l2tp Island --endpoint-prefix island --shared-secret letme1n

The same command a little shorter:

macosvpn create -m Alice -a p4ssw0rd -x .example.com \\
                -l Australia -f australia -s s3same \\
                -l Island -f island -s letme1n

If you feel adventurous you can find all available flags at the bottom of this file.

Troubleshooting

If you get a warning that says "Creating Keychain item failed: write permissions error", you need to run the application with sudo.
If you're stuck, try to add the --debug flag and see if it says something useful.

Limitations

If a VPN with the given name already exists, it is ignored. In the future there should be a --force option to re-create it

Development and credits

Feel free to browse through the code of this application. It's pretty small and straight-forward.

It all began with finding this page you probably already found. But it was not before this practical example that I actually dared to try to implement this. Then, google led me to this page where I learned how to set the Shared Secret. The last hurdle was to get the "Send all traffic over VPN" flag, which I finally found the answer to here. Finally, I learned from over here how to add things to the System Keychain.

Useful commands for debugging:

# Show all current VPN service configurations
open /Library/Preferences/SystemConfiguration/preferences.plist

# Show all Keychain Items and their access policies
security dump-keychain -a /Library/Keychains/System.keychain

Special thanks

To the beautiful 3rd party libraries I was allowed to use:

License

MIT 2015 halo. See MIT-LICENSE.

siraj / macosvpn