We create custom VPN tunnel by overriding PacketTunnelProvider on MacOS. Normal VPN connection works seamlessly. But if we enable onDemand rules on VPN manager, intemittently during tunnel creation via OnDemand, internet goes away on machine leading to a connection stuck state.
Why does internet goes away during tunnel creation?
OK. In that case I don’t see any way to make this work )-:
When you set an on-demand rule, connections that match that rule are held until the demand is satisfied. This makes sense when you think about the intended use case for on-demand rules, namely, a split VPN. Typically this pans out as follows:
- There’s a site that’s only available on the organisation’s intranet.
- The device manager deploys an on-demand VPN configuration to access that intranet.
- The user runs an app that connects to that site.
- The system treats that as demand and starts the VPN connection.
- And holds the app’s connection until the VPN connection is established.
- Once that’s done, it releases the app’s connection, which then connects to the site over the VPN.
This yields an obvious chicken’n’problem when the VPN provider relies on a connection that also matches the on-demand rule. The system can avoid this problems if the provider does it directly, from within its own process. This is the same sort of logic that NECP uses to avoid VPN loops. But if the provider’s connection somehow depends on some other unrelated process, tracking that dependency is hard and AFAIK there’s no facility within the system to do it.
You could file a bug about this, requesting that we tweak the system to understanding this dependency. However, that’s unlikely to be an easy fix.
Note If you do file a bug:
- Enabled relevant debugging on a test machine (definitely VPN (Network Extension) but I think that Single Sign-On also makes sense).
- Attach a sysdiagnose log taken from a machine in this stuck state.
- Please post your bug number, just for the record.
As to what you can do about this right now, you need to find a way to break this dependency loop. For example:
- You might limit the scope of your on-demand rules.
- Or change how you authenticate these requests.
- One switch to per-app VPN, targeting a specific list of apps that doesn’t include your SSO app.
Just as an FYI, extremely wide on-demand VPN rules are a common source of problems. I often see them deployed when folks are trying to use a packet tunnel provider for something that isn’t VPN. TN3120 Expected use cases for Network Extension packet tunnel providers has a general discussion of that issue.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"