Companies usually use Windows machines on a Windows network – everything is pretty much the same flavor of Windows, and all updates are forced upon the users. It’s actually very easy to maintain a Windows environment, provided the company allows the IT department to lock everything down on the end users.

Ah, but I had a new challenge today – get a Macintosh OSX 10.6.3 (now 10.6.4) to connect to the VPN and gain access to all of the network resources.

The company is using an OpenVPN solution – which means the choices for connecting are a lot nicer.

Download Tunnelblick for Mac OS X
http://code.google.com/p/tunnelblick
At the time of this writing, they’re on version 3.0 stable and 3.1.06 beta. I’m using the stable version.
Install Tunnelblick by double clicking on the DMG file and then double clicking on the Tunnelblick.app file
Press the Install button
Launch Tunnelblick
Use your LOCAL credentials to install
Create and open configuration folder
Move your filename.ovpn and your certificate.pem/crt file (/Users/username/Library/Application Support/Tunnelblick/Configurations)
Launch the Tunnelblick program – it should show up next to the time in the apple menu bar
Now you can click on the icon and select the VPN you want to connect to

Ah, but you want static routes too? OK.

Roark Holz gave me this snippet to use (I edited a bit):
Login as root (or sudo in front of all of these commands)
cd /Library/StartupItems
mkdir AddRoutes
cd AddRoutes
nano AddRoutes

#!/bin/sh
. /etc/rc.common
StartService ()
{
ConsoleMessage “Adding Static Routing Tables”
route add -net 10.1.0.0 -netmask 255.255.255.0 10.50.0.254
}
StopService ()
{
return 0
}
RestartService ()
{
return 0
}
RunService “$1”

nano StartupParameters.plist

{
Description = “Add static routing tables”;
Provides = (“AddRoutes”);
Requires = (“Network”);
OrderPreference = “None”;
}

chmod 755 AddRoutes StartupParameters.plist
reboot

After rebooting, check the route tables with:
netstat -r

Obviously 10.1.0.0 is the network, the netmask will be any variation of your netmask on the network, and the final IP is the gateway.

***EDIT***
OK, so I found out that since the TAP network is not enabled until AFTER booting and starting Tunnelblick… I had to edit the .ovpn file to include the following:
--route 10.1.0.0 255.255.255.0 10.50.0.254
--route 10.2.0.0 255.255.255.0 10.50.0.254
ETC. Works like a charm now.