Troubleshooting

---

Mac OS X 10.5 (Leopard)

• DigiTunnel 1.5 works on Mac OS X 10.5 (Leopard), but there were a few early reports of upgrade problems.
   
• In almost all cases this has solved any problems: Uninstall DigiTunnel (without deleting your preferences settings, then install it again.
   
• If DigiTunnel stops working after you upgrade, please contact us. To help us understand the issues, run Plumber and send us its report before attempting to fix the issue. To run Plumber, download this file and open it (a disk image). Please have DigiTunnel disconnected (black dots in the menu bar icon), then double-click the Plumber program.
   
• If you are planning your Mac OS X 10.5 upgrade, see "Evaluating the Leopard Installation Process" (especially "Installation Methods") from the excellent folks at TidBITS. Also check out the Macintouch Software Incompatibilities report.

Installing

How do I configure DigiTunnel for my Airport, network, PPP, other Internet connection?

Connecting
If DigiTunnel can't connect at all: (Error "Sorry, I cannot find the PPTP Server")
Error: "Sorry, I am unable to completely connect..."
If authentication fails
Other reasons why DigiTunnel can't connect

Using
It connected, but I get DNS errors so I can't connect to anything
It connected, but I'm having trouble connecting to Windows File Sharing (SMB)
It connected, but services on the VPN servers (such as web, file-sharing, SMB, email) don't work
Services on the Windows server can be reached, but not services on other servers on the private network
AppleTalk printers or file sharing doesn't work
When I try to disconnect from a file server, it says "the Disk is in use", even though I have no files open on it
An SMB folder unexpectedly dissappeared, or DigiTunnel warns me that an SMB shared folder is open, but it's not visible in the Finder
My Mac's hostname changes when connected, and I use software that requres that it stay the same (OS X 10.4 or later only)

Uninstalling
I uninstalled DigiTunnel, but it is still in the System Preferences window

Tools for troubleshooting

Installing

How do I configure DigiTunnel for my Airport, network, PPP, other Internet connection?

• You don't. DigiTunnel automatically uses the primary network that is currently up (connected).
• If you have multiple network interfaces (Ethernet, airport, modem) that are up at the same time, and you want to make one primary: (1) Open Network Preferences. (2) From the Active Ports popup menu, choose Network Port Configurations. (3) Drag the desired interface to the top of the list. Note: DigiTunnel's PPTP configurations normally show up in this list as grayed-out items. Moving them in the list has no effect.)

Connecting

If DigiTunnel can't connect at all: (Error "Sorry, I cannot find the PPTP Server")

• The server address in DigiTunnel's General tab may be incorrect. With a bad address (or an address that is not a PPTP server), the Connection Log shows "LCP: timeout sending Config-Requests" This error can also indicate a blocked connection mentioned above.
     
• Is your Internet connection working?
   
• You may have outbound connections blocked by a firewall on your Mac. Some built-in firewalls, such as ipfw or BrickHouse, can be configured to block all outbound connections. If you use such a firewall, you must allow outbound TCP port 1723 and inbound/outbound protocol 47 (GRE). Norton Personal Firewall does not block outbound connections or GRE, so it is not a factor.
  

• The server you are trying to connect to may not be a PPTP server. Other protocols such as IPSec are not compatible with DigiTunnel.
   
• If you have Virtual PC installed on the Mac, it may be interefering with network access on the Mac. Disable Virtual PC, and if that doesn't help, restart the Mac.
  
• If you are connecting through T-Mobile, ask if PPTP has been enabled for your account.

Error: "Sorry, I am unable to completely connect..."

• You may be trying to connect through a router that is not PPTP-aware, such as older Airport hubs. Routers are often used to share an Internet connection at home or office. Some routers have a setting to enable PPTP passthrough (usually accessed through a web page interface). Your cable or DSL modem may itself contain a NAT router, requiring it be reconfigured to allow PPTP. See the router compatibility list or if you have an Airport base station (older than Airport Extreme), see Airport workarounds.
   
• Your router may only support one PPTP connection at a time. This can result in successful connections at some times and this error message at others. In this case, (if permissable) reboot the router to reset its PPTP passthrough.
   
• You may be trying to connect with encryption off to a server that requires encryption. Check the box in DigiTunnel preferences.
   
• A firewall may be blocking inbound/outbound protocol 47 (GRE). OS X's built-in firewall can be configured to do this, but only from the unix command-line (ipfw) or using third-party software such as Brickhouse. Norton Personal Firewall does not block this, so it's no problem for DigiTunnel users. Brickhouse users should Allow Custom Service 47, no port, Source Internet, Destination My Computer.

If authentication fails:

• Make sure your Username and password are correct. Some servers require a Windows domain name before the username. Be sure to separate these with a backslash. (Remote message E=691).
   
• Your server may not be compatible with DigiTunnel. Check the server compatibility list.
   
• Your server may require a form of authentication that DigiTunnel does not support. One such form is EAP-TLS. "SecurID" uses EAP, so SecurID users cannot use DigiTunnel in this version. DigiTunnel supports MSCHAP and MSCHAPv2.
   
• If the server denies access, it may return an error code. When found, DigiTunnel displays the reason in plain english in an alert dialog. Here are the error codes, which appear in the system log, prefixed by "Remote message: E=". The codes are:
  

  646 ERROR_RESTRICTED_LOGON_HOURS
  647 ERROR_ACCT_DISABLED
  648 ERROR_PASSWD_EXPIRED
  649 ERROR_NO_DIALIN_PERMISSION
  691 ERROR_AUTHENTICATION_FAILURE <-wrong username or password?
  709 ERROR_CHANGING_PASSWORD

Other reasons why DigiTunnel can't connect:

• The server may not be configured for VPN remote access, or could be incorrectly configured (see Windows server).
  

Using

It connected, but I get DNS errors so I can't connect to anything:

• If you have DigiTunnel's all-VPN routing turned, off, the likely cause is that your organization's DNS servers are on a different subnet (IP address range) than your VPN server. The easy fix is to turn all-VPN routing on (DigiTunnel's Routing tab): check "Route all traffic through VPN". Or, use a larger Subnet Mask (DigiTunnel's General tab). Check with your system administrator for the correct value. Hint: a larger Subnet Mask ends in more zeroes. The subnet mask is not used for all-VPN routing.
• Ask your system administrator if you should be using any proxy settings (DigiTunnel's Proxies tab).

It connected, but I'm having trouble connecting to Windows File Sharing (SMB):

• SMB (Windows File Sharing) is a little tricky to use under OS X and VPN. You need to know the name of the server's Share (what PC users "map" their drive letter to.). You also need the name or IP address of the server. In the Finder's Connect To Server window, enter a URL like  smb://10.0.0.1/ShareName  where "10.0.0.1" is the address of the server and "ShareName" is the Windows Share name (possibly a PC drive letter). When you've entered it right, you'll get a dialog asking for Domain, Username, and Password.

It connected, but some or all services on the VPN servers (such as web or file-sharing) don't work:

• This solution works in many cases: In DigiTunnel's General tab, click "Advanced." In the Advanced window, change the line containing "mtu" to "mtu 400". Click OK, then click Apply Now. Reconnect and try the services again. Large (>400K) SMB file uploads in particular work better with mtu 400 for some users. Other mtu values up to 1466 may be optimal for your particular connection.
• Some services and some server installations don't work no matter what we do. If this is the case for your service/server, you may need to use some alternative to DigiTunnel (MS Windows in VPC, TunnelBuilder in OS 9, or OS X's built-in VPN client.). Lotus Notes in particular seems to dislike DigiTunnel's connections.
• See also the next item about services on other servers.

Services on the VPN (Windows) server can be reached, but not services on other servers on the private network:

• If "Route all traffic through VPN" is turned off, check the Subnet Mask setting under DigiTunnel's General tab. This should be the same as that for any computer physically on the network at the office.

AppleTalk printers or file sharing doesn't work:

• Sorry, AppleTalk is not supported over the VPN. AppleTalk printers can be reached by setting up a print server at the office that receives jobs via LPR (a protocol that works over IP). File sharing over AppleTalk can be upgraded to use TCP/IP. AppleTalk should not be confused with AppleShare, which is the name for Apple's OS 8/9 server software. AppleShare IP servers work fine over the VPN (and include the printe server function).

When I try to disconnect from a file server, it says "the Disk is in use", even though I have no files open on it:

• De-select the server icon or close its window so that its contents are not seen in any window. Drag the server icon to Trash/Disconnect in the Dock.
• If that doesn't work, log out of the Finder and log back in (or restart the Mac). In this case, you may get better results with a smaller mtu setting (see above).

An SMB folder unexpectedly dissappeared, or DigiTunnel warns me that an SMB shared folder is open, but it's not visible in the Finder

• If you successfully connected to an SMB shared folder in the Finder, but it disappeared, you can make it reappear. Choose Force Quit from the Apple menu, choose Finder, click Restart. It may be safer to close other programs before doing this. Upon relaunch, the Finder should show your SMB shared folder so you can disconnect from it before closing the VPN.

My Mac's hostname changes when connected, and I use software that requres that it stay the same (OS X 10.4 or later only)

• A hostname is a human-readable name that refers to a computer on a network, used instead of a numeric IP address. For common user applications such as email and web browsing, the Mac's hostname is unimportant. But some applications may not function properly if the hostname changes by connecting with DigiTunnel, which happens on Mac OS X 10.4 (Tiger). Here's a way to set an unchanging hostname—recommended for power users only, and only if necessary:
• (Workaround kindly provided by DigiTunnel user Eric H.) The 'HOSTNAME' setting defaults to "-AUTOMATIC-" in both 10.3 and 10.4. I believe the correct workaround is to set HOSTNAME in /etc/hostconfig equal to your desired host name.  You must also add a NetInfo entry with the same name under /machines by copying and editing the localhost entry in NetInfoManager.app.  Restart your computer and you should be ready to go.  This works for me, at least.
  See also http://manuals.info.apple.com/en/Mac_OS_X_Server_v10.4_Getting_Started.pdf

Uninstalling

I uninstalled DigiTunnel, but it is still in the System Preferences window

• To uninstall DigiTunnel, open "Uninstall DigiTunnel." This program is in the folder /Library/Application Support/DigiTunnel
• When DigiTunnel was really uninstalled, System Preferences may just not notice for a while: System Preferences keeps copies of the icons in a cache file. Delete the file to get rid of the old icon. The file is inside your home folder in this location:
  
  ~/Library/Caches/com.apple.preferencepanes.cache
  
  

Tools for troubleshooting:

• A log is available in the Internet Connect program: Choose Window->Connection Log. Send this log to Gracion support for analysis.
• DigiTunnel Plumber: Download this tool from Gracion. It produces a configuration report that can be sent in for analysis and help.
• Applications ->Utilities -> Console. Generally not needed, because the Connection Log already shows all info of interest. But in case you need it: Information about the connection process, tagged "pppd", are shown in /var/log/system.log. Scroll to the bottom for a real-time view. (The default Console Log is designed to only show errors from all applications.)
• On your Windows VPN server, open Programs->Administrative Tools->Event Viewer->System Log. This shows login errors. To enable this logging, right-click your server under Routing and Remote Access, click Properties, Event Logging. If set for maximum logging, also shows normal successful login and logout.