DNS failed when using NEPacketTunnelProvider

Question

Created Jun ’20

Replies 1

Boosts 0

Participants 2

I'm working on a vpn app using NEPacketTunnelProvider, and below is the main code for seting up the tunnel :

        let networkSettings = NEPacketTunnelNetworkSettings(tunnelRemoteAddress: "1.1.1.1")
        networkSettings.mtu = 1500
       
        let ipv4Settings = NEIPv4Settings(addresses: ["192.169.88.1"], subnetMasks: ["255.255.255.0"])
        let includeRoutes: Array<NEIPv4Route> =  [NEIPv4Route.default()]
        let excludeRoutes: Array<NEIPv4Route> = [
            NEIPv4Route(destinationAddress: "8.8.8.8", subnetMask: "255.255.255.0"),
            NEIPv4Route(destinationAddress: "4.4.4.4", subnetMask: "255.255.255.0"),
        ]
       
        ipv4Settings.includedRoutes = includeRoutes
        ipv4Settings.excludedRoutes = excludeRoutes
        networkSettings.ipv4Settings = ipv4Settings
       
        let DNSSettings = NEDNSSettings(servers: ["8.8.8.8", "4.4.4.4"])
        DNSSettings.matchDomains = [""]
        networkSettings.dnsSettings = DNSSettings
       
        self.setTunnelNetworkSettings(networkSettings) {error in
            completion(error)
        }

Packets are routing to a socks server on my laptop, the socks server is working properly because another app from appstore works fine on it.

Now the problem is, any browsing via url(like www.google.com) will failed but via the ip directly works fine, it seem like dns is not working. And it is the same after dropping the excludeRoutes

        let excludeRoutes: Array<NEIPv4Route> = [
            NEIPv4Route(destinationAddress: "8.8.8.8", subnetMask: "255.255.255.0"),
            NEIPv4Route(destinationAddress: "4.4.4.4", subnetMask: "255.255.255.0"),
        ]

Have you ever met this problem or heard something relating to problems like this? Or could you please give me some possible clues for digging in?

Boost

Answer 1

Systems Engineer OP

Apple

Jun ’20

Try debugging your routes. Try setting up a NEIPv4Route that should capture a wide traffic that includes 8.8.8.8 and try removing your excluded routes to open this up when debugging. Remember too if you need to match a specific search domain for DNS to ensure that it's captured in matchDomains and the matchDomainsNoSearch is set to true.

For example:

dnsSettings.matchDomains = ["google.com"]
dnsSettings.matchDomainsNoSearch = true

Matt Eaton

DTS Engineering, CoreOS

meaton3 at apple.com

0