Or is it somehow the expected behavior?
Probably this.
Matt and I chatted about your question recently and we came up with scenario we’d like to outline. Imagine you’re volunteering as a sysadmin for the Waffle Varnish Cooperative™, who has a public web site
www.waffle-varnish.org
and a CRM system at
crm.waffle-varnish.org
. The latter is only available to staff over a VPN. You want to set up VPN On Demand so that when a staff member enters
crm.waffle-varnish.org
into a browser, it starts the VPN. In this case, the browser’s outgoing connection must be placed on hold until the VPN comes up. If not, the browser will fail to connect because
crm.waffle-varnish.org
isn’t available on the public Internet. The user will have to manually retry. This is clearly suboptimal.
Now think about what happens if you set up VPN On Demand too ‘wide’, for example, to cover all of
waffle-varnish.org
. Now the staff member’s connections to the public web site will be held up waiting for VPN On Demand, even though that’s not necessary.
Now, if VPN On Demand is holding up unrelated connections, that would definitely be bugworthy. But if it’s holding up connections that match the on demand rules, that’s the correct behaviour.
Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware
let myEmail = "eskimo" + "1" + "@apple.com"
