VPN Forced Tunneling not working on MacOS 14

Question

Created Jan ’24

Replies 7

Boosts 0

Participants 2

Hi. We setup OpenVPN protocol based VPN tunnel on MacOS using Packet Tunnel Provider / Network extension framework. We are trying to configure forced tunneling that means passing all the internet bound traffic via VPN tunnel. We configure routes on virtual tun interface:

0.0.0.0/ 0 - Works correctly.

But this setup doesn't work:

0.0.0.0/1

128.0.0.0/1

(Covers full IPv4 address range). Routes get added on the tun interface but TCP socket gets disconnected within few seconds with error: No route to host.

Both were working correctly on MacOS < 14.0.

Any pointers on this?

Boost

Answer 1

disinghal OP

Jan ’24

Route table shows routes are getting added on both tun and ethernet interface because of which traffic is not going via tunnel **0/1 192.168.29.1 UGScg en0 **
default 192.168.29.1 UGScg en0
**0/1 link#21 UCSIg utun7 **
default link#21 UCSIg utun7
10.2.0.130 10.2.0.130 UH utun7
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
**128.0/1 192.168.29.1 UGSc en0
128.0/1 link#21 UCSI utun7 **

0

Answer 2

disinghal OP

Jan ’24

With 0/0, tun interface is prioritised

Internet: Destination Gateway Flags Netif Expire default link#21 UCSg utun7
default 192.168.29.1 UGScIg en0

0

Answer 3

DTS Engineer OP

Apple

Jan ’24

0.0.0.0/0 is just a weird way of specifying the default route, that is, NEIPv4Route.default(). Consider:

let d = NEIPv4Route.default()
print(d.destinationAddress)     // 0.0.0.0
print(d.destinationSubnetMask)  // 0.0.0.0

If you want to claim the default route, use NEIPv4Route.default(). And the good news is that it sounds like that’s working as expected.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 4

disinghal OP

Jan ’24

Problem is not with 0.0.0.0/0

Problematic: 0.0.0.0/1 128.0.0.0/1 Which covers entire IPv4 address range. When these routes are being added on TUN interface, forced tunneling is not working. Traffic is not going via tun interface but via Wifi interface. Route table is attached above. It correctly shows that routes were added on tun interface

And this problem happens only on MACOS 14. Works correctly on MacOS 13

0

Answer 5

disinghal OP

Feb ’24

Apple Support Team, could you please check this issue?

0

Answer 6

disinghal OP

Feb ’24

Apple team, Could you please check this?

0

Answer 7

DTS Engineer OP

Apple

Feb ’24

Problematic: 0.0.0.0/1 128.0.0.0/1

Why are you using this approach rather than setting includeAllNetworks?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0