Level 1

36 points

VPN / DNS Issues With macOS Ventura

After upgrading MacBook Air M1 to Ventura I noticed that several of our internal business sites, RDP connections and Network SMB folders which require a VPN to access would not resolve, even after a successful VPN connection. and would only work via their respective IP addresses

Usual troubleshooting including...

Home router reboots
Mac reboots
Re-creating VPN connection
Different browsers
Different VPN account
macOS DNS cache clear
Switching to a mobile data (tethered) connection and then connecting to the vpn did not resolve

In desperation had to resort to manually editing the HOSTS file

sudo nano /etc/hosts

... which allowed the respective sites, folders and connections to resolve.

It's clear that Apple devs have broken DNS networking stuff which worked in Monterey and before.

Users should not have to manually edit the macOS HOSTS file to use DNS names whilst connected to a VPN in Ventura

MacBook Air 13″, macOS 13.0

Posted on Oct 26, 2022 5:48 PM

Top-ranking reply

leon_is_awesome

Level 1

8 points

Posted on Apr 6, 2023 4:43 PM

Hi,

I have been having this problem also but I just solved it. I actually only joined to post the solution

Indeed the /etc/resolv.conf is over-written props to the user who pointed that out on page 3). For me it was overwritten with an internal 10.x address so obviously DNS was failing.

What is causing the overwrite is after upgrading apple turns on by default limit ip tracking.

01) Go to settings

02) Go to networks

03) Click details next to the network name In my case my wireless

04) Turn off limit ip tracking

05) Try your vpn again

That one thing fixed the automatic overwriting of the conf file.

I work in cloud security arch and while I am a big believer in secure defaults it is obnoxious to roll something like that out breaking people's vpns without some kind of warning.

Good luck to everyone!

View in context

Similar questions

89 replies

Jan 25, 2023 10:41 AM in response to hamacardo

I just tried upgrade to 13.2 Ventura. Sadly, no improvement at all - standard tooling still doesn't resolve addresses from the internal DNS (despite nslookup returning correct IPs).

Mar 2, 2023 7:59 AM in response to StockerRumbles

Aha, interesting! Let me know how it goes. I can at least say that there is no problem like this with Jamf and Monterey.

vontomke

Level 1

8 points

Mar 8, 2023 1:26 AM in response to hamacardo

I'm not using JAMF and still have this issue.

Mar 21, 2023 11:41 AM in response to OverweightBatman

I'm encountering the issue in 13.2, so I don't think it has been completely fixed.

Mar 22, 2023 2:41 AM in response to owendelong

No, it's not been fixed. I'm on 13.2.1 and still facing the same issue. Even my previous workaround of overriding resolver in /etc/resolver/<domain> config stopped working.

Mar 31, 2023 6:51 AM in response to hamacardo

Just upgraded to 13.3. Issue still persists, sadly.

Very disappointed with Apple's attitude.

Mar 31, 2023 9:12 AM in response to weakcamelsm

Yes, it's sad. I'm hoping for the 13.4 release. Have an open ticket with Apple and have provided some info and also got a response back, so we'll see what goes during the beta testing...

mprush12

Level 1

8 points

Mar 31, 2023 9:22 AM in response to star-affinity

What was Apple's response? Are they aware of the issue? Did they say they were planning on addressing it?

mprush12

Level 1

8 points

Mar 31, 2023 12:45 PM in response to weakcamelsm

I spoke to Apple per our Enterprise Support Agreement, and they said they were not aware of an issue but they are looking into it now.

NickTK

Level 1

9 points

Aug 17, 2023 5:37 AM in response to hamacardo

The same problem, macOS 13.5, no one checked by chance, maybe they fixed it in Sonoma?

Dec 5, 2023 5:23 AM in response to matthias.link.77

I am still having the same issue on Sonoma.

lequi

Level 1

8 points

May 11, 2024 5:45 AM in response to NickTK

Sonoma still have this issue

Dec 16, 2022 11:35 AM in response to etresoft

On 13.1 the current workaround seems to be to not use Cloudflare 1.1.1.1/1.0.0.1 as a DNS secondary which I was doing on my home network as a backup to my single home dns server (using Cloudflare family now). This was noted as a VPN issue at the start of this thread but is not limited to vpn users, which seems to have been missed. Reddit threads were started in regards to Pi-hole use. Anyway I will endeavor to find an answer to satisfy my curiosity. I will try apple support again (got cut off last time) and I have tried wading through mDNSResponder source code but it is quite complex. Hat tip to f1r3s4l3.

daittech

Level 1

8 points

Mar 31, 2023 3:22 PM in response to mprush12

Here's a potential workaround I have found, tested on 13.3, unfortunately this wouldn't necessarily work at a public place but hopefully helps someone.

I recently discovered the bug its triggered when the DNS assigned to the interface providing internet access has a Public DNS . Meaning the interface gets a public address for its DNS via DHCP or statically . However if you have an internal DNS the problem goes away.

For example, say im at home and my ISP router gives my laptop the following DHCP settings

IP 192.168.100.101

Subnet 255.255.255.0

Gateway 192.168.100.1

DNS 75.75.75.75 <-- Public DNS

When I connect to my work VPN I will not be able to properly resolve work internal names.

nslookup will show the correct response but other applications won't including ping, trace route, safari an others.

However if your router supports DNS resolution (most do) manually change the DNS to it in my case its the same as my gateway and would look like this:

IP 192.168.100.101

Subnet 255.255.255.0

Gateway 192.168.100.1

DNS 192.168.100.1 <-- Private DNS

After the change I reconnected to my VPN and DNS resolution works over the VPN as expected for internal names.

Why in the world does OSX gets confused when using a Public DNS server is beyond me but I hope this helps someone.

We have also contacted Apple via our enterprise agreement and I am sharing my findings, hopefully the issue will get some traction.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

VPN / DNS Issues With macOS Ventura