NE SystemExtension connects to the VPN server, but traffic is blocked

I am working on OpenVPN application for Mac OS. I use openVPNAdapter to do this. Version for Mac OS store with apex works well. But we need a Developer ID signing version. To do this I created NE system extension (appex was removed from the project), changed packet-tunnel-provider with packet-tunnel-provider-systemextension, reuse the same PacketTunnelProvider code and the same openVPNAdapter (framework was embedded into the extension). Run system extension via OSSystemExtensionRequest (copied logic from SempleFirewall apple example), makes a build, and notarized it.

When I run the app, I see that SeystemExtension is running (activity monitor), PacketTunnelProvider successfully connects to the VPN server (logs and “connected” status in the macOS SystemPreferences), but traffic is locked. I can’t open any websites. First I thought that the problem with DNS, but I can't open any sites via IP too. So I think Mac OS locks socket traffic.

Maybe somebody has such an issue and knows how to resolve it.

MacOS: 11.4

Up vote post of VictorVl Down vote post of VictorVl
1.5k views
Posted by
VictorVl
Reply
Add a Comment

Replies

Hello, I also encountered the same problem as you, how did you solve it in the end?

Posted by
fffaker
Up vote reply of fffaker Down vote reply of fffaker
Add a Comment

I use openVPNAdapter to build MacOS VPN too, but print error "cannot open available utun device", Could you help me solve this error?

Posted by
flkapple
Up vote reply of flkapple Down vote reply of flkapple
Add a Comment

I cannot speak for any third party projects or SDK's in this context, but if you are able to successfully see the provider connect to the VPN server and the System Extension is running as expected then I would expect the next place(s) to look would be how the routing and DNS is setup on NEPacketTunnelNetworkSettings. If that does not turn up anything I would then check to see if you are at least able to read packets from the virtual interface via NEPacketTunnelFlow's readPacket methods.

Posted by
meaton
Up vote reply of meaton Down vote reply of meaton
Add a Comment