New Mac, same .conf profiles, now always "inactive (on-demand)" #1557

Qhilm · 2025-09-23T16:32:24Z

Qhilm
Sep 23, 2025

I imported the same .conf file and it does not work on the new mac, it's always "inactive (on-demand)". The "on-demand" part of the config is "active the VPN in any network". I tested this with two different .conf file imports.

Also, maybe related, the wireguard profiles do not sync over icloud somehow (they do sync well between old MacBook and iPhone though, in both directions).

I suspect something is fundamentally wrong on the new MacBook but I can put my finger on it. If anyone has an idea where I should start looking...

app logs

18:20:00 - 
18:20:00 - --- BEGIN ---
18:20:00 - 
18:20:00 - App: 3.5.11 (3919)
18:20:00 - OS: macOS 15.7.0
18:20:00 - 
18:20:00 - Set up local container: Local
18:20:00 - Container description: <NSPersistentStoreDescription: 0x6000007084e0> (type: SQLite, url: file:///Users/cysimons/Library/Containers/com.algoritmico.mac.Passepartout/Data/Library/Application%20Support/Passepartout/Local.sqlite)
18:20:00 - Device ID: sd8TzzcFekqC1C2deVkt3PdcJ52uFeAeUE7pBYGLVMQVrimCJbxIU8V50lT0MFF5
18:20:00 - Set up local container: Backup
18:20:00 - Container description: <NSPersistentStoreDescription: 0x60000070e7c0> (type: SQLite, url: file:///Users/cysimons/Library/Containers/com.algoritmico.mac.Passepartout/Data/Library/Application%20Support/Passepartout/Backup.sqlite)
18:20:00 - Filter profiles with '' (0): []
18:20:00 - Application did launch
18:20:00 - 	Read and observe local profiles...
18:20:00 - Decoded 0 managers to 0 profiles in 0.0 seconds
18:20:00 - Reload local profiles: []
18:20:00 - Filter profiles with '' (0): []
18:20:00 - Required features: [:]
18:20:00 - Local profiles after exclusions: []
18:20:00 - 	Observe in-app events...
18:20:00 - 	Observe eligible features...
18:20:00 - 	Observe changes in ProfileManager...
18:20:00 - 	Fetch providers index...
18:20:00 - Fetch data for index: https://passepartoutvpn.app/api/v7/index.json
18:20:00 - System Extension: load current status...
18:20:00 - System Extension: load result is needsApproval
18:20:00 - Current step: doneV3_2_3
18:20:00 - Next step: doneV3_2_3
18:20:01 - Available in-app products: []
18:20:03 - Data was cached: https://passepartoutvpn.app/api/v7/index.json
18:20:03 - Application did update eligible features
18:20:03 - Set up local container: Remote
18:20:03 - Container description: <NSPersistentStoreDescription: 0x600000734a50> (type: SQLite, url: file:///Users/cysimons/Library/Containers/com.algoritmico.mac.Passepartout/Data/Library/Application%20Support/Passepartout/Remote.sqlite)
18:20:03 - 	Refresh modules preferences repository...
18:20:03 - 	Refresh providers preferences repository...
18:20:03 - 	Reload profiles required features...
18:20:03 - Required features: [:]
18:20:03 - Config (GitHub): fetching bundle from https://passepartoutvpn.app/config/v1/bundle.json
18:20:03 - Application did enter foreground
18:20:03 - System Extension: load current status...
18:20:03 - System Extension: load result is needsApproval
18:20:03 - Config: active flags = [newPaywall, tvWebImport, allowsRelaxedVerification]
18:20:03 - Current step: doneV3_2_3
18:20:03 - Next step: doneV3_2_3
18:20:10 - Save profile 2607B039-692D-4819-9A75-C105553DC5C1...
18:20:10 - Encoded profile:
18:20:10 - 	ID: 2607B039-692D-4819-9A75-C105553DC5C1
18:20:10 - 	Name: MB-WG-to-Sense.conf
18:20:10 - 	Modules:
18:20:10 - 		+ WireGuardModule: {"id":"ADFE6E73-F905-4CF7-9A1B-D53CC756093A","configuration":{"peers":[{"endpoint":"<redacted>:57453","allowedIPs":["<redacted>\/0","<redacted>\/0"],"publicKey":"<redacted>"}],"interface":{"privateKey":"<redacted>","dns":{"protocolType":{"cleartext":{}},"servers":[],"searchDomains":[],"id":"6F190B80-0113-4FE7-8700-B3D296144D3C"},"addresses":["<redacted>\/128","<redacted>\/32"]}}}
18:20:10 - 		+ OnDemandModule: {"withOtherNetworks":[],"withSSIDs":{},"id":"161C3CE9-AF5A-4475-BCB8-964A520ADE01","policy":"any"}
18:20:10 - On-demand rules:
18:20:10 - 
    action = connect
    interfaceTypeMatch = any
18:20:12 - Application did enter foreground
18:20:12 - System Extension: load current status...
18:20:12 - System Extension: load result is needsApproval
18:20:12 - Finished saving profile 2607B039-692D-4819-9A75-C105553DC5C1
18:20:12 - Application did save profile (2607B039-692D-4819-9A75-C105553DC5C1)
18:20:12 - Decoded 1 managers to 1 profiles in 0.00048601627349853516 seconds
18:20:12 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:12 - Filter profiles with '' (1): ["MB-WG-to-Sense.conf"]
18:20:12 - Decoded 1 managers to 1 profiles in 8.797645568847656e-05 seconds
18:20:12 - Required features: [:]
18:20:12 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:12 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:12 - Filter profiles with '' (1): ["MB-WG-to-Sense.conf"]
18:20:12 - Required features: [:]
18:20:12 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:15 - Connect to profile 2607B039-692D-4819-9A75-C105553DC5C1...
18:20:15 - System Extension: install...
18:20:15 - System Extension: installation error: systemExtension(CommonUtils.SystemExtensionManager.Result.needsApproval)
18:20:15 - Install profile 2607B039-692D-4819-9A75-C105553DC5C1...
18:20:15 - Encoded profile:
18:20:15 - 	ID: 2607B039-692D-4819-9A75-C105553DC5C1
18:20:15 - 	Name: MB-WG-to-Sense.conf
18:20:15 - 	Modules:
18:20:15 - 		+ WireGuardModule: {"id":"ADFE6E73-F905-4CF7-9A1B-D53CC756093A","configuration":{"interface":{"addresses":["<redacted>\/128","<redacted>\/32"],"dns":{"servers":[],"id":"6F190B80-0113-4FE7-8700-B3D296144D3C","protocolType":{"cleartext":{}},"searchDomains":[]},"privateKey":"<redacted>"},"peers":[{"allowedIPs":["<redacted>\/0","<redacted>\/0"],"endpoint":"<redacted>:57453","publicKey":"<redacted>"}]}}
18:20:15 - 		+ OnDemandModule: {"policy":"any","id":"161C3CE9-AF5A-4475-BCB8-964A520ADE01","withSSIDs":{},"withOtherNetworks":[]}
18:20:15 - On-demand rules:
18:20:15 - 
    action = connect
    interfaceTypeMatch = any
18:20:15 - Active profiles: [{2607B039-692D-4819-9A75-C105553DC5C1, status=activating, onDemand=true}]
18:20:15 - Decoded 1 managers to 1 profiles in 0.00016498565673828125 seconds
18:20:15 - Decoded 1 managers to 1 profiles in 6.80685043334961e-05 seconds
18:20:15 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:15 - Filter profiles with '' (1): ["MB-WG-to-Sense.conf"]
18:20:15 - Decoded 1 managers to 1 profiles in 5.996227264404297e-05 seconds
18:20:15 - Required features: [:]
18:20:15 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:15 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:15 - Filter profiles with '' (1): ["MB-WG-to-Sense.conf"]
18:20:15 - Required features: [:]
18:20:15 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:15 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:15 - Filter profiles with '' (1): ["MB-WG-to-Sense.conf"]
18:20:15 - Required features: [:]
18:20:15 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:15 - Decoded 1 managers to 1 profiles in 0.00013399124145507812 seconds
18:20:15 - Active profiles: [{2607B039-692D-4819-9A75-C105553DC5C1, status=inactive, onDemand=true}]
18:20:15 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:15 - Filter profiles with '' (1): ["MB-WG-to-Sense.conf"]
18:20:15 - Required features: [:]
18:20:15 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:17 - Disconnect...
18:20:17 - Disconnect profile 2607B039-692D-4819-9A75-C105553DC5C1...
18:20:17 - Active profiles: []
18:20:17 - Decoded 1 managers to 1 profiles in 0.00016808509826660156 seconds
18:20:17 - Decoded 1 managers to 1 profiles in 6.794929504394531e-05 seconds
18:20:17 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:17 - Filter profiles with '' (1): ["MB-WG-to-Sense.conf"]
18:20:17 - Required features: [:]
18:20:17 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:17 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:17 - Filter profiles with '' (1): ["MB-WG-to-Sense.conf"]
18:20:17 - Required features: [:]
18:20:17 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:27 - Save profile 2607B039-692D-4819-9A75-C105553DC5C1...
18:20:27 - Encoded profile:
18:20:27 - 	ID: 2607B039-692D-4819-9A75-C105553DC5C1
18:20:27 - 	Name: Sense
18:20:27 - 	Modules:
18:20:27 - 		+ WireGuardModule: {"id":"ADFE6E73-F905-4CF7-9A1B-D53CC756093A","configuration":{"peers":[{"endpoint":"<redacted>:57453","publicKey":"<redacted>","allowedIPs":["<redacted>\/0","<redacted>\/0"]}],"interface":{"dns":{"protocolType":{"cleartext":{}},"servers":[],"searchDomains":[],"id":"6F190B80-0113-4FE7-8700-B3D296144D3C"},"privateKey":"<redacted>","addresses":["<redacted>\/128","<redacted>\/32"]}}}
18:20:27 - 		+ OnDemandModule: {"withSSIDs":{},"withOtherNetworks":[],"id":"161C3CE9-AF5A-4475-BCB8-964A520ADE01","policy":"any"}
18:20:27 - On-demand rules:
18:20:27 - 
    action = connect
    interfaceTypeMatch = any
18:20:27 - Finished saving profile 2607B039-692D-4819-9A75-C105553DC5C1
18:20:27 - Application did save profile (2607B039-692D-4819-9A75-C105553DC5C1)
18:20:27 - Decoded 1 managers to 1 profiles in 0.00021708011627197266 seconds
18:20:27 - Decoded 1 managers to 1 profiles in 0.00010395050048828125 seconds
18:20:27 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:27 - Filter profiles with '' (1): ["Sense"]
18:20:27 - Required features: [:]
18:20:27 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:27 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:27 - Filter profiles with '' (1): ["Sense"]
18:20:27 - Required features: [:]
18:20:27 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:20:27 - Current step: doneV3_2_3
18:20:27 - Next step: doneV3_2_3
18:23:18 - Application did enter foreground
18:23:18 - System Extension: load current status...
18:23:18 - System Extension: load result is needsApproval
18:23:20 - Connect to profile 2607B039-692D-4819-9A75-C105553DC5C1...
18:23:20 - System Extension: install...
18:23:20 - System Extension: installation error: systemExtension(CommonUtils.SystemExtensionManager.Result.needsApproval)
18:23:20 - Install profile 2607B039-692D-4819-9A75-C105553DC5C1...
18:23:20 - Encoded profile:
18:23:20 - 	ID: 2607B039-692D-4819-9A75-C105553DC5C1
18:23:20 - 	Name: Sense
18:23:20 - 	Modules:
18:23:20 - 		+ WireGuardModule: {"id":"ADFE6E73-F905-4CF7-9A1B-D53CC756093A","configuration":{"interface":{"addresses":["<redacted>\/128","<redacted>\/32"],"dns":{"protocolType":{"cleartext":{}},"servers":[],"id":"6F190B80-0113-4FE7-8700-B3D296144D3C","searchDomains":[]},"privateKey":"<redacted>"},"peers":[{"publicKey":"<redacted>","endpoint":"<redacted>:57453","allowedIPs":["<redacted>\/0","<redacted>\/0"]}]}}
18:23:20 - 		+ OnDemandModule: {"withSSIDs":{},"withOtherNetworks":[],"id":"161C3CE9-AF5A-4475-BCB8-964A520ADE01","policy":"any"}
18:23:20 - On-demand rules:
18:23:20 - 
    action = connect
    interfaceTypeMatch = any
18:23:20 - Active profiles: [{2607B039-692D-4819-9A75-C105553DC5C1, status=activating, onDemand=true}]
18:23:20 - Decoded 1 managers to 1 profiles in 0.0001590251922607422 seconds
18:23:20 - Decoded 1 managers to 1 profiles in 6.99758529663086e-05 seconds
18:23:20 - Decoded 1 managers to 1 profiles in 5.805492401123047e-05 seconds
18:23:20 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:23:20 - Filter profiles with '' (1): ["Sense"]
18:23:20 - Required features: [:]
18:23:20 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:23:20 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:23:20 - Filter profiles with '' (1): ["Sense"]
18:23:20 - Required features: [:]
18:23:20 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:23:20 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:23:20 - Filter profiles with '' (1): ["Sense"]
18:23:20 - Required features: [:]
18:23:20 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:23:20 - Active profiles: [{2607B039-692D-4819-9A75-C105553DC5C1, status=inactive, onDemand=true}]
18:23:20 - Decoded 1 managers to 1 profiles in 0.00015497207641601562 seconds
18:23:20 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:23:20 - Filter profiles with '' (1): ["Sense"]
18:23:20 - Required features: [:]
18:23:20 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:23:21 - Disconnect...
18:23:21 - Disconnect profile 2607B039-692D-4819-9A75-C105553DC5C1...
18:23:21 - Active profiles: []
18:23:21 - Decoded 1 managers to 1 profiles in 0.00021898746490478516 seconds
18:23:21 - Decoded 1 managers to 1 profiles in 6.99758529663086e-05 seconds
18:23:21 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:23:21 - Filter profiles with '' (1): ["Sense"]
18:23:21 - Required features: [:]
18:23:21 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:23:21 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:23:21 - Filter profiles with '' (1): ["Sense"]
18:23:21 - Required features: [:]
18:23:21 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:24:43 - Application did enter foreground
18:24:43 - System Extension: load current status...
18:24:43 - System Extension: load result is needsApproval
18:24:45 - Connect to profile 2607B039-692D-4819-9A75-C105553DC5C1...
18:24:45 - System Extension: install...
18:24:45 - System Extension: installation error: systemExtension(CommonUtils.SystemExtensionManager.Result.needsApproval)
18:24:45 - Install profile 2607B039-692D-4819-9A75-C105553DC5C1...
18:24:45 - Encoded profile:
18:24:45 - 	ID: 2607B039-692D-4819-9A75-C105553DC5C1
18:24:45 - 	Name: Sense
18:24:45 - 	Modules:
18:24:45 - 		+ WireGuardModule: {"id":"ADFE6E73-F905-4CF7-9A1B-D53CC756093A","configuration":{"peers":[{"allowedIPs":["<redacted>\/0","<redacted>\/0"],"endpoint":"<redacted>:57453","publicKey":"<redacted>"}],"interface":{"addresses":["<redacted>\/128","<redacted>\/32"],"dns":{"servers":[],"id":"6F190B80-0113-4FE7-8700-B3D296144D3C","protocolType":{"cleartext":{}},"searchDomains":[]},"privateKey":"<redacted>"}}}
18:24:45 - 		+ OnDemandModule: {"withSSIDs":{},"withOtherNetworks":[],"id":"161C3CE9-AF5A-4475-BCB8-964A520ADE01","policy":"any"}
18:24:45 - On-demand rules:
18:24:45 - 
    action = connect
    interfaceTypeMatch = any
18:24:45 - Active profiles: [{2607B039-692D-4819-9A75-C105553DC5C1, status=activating, onDemand=true}]
18:24:45 - Decoded 1 managers to 1 profiles in 0.0001900196075439453 seconds
18:24:45 - Decoded 1 managers to 1 profiles in 7.796287536621094e-05 seconds
18:24:45 - Decoded 1 managers to 1 profiles in 6.699562072753906e-05 seconds
18:24:45 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:24:45 - Filter profiles with '' (1): ["Sense"]
18:24:45 - Required features: [:]
18:24:45 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:24:45 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:24:45 - Filter profiles with '' (1): ["Sense"]
18:24:45 - Required features: [:]
18:24:45 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:24:45 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:24:45 - Filter profiles with '' (1): ["Sense"]
18:24:45 - Required features: [:]
18:24:45 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:24:45 - Active profiles: [{2607B039-692D-4819-9A75-C105553DC5C1, status=inactive, onDemand=true}]
18:24:45 - Decoded 1 managers to 1 profiles in 0.00016200542449951172 seconds
18:24:45 - Reload local profiles: [2607B039-692D-4819-9A75-C105553DC5C1]
18:24:45 - Filter profiles with '' (1): ["Sense"]
18:24:45 - Required features: [:]
18:24:45 - Local profiles after exclusions: [2607B039-692D-4819-9A75-C105553DC5C1]
18:24:52 - Send message to profile 2607B039-692D-4819-9A75-C105553DC5C1...

Qhilm · 2025-09-26T07:17:30Z

Qhilm
Sep 26, 2025
Author

You MUST Install from Apple App Store, I really need to remember that, second time I struggle with this.

9 replies

keeshux Sep 27, 2025
Maintainer

It's case-sensitive, skip the grep.

keeshux Sep 27, 2025
Maintainer

By the way, the expected flow with the .dmg is:

Add a profile
Connect
Alert shows with suggestion to enable the Network Extension
You go there and enable the extension
Connect again, now it will

Qhilm Sep 27, 2025
Author

It's case-sensitive, skip the grep.

the -i makes the grep case-insensitive.

keeshux Sep 27, 2025
Maintainer

My bad, I try to exclude the obvious because sometimes macOS utils differ from GNU.

Does the alert appear at all when you enable a profile?

Qhilm Sep 27, 2025
Author

sorry, I wasn't clear, the issue is resolved after I switched to the apple store version.

I still do not see any "passepartout" network extension, but VPN works fine, so I'm good. Thanks a lot for the help.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Partout

New Mac, same .conf profiles, now always "inactive (on-demand)" #1557

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 9 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Partout

New Mac, same .conf profiles, now always "inactive (on-demand)" #1557

Uh oh!

Qhilm Sep 23, 2025

Replies: 1 comment · 9 replies

Uh oh!

Qhilm Sep 26, 2025 Author

Uh oh!

keeshux Sep 27, 2025 Maintainer

Uh oh!

keeshux Sep 27, 2025 Maintainer

Uh oh!

Qhilm Sep 27, 2025 Author

Uh oh!

keeshux Sep 27, 2025 Maintainer

Uh oh!

Qhilm Sep 27, 2025 Author

Qhilm
Sep 23, 2025

Replies: 1 comment 9 replies

Qhilm
Sep 26, 2025
Author

keeshux Sep 27, 2025
Maintainer

keeshux Sep 27, 2025
Maintainer

Qhilm Sep 27, 2025
Author

keeshux Sep 27, 2025
Maintainer

Qhilm Sep 27, 2025
Author