Passepartout

A non-official, user-friendly OpenVPN® client for iOS and macOS.

Frequently Asked Questions

I’m unable to add my Wi-Fi to trusted networks

1.9.0 [iOS]

If you see the “You are not connected to any Wi-Fi network.” message, it’s coming from a known iOS 13 bug.

Until Apple fixes it, you may want to try these workarounds:

Unfortunately neither is guaranteed to work. While extremely sorry for the inconvenience, I can’t do more than this about this iOS bug.

Anyway, you can follow this Reddit discussion for updates.

1.8.1 and before [iOS]

The effect of the new location access requirement in iOS 13 is the inability to trust the connected Wi-Fi network. The app will either trust a bogus “Wi-Fi” or “WLAN” SSID name, or present the alert “You are not connected to any Wi-Fi network.”.

To work around this issue:

I had purchased this app before yet it prompts me for purchases

Since iOS version 1.9.0, Passepartout switched to a freemium model, which means free to download with paid in-app purchases. Of course, those who purchased former versions of the app will retain full access to all features and providers. Most of the time the upgrade will be seamless. In some cases, however, it will take those users an extra step to restore app functionalities.

Any of the hints below will fix the issue 100% of the times:

If you still struggle, don’t hesitate to get in touch.

My provider is not listed

You should contact with your provider to double check if there is interest in being added to Passepartout. Beware that some may be concerned instead. Ultimately, you can submit your provider request for a viability review to providers@passepartoutvpn.app.

I’m on Wi-Fi but my device shows I’m connected via LTE

The Wi-Fi/LTE icon (replace LTE with any cellular signal) while on VPN has been broken since iOS 10 or the like. It’s something that Apple is unable to fix or doesn’t bother fixing.

You should do a simple test. Verify your data consumption with your LTE provider website, normally phone providers have that. Now, when on VPN and the LTE icon appears in spite of Wi-Fi, download a relevant chunk of data. You may then learn that the plan is unaffected, implying that you’re actually connected via Wi-Fi.

I haven’t found a workaround for this and it’s been there for almost two years. Yeah, it’s a shame.

Why is location access required when trusting a Wi-Fi network?

Starting from iOS 12 (or 13?), iOS has restricted what apps can learn about Wi-Fi networks. Location access has become a requirement to access the SSID of the connected Wi-Fi, which is crucial to add it to trusted networks.

That’s why, starting from iOS app 1.9.0, Passepartout will prompt you for a location permission when trusting a Wi-Fi network. Make sure that location services (under “Privacy”) are enabled on your device, otherwise the app will be unable to ask the permission in the first place.

I can connect to the VPN but the Internet does not work

MTU

Historically, Passepartout has used a low MTU setting (1250 bytes) in order to maximize compatibility, at the cost of performance. iOS version 1.13.0 -and any macOS version- supports tunnel MTU customization. With this update, it sounded reasonable to also leverage a standard (higher) MTU (usually 1500).

If such change is making the app struggle in your environment, I encourage you to try lowering the MTU. You can easily do that by setting MTU to “Manual” in “Network settings”. You will then be able to pick something down to 1200 bytes. Decrease incrementally until you restore VPN operation.

Compression

Most of the time there could be a mismatch in compression framing. E.g. server is using LZO compression framing whereas the client is not, or vice versa. Sometimes the app gracefully shuts down with “Compression unsupported”, sometimes the error can be subtle and packet transmission could just fail silently, resulting in no data exchanged over the wire.

Therefore, make sure that compression directives are compatible between client and server before looking into routing issues. Also read the next FAQ entry, as it may be another cause of a dead data link.

DNS

Last but not least: make sure that you’re not experiencing a simple DNS issue. Try pinging a remote machine by IP address: if that works, then DNS is the culprit. This usually happens when your server, whatever the reason, doesn’t push public DNS servers to clients. There’s a quick workaround: enter “Network settings” in Passepartout, set “DNS” to “Manual” and add an explicit DNS server address. That should fix it.

The VPN fails with “Auth failed” or immediately disconnects with “Encryption failed”

This may happen when you rely on default OpenVPN encryption, which is normally Blowfish (BF-CBC). The algorithm, besides being unsupported by Passepartout, is also weak and therefore discouraged. In order to fix this issue, you must switch to AES encryption. Passepartout only supports AES, be it in CBC or GCM mode.

Set encryption explicitly in the server configuration, e.g.:

cipher AES-128-CBC
auth SHA1

and don’t forget to update the client .ovpn as well with the exact same parameters.

If you want to leverage newer AES-GCM encryption, you could just use:

ncp-ciphers AES-256-GCM
# or
ncp-ciphers AES-128-GCM

and the client wouldn’t need to change a thing, because the algorithm will be enforced by the server no matter what.

My provider returns “Auth failed” but my credentials are correct

Bear in mind that some providers require specific credentials for their direct OpenVPN servers. That’s why Passepartout, in those cases, has a convenient link in the bottom of the Account screen showing you where to find such credentials on your provider’s website.

Regarding Mullvad in particular, remember to strip spaces from the username.

The configuration file lacks a required option (cipher)

When missing, OpenVPN implies a Blowfish cipher, which is severely obsolete and unsupported. Passepartout requires that you set an AES cipher instead. For that to work, you must update your OpenVPN server and client configuration to use AES by explicitly setting a cipher (e.g. cipher AES-128-CBC).

Recent servers might still be pushing a modern cipher option (normally AES-GCM), but Passepartout enforces an explicit client cipher to avoid another subtle issue.

The configuration file contains an unsupported option (external file)

Due to easier interoperability, the app does not support external files in the .ovpn main configuration. That’s because more often than not, it may not make sense referring to relative paths in a mobile device environment. Think of the Mail app for example. The fix is straightforward though, say you have an external ca file:

ca my-ca.crt

Just replace it with:

<ca>
...
content of my-ca.crt
...
</ca>

The same applies to other settings like cert, key, tls-auth and tls-crypt. In the specific case of tls-auth with a key direction, like:

tls-auth ta.key 1

Replace with:

<tls-auth>
...
content of ta.key
...
</tls-auth>
key-direction 1

Why don’t Siri Shortcuts execute in the background?

Unfortunately Apple is guilty of not fixing a related bug. I mean, it’s been there for years -since iOS 9 with my first bug report dating back to 2017- without them caring at all. No feedback and not even a proper response. And of course, no progress.

This is one of the several threads remarking the issue:

https://forums.developer.apple.com/thread/96020

Now, due to this bug, App Extensions can’t control VPN using custom protocols -Siri Intents Extension in this case, in order to run shortcuts in the background. Only native VPN protocols work (IKEv2, IPsec etc.).

In short, there’s really nothing I can do about it.

It seems that my traffic doesn’t necessarily go through the VPN

Unless redirect-gateway is either:

the default gateway is NOT changed. That is, your external IP won’t be the VPN’s IP. Double check the “Default gateway” entry in the “Configuration” page to see how your host profile looks like. On the other hand, the default gateway is always enforced for provider profiles.

This has been recently fixed in Passepartout 1.6.0 as it’s the standard OpenVPN behavior. Before 1.6.0, Passepartout erroneously assumed that all traffic should go through the VPN implicitly.

Try this website to test your external IP before and after this change.

I’d like to see a Today Widget in the Notification Center

The reason behind not providing a widget is exactly the same as Siri Shortcuts. A widget would still need to open the app, thus making it quite useless.

I’d like to see my IP address in the app

The reason why Passepartout does not present any personal information in app is privacy. Obtaining one’s IP address, regardless of being connected to a VPN or not, involves querying -and trusting- a third party service. Knowing such info is also of little use, given that most of the time you don’t want to share your VPN IP address and therefore link your identity to it. However, this feature might be introduced later as a diagnostic tool.

Mullvad ignores my custom DNS settings

It looks like Mullvad “hijacks” DNS on default endpoints, making custom DNS settings irrelevant. In order to do custom DNS with Mullvad, make sure to explicitly pick the “Custom DNS” preset, which will let you connect to the UDP:1400 and TCP:1401 endpoints. These endpoints do support custom DNS servers instead.

Until version 1.7.0 for iOS, you will have to do a manual “Refresh infrastructure” in order to access the new preset.

Read the related report on GitHub.

My host profile ignores DNS settings pushed by server

Passepartout is slightly different from OpenVPN Connect when it comes to DNS. Due to the ability of overriding network settings in general, Passepartout lets the user specify what DNS servers to pick without any ambiguity (“Read .ovpn”, “Pull from server” or “Manual”). On the other hand, OpenVPN Connect merges and uses both the servers defined in the .ovpn file (first) and those pushed as dhcp-option by the VPN server (last). With this in mind, you should now understand why DNS in some networks may behave differently than the official OpenVPN clients.