Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to configure the Snow Leopard's VPN on demand service without success

VPN on demand screenshot

I've tried the following domain+configuration pairs but none of them have worked: default
* default

My goal is that each time I go to with Safari, ssh or everything else on this the connection will be established trough the VPN !

I've tried plenty of different configs but it has never worked so far...

share|improve this question
Wow, I didn't know snow leopard did VPN on demand. I wish windows did it (apart from the more complex direct access...) – Christopher Edwards May 7 '10 at 17:29
There's another configuration section for VPN where you can add your password to the keychain. Make sure that's already set up--in my experience VPN-on-demand will only trigger if the initial connection fails, so this might not work if your server responds to both public and private connections. – NReilingh Jul 29 '10 at 15:57
there is a way to indicate that an answer is not useful. It's done by downvoting. The answers you suggested to delete are off-topic, sure, but they don't qualify as offensive or worthy of deletion. They just should be downvoted. – Gnoupi Aug 14 '10 at 6:46
Could this topic help? It suggest you must not be able to connect to that host without VPN for it to work. – Daniel Beck Jan 26 '11 at 14:53
this is not 100% related, but somewhat:… ... it's obviously only part of a solution to get some kind of VPN on demand, of course. – Dan Rosenstark Apr 3 '11 at 6:58

As I discovered after some testing: VPN on demand on OS X doesn't work with configuration "Default"!


Add a minimum one named configuration on the VPN interface which you use for connecting. Then everything works fine - it's simple like that!

share|improve this answer
It works only with OS X built-in apps like Safari/Mail and like Gareth said, Default doesn't work, you should create a new configuration – Haytham Elkhoja Jul 23 '11 at 12:17
Another requirement is that the triggering domain must be a hostname that can not be resolved using public DNS according to… And even then VPN on demand is likely to only function using applications developed by Apple. – Pro Backup Jul 30 '13 at 14:01

Apparently this works only if you're using certificate-based authentication.

What is VPN on demand, and how do I get it to work with iOS?

The VPN connection is made whenever the device tries to connect to certain domains. Specific apps don't need to do anything; as soon as they try to access such a server the VPN connection is initiated.

Visit this support page for information about how to use the Configuration Utility to create a configuration profile that sets up VPN On Demand.

share|improve this answer
This appears to be a solution for iOS while the OP is requesting for Snow Leopard. – KronoS Jul 19 '12 at 6:19

I've not found a true "on-demand" solutions for ssh tunnels. Here is the definition (to me):

  • A host (whether local or remote) has a listening service on port XXX
  • A client (again, local or remote) connects to port XXX
  • Host then initiates a pre-defined ssh connection to another host and sets up appropriate port forwarding, authentication typically handled for the client.
  • The client is then able to use that connection based on the port forwarding.

As near as I can tell there is no software that currently enables the "on-demand" part; as defined by a service that is actively listening for connections. You can obviously start a service that creates the tunnel, but that is of course a manual operation.

Currently my solution is using launchd to keep an ssh connection open all the time. I used this blog post to craft my own solution:

If you update your question I could probably help you roll your own, again, this is a dedicated solution not "on-demand".

As an alternative to this, you can look as SSH Tunnel Manager or the afore mentioned TunnelBlick to start tunnels manually.

share|improve this answer
On-demand VPN is a feature that is advertised in Mac OS X; however, judging from this question and by searching on the web, it doesn't work properly for many people in Snow Leopard. I've tested it myself and it doesn't behave as it should. – Stephen Jennings May 10 '10 at 14:26
This doesn't address the question. In my work environment, I need to connect to the VPN before I can initiate any sort of ssh connection. – Doug Harris May 10 '10 at 15:08
Completely useless ... I love the part If you update your question I could probably help you roll your own, again, this is a dedicated solution not "on-demand". I'm still laughing on this. – Studer May 23 '10 at 22:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .