Tunnelblick Connect at Login or at Boot: Pick One

The setting says connect automatically, and what happens after it is applied depends entirely on which of the two modes was chosen. One starts the tunnel when you sign in to the Mac; the other starts it when the computer boots, with no user session at all. The second needs credentials that exist before anyone can type a password, which is why it often ends with a connection that never comes up. Neither mode is a policy that stops traffic before the tunnel exists.

Decide which event the connection should follow before choosing the option, because the requirements flow entirely from that answer.

Two Options, Two Different Sessions

Tunnelblick's automatic connection setting offers a login-time mode and a computer-start mode, and they are not interchangeable labels. The first runs inside a user session, with that user's keychain and the ability to prompt. The second runs without the interface and without that session, so a dialog has nobody to appear to. Everything else that differs, including which configurations are eligible, follows from that split.

A working private profile on the desktop is therefore not automatically a candidate for computer start.

What Login-Time Starting Gets You

Starting with the session preserves the normal interactive context. The app can request whatever the profile needs, whether that is an account password, a key passphrase or an MFA prompt, and the user is present to answer. Tunnelblick also documents relaunching at login when it was running at logout, which is a related but separate behaviour worth confirming for the installed version. Opening the app and establishing a usable tunnel are two events, and only the second one matters to the resource you want to reach.

Test it by logging out and back in, then check the private resource rather than the icon. An icon in the menu bar proves the app launched; a successful request proves the tunnel works.

What Computer Start Actually Requires

Computer start runs OpenVPN without the Tunnelblick interface and without a logged-in user, so no user keychain is available and no prompt can appear. The option requires a shared configuration eligible for this mode, and authentication has to work unattended: a key without a passphrase, or another supported arrangement the VPN owner has approved. Removing protection from a key or storing an MFA code in a file so that a greyed-out control becomes selectable is not configuration, it is a downgrade.

A computer-start connection can also outlive the app and the user session. Plan how an administrator observes and stops it, instead of assuming that quitting Tunnelblick ends the tunnel.

Neither One Blocks Traffic

Earlier startup is not a network-blocking policy. The underlying network has to exist before OpenVPN can connect, and meanwhile other applications can use it freely. If the requirement is that nothing leaves before the tunnel is up, that is a separate enforcement design with its own verification, not a checkbox in the VPN client. macOS on-demand rules and a firewall solve different parts of that problem.

Write the requirement as a sentence before touching the setting: this Mac must have the tunnel from login onward, from boot, or only while a specific application runs. Then check which modes the installed version actually supports.

The symptom that started this is usually a tunnel that never came up. The answer is almost always the session model, not the profile.