> This page is for Developers.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.emnify.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.emnify.com/_mcp/server.

# Integrate OpenVPN on macOS

> Step-by-step guide for integrating OpenVPN on macOS to use on devices with emnify eSIMs.

Using emnify, you can create a [virtual private network (VPN)](https://www.emnify.com/iot-glossary#vpn) for your mobile IoT/M2M devices fitted with emnify SIMs.
Data traffic is exchanged between the devices and the application server through an OpenVPN tunnel, enabling direct communication with the IPs of the mobile devices—no network address translation (NAT) applied.

The tunnel is established between the emnify Core Network and the customer's VPN gateway or server.

> **Tip**
>
> The [Secure your devices with OpenVPN](https://youtu.be/yt44fJpfkQ4) video provides a step-by-step walk-through.

## Required preparation in the emnify Portal

Any traffic exchanged with mobile devices is encrypted before being transmitted over the public internet, which adds an additional layer of security and privacy.
No VPN software needs to be installed on the device, or there aren't any required configuration changes necessary.
The default emnify APN also supports VPN flows.

### Download the VPN configuration file

[Log in to your emnify account](https://portal.emnify.com/sign).

Navigate to **Integrations** and find the [**Secure Connection**](https://portal.emnify.com/integrations#secure-connection) section.

Under **OpenVPN**, select **Show instructions**.

![](/_fern-img/dc9a5cf67757307da107bd7841461d21f2cac2d80bf6bf9fc87497588822b36f.webp)

Make sure you're on the **macOS** tab, then click **Download client.ovpn**.

![](/_fern-img/03868623d3d8597e9a8a3eb5bb65de05053b7a2920eb81e499c79cdd39ff54e6.webp)

Select the region that matches the breakout region configured in the device's service policy or **Download all regions**.

> **Warning**
>
> End-to-end connectivity only works between devices and OpenVPN clients configured in the same region.

Once downloaded, store that file on your server in the folder `/etc/openvpn`.

### Change the internet breakout region

Navigate to [**Device Policies**](https://portal.emnify.com/device-policies) in the emnify Portal.

In **Service Policies**, select the policy assigned to the devices you want to secure and expand the policy details.

In **Data**, find **Internet breakout region**.
By default, the badge next to the section title reads **Automatic Breakout Region**.
Click **Edit** to access the **Breakout region** dropdown menu.

Select a VPN breakout region (for example, `eu-west-1 (VPN)`).

> **Check**
>
> Changes save automatically.

## Set up with OpenVPN

### Install the OpenVPN software

First, install OpenVPN via [Homebrew](https://formulae.brew.sh/formula/openvpn):

```bash
brew install openvpn
```

### Create the credentials file

```bash
sudo touch /etc/openvpn/credentials.txt
sudo nano /etc/openvpn/credentials.txt
```

The `credentials.txt` file should contain OrgID and Application Token (preferred):

```txt
orgId
Application Token
```

Alternatively, you can use your username and password:

```txt
username@domain.com
YourPassword
```

Connect with the following command, passing the configuration file to OpenVPN using the `--config` option:

```bash
sudo openvpn --config path/to/emnify-eu-west-1.conf
```

## Set up with Tunnelblick

Drop the configuration file onto the Tunnelblick icon in the top bar.
Alternatively, drop the configuration file onto the **Configurations** list via the settings panel in
**VPN Details > Configurations**.
Tunnelblick asks for a user password.

### Create credentials

In the `/etc/openvpn` directory, create the credentials file:

```bash
sudo touch /etc/openvpn/credentials.txt
sudo nano /etc/openvpn/credentials.txt
```

> **Info**
>
> To connect to the regions VPN, you need to enter your Mac's password.