On macOS, Tap interface must be activated manually

[kabassanov]

Some debugging on recent macOS, showed that TAP interface is not brought up by openvpn when a vpn connection is established. Even if an "ifconfig tap0 up" is set in "--up" script, it is still not enough. Incoming packets can be observed with tcpdump, but no outgoing packet is sent... until a route-delay timer is fired. It is not optimal, as this way eventual dhcp requests are not sent and expected dhcp replies don't arrive in time in order to be used by openvpn routing management. The problem can be mitigated by "ipconfig set tap0 DHCP" and "ipconfig set tap0 AUTOMATIC-V6" in the "--up" script, but isn't it an openvpn task, as it is the only one to manage tap creation?

[cron2]

Please include a log file showing what OpenVPN is doing (verb 4, everything after PUSH_REPLY is relevant).

Standard macOS did not have any tap device support at all for a long while, so it comes as a surprise that you can "make it work"

[schwabe]

tap on macOS is requires setting a weak security policy (https://tunnelblick.net/cTunTapConnections.html#the-long-term-problem). I don't think anyone tested tap on macOS for years, so that it got broken comes as no surprise to me. There seem to very little demand for it.

[kabassanov]

Here you can see that interface is not operational before the end of the 10 seconds route-delay:
tap0-not-really-opened-before-route-up-script.txt

With explicit up and dhcp modes in --up script, "normal" behavior is observed:
tap0-opened-before-route-up-script.txt

[kabassanov]

Please include a log file showing what OpenVPN is doing (verb 4, everything after PUSH_REPLY is relevant).

Standard macOS did not have any tap device support at all for a long while, so it comes as a surprise that you can "make it work"

Yes, I saw all you wrote about Apple tap device support. At this time kernel extensions still work and if/when Apple drops them, there is a way to replace them by 2 feth interfaces and some adaptations. Even if it is not always required, some network architecture intergrations need to provide real level 2 connectivity with mac address management and so on. And openvpn2 is still able to do it.