NE SystemExtension connects to the VPN server, but traffic is blocked

Question

Created Jun ’21

Replies 3

Boosts 0

Views 1.7k

Participants 4

I am working on OpenVPN application for Mac OS. I use openVPNAdapter to do this. Version for Mac OS store with apex works well. But we need a Developer ID signing version. To do this I created NE system extension (appex was removed from the project), changed packet-tunnel-provider with packet-tunnel-provider-systemextension, reuse the same PacketTunnelProvider code and the same openVPNAdapter (framework was embedded into the extension). Run system extension via OSSystemExtensionRequest (copied logic from SempleFirewall apple example), makes a build, and notarized it.

When I run the app, I see that SeystemExtension is running (activity monitor), PacketTunnelProvider successfully connects to the VPN server (logs and “connected” status in the macOS SystemPreferences), but traffic is locked. I can’t open any websites. First I thought that the problem with DNS, but I can't open any sites via IP too. So I think Mac OS locks socket traffic.

Maybe somebody has such an issue and knows how to resolve it.

MacOS: 11.4

Boost

Answer 1

fffaker OP

Dec ’22

Hello, I also encountered the same problem as you, how did you solve it in the end?

0

Answer 2

flkapple OP

May ’23

I use openVPNAdapter to build MacOS VPN too, but print error "cannot open available utun device", Could you help me solve this error?

0

Answer 3

Systems Engineer OP

Apple

May ’23

I cannot speak for any third party projects or SDK's in this context, but if you are able to successfully see the provider connect to the VPN server and the System Extension is running as expected then I would expect the next place(s) to look would be how the routing and DNS is setup on NEPacketTunnelNetworkSettings. If that does not turn up anything I would then check to see if you are at least able to read packets from the virtual interface via NEPacketTunnelFlow's readPacket methods.

0