2

I have a Mac user (macOS Catalina, 10.15.7) that can connect to our AWS Client VPN but loses wider internet access when they do so. The user is not technical, remote and I am not a Mac user and have no Mac to test this on.

The AWS Client VPN retains access on Windows 10 (19041) with OpenVPN Client and the AWS Client. We are using the same configuration file.

The VPN is there for protecting users when on unknown networks, so is a pass through. The user does not need access to our AWS resources.

When the VPN is active, I need all traffic to route through it. I believe the pertinent line (full log below) is:

2020-11-24 16:14:23.404 +00:00 [DBG] CM received: >LOG:1606234460,,PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route-gateway 10.0.5.33,topology subnet,ping 1,ping-restart 20,ifconfig 10.0.5.34 255.255.255.224'

This is the AWS Client VPN server telling the client that all traffic must go through the gateway (redirect-gateway def1).

The Mac has no other VPN tunnels active.

Given that the user is not technical and I can only do video screen share if they are disconnected from the VPN, what steps should I take to resolve this?

Full Connection Log

From the AWS Mac Client. Names changed to protect the innocent.

2020-11-24 16:12:46.578 +00:00 [INF] Logger initialized 2020-11-24 16:12:46.795 +00:00 [INF] Current OS Information: 2020-11-24 16:12:46.798 +00:00 [INF] Platform: "Unix" 2020-11-24 16:12:46.805 +00:00 [INF] Version String: Unix 19.6.0.0 2020-11-24 16:12:46.808 +00:00 [INF] OS description: Unix 19.6.0.0 2020-11-24 16:12:46.808 +00:00 [INF] OSX detected. 2020-11-24 16:12:47.117 +00:00 [DBG] Auto culture: en-GB Auto UI culture: en-GB 2020-11-24 16:12:47.286 +00:00 [DBG] openVpnExePath: /Applications/AWS VPN Client/AWS VPN Client.app/Contents/Resources/openvpn/acvc-openvpn 2020-11-24 16:12:47.286 +00:00 [DBG] helperToolExePath: /Applications/AWS VPN Client/AWS VPN Client.app/Contents/Resources/AWS VPN Client/Contents/MacOS/ACVCHelperTool 2020-11-24 16:12:47.293 +00:00 [INF] No existing profile store. Create an empty one in /Users/username/.config/AWSVPNClient/ConnectionProfiles 2020-11-24 16:12:47.315 +00:00 [INF] Saving profile store to /Users/username/.config/AWSVPNClient/ConnectionProfiles 2020-11-24 16:12:47.639 +00:00 [DBG] macOS viewDidLoad 2020-11-24 16:12:48.452 +00:00 [DBG] Current metadata schema version is 1, which is less or equal to current supported version: 1. 2020-11-24 16:14:09.349 +00:00 [INF] Adding profile with name: XXX London, OpenVPN config file: /Users/username/Downloads/Open VPN Configuration File (1).ovpn 2020-11-24 16:14:09.359 +00:00 [INF] Validating OpenVPN config /Users/username/Downloads/Open VPN Configuration File (1).ovpn 2020-11-24 16:14:09.361 +00:00 [INF] File size of /Users/username/Downloads/Open VPN Configuration File (1).ovpn: 4564 bytes 2020-11-24 16:14:09.362 +00:00 [INF] Validating schema for OpenVPN config: /Users/username/Downloads/Open VPN Configuration File (1).ovpn 2020-11-24 16:14:09.386 +00:00 [INF] Successfully validated /Users/username/Downloads/Open VPN Configuration File (1).ovpn 2020-11-24 16:14:09.387 +00:00 [INF] Copying OpenVPN config to application local with name: XXX London, from source: /Users/username/Downloads/Open VPN Configuration File (1).ovpn 2020-11-24 16:14:09.394 +00:00 [INF] For OpenVPN config: /Users/username/Downloads/Open VPN Configuration File (1).ovpn, CvpnEndpointId: cvpn-endpoint-061a750f73ce6c477, CvpnEndpointRegion: eu-west-2 2020-11-24 16:14:09.400 +00:00 [INF] Saving profile store to /Users/username/.config/AWSVPNClient/ConnectionProfiles 2020-11-24 16:14:15.202 +00:00 [INF] Saving profile store to /Users/username/.config/AWSVPNClient/ConnectionProfiles 2020-11-24 16:14:15.211 +00:00 [INF] Connecting /Users/username/.config/AWSVPNClient/OpenVpnConfigs/XXX London 2020-11-24 16:14:15.219 +00:00 [DBG] validationString: /Users/username/.config/AWSVPNClient/OpenVpnConfigs/XXX London 1606234465 2020-11-24 16:14:15.418 +00:00 [INF] Starting OpenVpn process 2020-11-24 16:14:15.421 +00:00 [DBG] Starting process 2020-11-24 16:14:15.453 +00:00 [DBG] Start to read process output 2020-11-24 16:14:18.826 +00:00 [DBG] End reading process output 2020-11-24 16:14:18.884 +00:00 [DBG] Helper app --init output: Kill success. 2020-11-24 16:14:18.884 +00:00 [DBG] Connecting using command /Applications/AWS VPN Client/AWS VPN Client.app/Contents/Resources/AWS VPN Client/Contents/MacOS/ACVCHelperTool --start -c "/Users/username/.config/AWSVPNClient/OpenVpnConfigs/current_connection.txt" -p "/Users/username/.config/AWSVPNClient/acvc-8096.txt" 2020-11-24 16:14:18.884 +00:00 [DBG] Starting process 2020-11-24 16:14:18.889 +00:00 [DBG] Start to read process output 2020-11-24 16:14:19.540 +00:00 [DBG] End reading process output 2020-11-24 16:14:19.594 +00:00 [DBG] Helper app --start output: Start success. 2020-11-24 16:14:19.635 +00:00 [INF] Connecting to management interface... host 127.0.0.1, port 8096 2020-11-24 16:14:19.652 +00:00 [DBG] Socket connected 2020-11-24 16:14:19.652 +00:00 [DBG] Starting to listen to management port 2020-11-24 16:14:19.656 +00:00 [DBG] Called isAliveProcess 2020-11-24 16:14:19.667 +00:00 [INF] Received bytes: 15 2020-11-24 16:14:19.668 +00:00 [DBG] Message marshalling complete 2020-11-24 16:14:19.675 +00:00 [DBG] CM received: ENTER PASSWORD: 2020-11-24 16:14:19.678 +00:00 [DBG] CM processsing: ENTER PASSWORD: 2020-11-24 16:14:19.679 +00:00 [DBG] Port needs password to connect 2020-11-24 16:14:19.680 +00:00 [DBG] Sending port password 2020-11-24 16:14:19.683 +00:00 [INF] Begin receive init again 2020-11-24 16:14:19.683 +00:00 [INF] Received bytes: 105 2020-11-24 16:14:19.684 +00:00 [DBG] Message marshalling complete 2020-11-24 16:14:19.684 +00:00 [DBG] CM received: SUCCESS: password is correct >INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info 2020-11-24 16:14:19.684 +00:00 [DBG] CM processsing: SUCCESS: password is correct 2020-11-24 16:14:19.684 +00:00 [DBG] 🥶 ONE lineSUCCESS: password is correct 2020-11-24 16:14:19.684 +00:00 [DBG] CM processsing: >INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info 2020-11-24 16:14:19.686 +00:00 [DBG] Asking for real-time state and log notifications. 2020-11-24 16:14:19.686 +00:00 [DBG] Waiting fixed time for response. 2020-11-24 16:14:19.688 +00:00 [DBG] CM processsing: 2020-11-24 16:14:19.688 +00:00 [DBG] 🥶 APPEND line 2020-11-24 16:14:19.688 +00:00 [INF] Begin receive init again 2020-11-24 16:14:19.688 +00:00 [INF] Received bytes: 134 2020-11-24 16:14:19.688 +00:00 [DBG] Message marshalling complete 2020-11-24 16:14:19.689 +00:00 [DBG] CM received: SUCCESS: real-time state notification set to ON SUCCESS: real-time log notification set to ON >LOG:1606234459,D,MANAGEMENT: CMD '' 2020-11-24 16:14:19.689 +00:00 [DBG] CM processsing: SUCCESS: real-time state notification set to ON 2020-11-24 16:14:19.689 +00:00 [DBG] Response recieved for: state on 2020-11-24 16:14:19.690 +00:00 [DBG] Assume real-time state notifications are on. Received: SUCCESS: real-time state notification set to ON 2020-11-24 16:14:19.690 +00:00 [DBG] CM processsing: SUCCESS: real-time log notification set to ON 2020-11-24 16:14:19.690 +00:00 [DBG] Response recieved for: log on 2020-11-24 16:14:19.690 +00:00 [DBG] CM processsing: >LOG:1606234459,D,MANAGEMENT: CMD '' 2020-11-24 16:14:19.692 +00:00 [DBG] CM processsing: 2020-11-24 16:14:19.693 +00:00 [DBG] 🥶 APPEND line 2020-11-24 16:14:19.693 +00:00 [INF] Begin receive init again 2020-11-24 16:14:20.811 +00:00 [INF] Received bytes: 168 2020-11-24 16:14:20.811 +00:00 [DBG] Message marshalling complete 2020-11-24 16:14:20.812 +00:00 [DBG] CM received: >LOG:1606234460,,MANAGEMENT: >STATE:1606234460,GET_CONFIG,,,,,, >STATE:1606234460,GET_CONFIG,,,,,, >LOG:1606234460,,SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) 2020-11-24 16:14:20.812 +00:00 [DBG] CM processsing: >LOG:1606234460,,MANAGEMENT: >STATE:1606234460,GET_CONFIG,,,,,, 2020-11-24 16:14:20.812 +00:00 [DBG] CM received state: >LOG:1606234460,,MANAGEMENT: >STATE:1606234460,GET_CONFIG,,,,,, 2020-11-24 16:14:20.813 +00:00 [DBG] CM processsing: >STATE:1606234460,GET_CONFIG,,,,,, 2020-11-24 16:14:20.813 +00:00 [DBG] CM received state: >STATE:1606234460,GET_CONFIG,,,,,, 2020-11-24 16:14:20.813 +00:00 [DBG] CM processsing: >LOG:1606234460,,SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) 2020-11-24 16:14:20.813 +00:00 [DBG] CM processsing: 2020-11-24 16:14:20.813 +00:00 [DBG] 🥶 APPEND line 2020-11-24 16:14:20.813 +00:00 [INF] Begin receive init again 2020-11-24 16:14:23.404 +00:00 [INF] Received bytes: 1978 2020-11-24 16:14:23.404 +00:00 [DBG] Message marshalling complete 2020-11-24 16:14:23.404 +00:00 [DBG] CM received: >LOG:1606234460,,PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route-gateway 10.0.5.33,topology subnet,ping 1,ping-restart 20,ifconfig 10.0.5.34 255.255.255.224' >LOG:1606234460,,OPTIONS IMPORT: timers and/or timeouts modified >LOG:1606234460,,OPTIONS IMPORT: --ifconfig/up options modified >LOG:1606234460,,OPTIONS IMPORT: route options modified >LOG:1606234460,,OPTIONS IMPORT: route-related options modified >LOG:1606234460,,Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key >LOG:1606234460,,Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key >LOG:1606234460,,ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=en0 HWADDR=d4:61:9d:2c:1b:d8 >LOG:1606234460,,Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16) >LOG:1606234460,,Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16) >LOG:1606234460,I,Opened utun device utun2 >LOG:1606234460,D,do_ifconfig, tt->did_ifconfig_ipv6_setup=0 >LOG:1606234460,,MANAGEMENT: >STATE:1606234460,ASSIGN_IP,,10.0.5.34,,,, >STATE:1606234460,ASSIGN_IP,,10.0.5.34,,,, >LOG:1606234460,I,/sbin/ifconfig utun2 delete >LOG:1606234460,I,NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure >LOG:1606234460,I,/sbin/ifconfig utun2 10.0.5.34 10.0.5.34 netmask 255.255.255.224 mtu 1500 up >LOG:1606234460,,/sbin/route add -net 10.0.5.32 10.0.5.34 255.255.255.224 >LOG:1606234460,I,/Applications/AWS VPN Client/AWS VPN Client.app/Contents/Resources/openvpn/client.up -o -f utun2 1500 1549 10.0.5.34 255.255.255.224 init >LOG:1606234463,,/sbin/route add -net 18.134.186.180 192.168.0.1 255.255.255.255 >LOG:1606234463,,/sbin/route add -net 0.0.0.0 10.0.5.33 128.0.0.0 >LOG:1606234463,,/sbin/route add -net 128.0.0.0 10.0.5.33 128.0.0.0 >LOG:1606234463,W,WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this >LOG:1606234463,I,Initialization Sequence Completed 2020-11-24 16:14:23.404 +00:00 [DBG] CM processsing: >LOG:1606234460,,PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route-gateway 10.0.5.33,topology subnet,ping 1,ping-restart 20,ifconfig 10.0.5.34 255.255.255.224' 2020-11-24 16:14:23.405 +00:00 [DBG] CM processsing: >LOG:1606234460,,OPTIONS IMPORT: timers and/or timeouts modified 2020-11-24 16:14:23.405 +00:00 [DBG] CM processsing: >LOG:1606234460,,OPTIONS IMPORT: --ifconfig/up options modified 2020-11-24 16:14:23.405 +00:00 [DBG] CM processsing: >LOG:1606234460,,OPTIONS IMPORT: route options modified 2020-11-24 16:14:23.405 +00:00 [DBG] CM processsing: >LOG:1606234460,,OPTIONS IMPORT: route-related options modified 2020-11-24 16:14:23.405 +00:00 [DBG] CM processsing: >LOG:1606234460,,Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2020-11-24 16:14:23.405 +00:00 [DBG] CM processsing: >LOG:1606234460,,Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2020-11-24 16:14:23.405 +00:00 [DBG] CM processsing: >LOG:1606234460,,ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=en0 HWADDR=d4:61:9d:2c:1b:d8 2020-11-24 16:14:23.405 +00:00 [DBG] CM processsing: >LOG:1606234460,,Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16) 2020-11-24 16:14:23.405 +00:00 [DBG] CM processsing: >LOG:1606234460,,Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16) 2020-11-24 16:14:23.405 +00:00 [DBG] CM processsing: >LOG:1606234460,I,Opened utun device utun2 2020-11-24 16:14:23.405 +00:00 [DBG] CM processsing: >LOG:1606234460,D,do_ifconfig, tt->did_ifconfig_ipv6_setup=0 2020-11-24 16:14:23.406 +00:00 [DBG] CM processsing: >LOG:1606234460,,MANAGEMENT: >STATE:1606234460,ASSIGN_IP,,10.0.5.34,,,, 2020-11-24 16:14:23.406 +00:00 [DBG] CM received state: >LOG:1606234460,,MANAGEMENT: >STATE:1606234460,ASSIGN_IP,,10.0.5.34,,,, 2020-11-24 16:14:23.406 +00:00 [DBG] CM processsing: >STATE:1606234460,ASSIGN_IP,,10.0.5.34,,,, 2020-11-24 16:14:23.406 +00:00 [DBG] CM received state: >STATE:1606234460,ASSIGN_IP,,10.0.5.34,,,, 2020-11-24 16:14:23.406 +00:00 [DBG] CM processsing: >LOG:1606234460,I,/sbin/ifconfig utun2 delete 2020-11-24 16:14:23.406 +00:00 [DBG] CM processsing: >LOG:1606234460,I,NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure 2020-11-24 16:14:23.406 +00:00 [DBG] CM processsing: >LOG:1606234460,I,/sbin/ifconfig utun2 10.0.5.34 10.0.5.34 netmask 255.255.255.224 mtu 1500 up 2020-11-24 16:14:23.406 +00:00 [DBG] CM processsing: >LOG:1606234460,,/sbin/route add -net 10.0.5.32 10.0.5.34 255.255.255.224 2020-11-24 16:14:23.406 +00:00 [DBG] CM processsing: >LOG:1606234460,I,/Applications/AWS VPN Client/AWS VPN Client.app/Contents/Resources/openvpn/client.up -o -f utun2 1500 1549 10.0.5.34 255.255.255.224 init 2020-11-24 16:14:23.406 +00:00 [DBG] CM processsing: >LOG:1606234463,,/sbin/route add -net 18.134.186.180 192.168.0.1 255.255.255.255 2020-11-24 16:14:23.406 +00:00 [DBG] CM processsing: >LOG:1606234463,,/sbin/route add -net 0.0.0.0 10.0.5.33 128.0.0.0 2020-11-24 16:14:23.406 +00:00 [DBG] CM processsing: >LOG:1606234463,,/sbin/route add -net 128.0.0.0 10.0.5.33 128.0.0.0 2020-11-24 16:14:23.406 +00:00 [DBG] CM processsing: >LOG:1606234463,W,WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this 2020-11-24 16:14:23.407 +00:00 [DBG] CM processsing: >LOG:1606234463,I,Initialization Sequence Completed 2020-11-24 16:14:23.407 +00:00 [DBG] CM processsing: 2020-11-24 16:14:23.407 +00:00 [DBG] 🥶 APPEND line 2020-11-24 16:14:23.407 +00:00 [INF] Begin receive init again 2020-11-24 16:14:23.407 +00:00 [INF] Received bytes: 165 2020-11-24 16:14:23.407 +00:00 [DBG] Message marshalling complete 2020-11-24 16:14:23.407 +00:00 [DBG] CM received: >LOG:1606234463,,MANAGEMENT: >STATE:1606234463,CONNECTED,SUCCESS,10.0.5.34,18.134.186.180,443,, >STATE:1606234463,CONNECTED,SUCCESS,10.0.5.34,18.134.186.180,443,, 2020-11-24 16:14:23.407 +00:00 [DBG] CM processsing: >LOG:1606234463,,MANAGEMENT: >STATE:1606234463,CONNECTED,SUCCESS,10.0.5.34,18.134.186.180,443,, 2020-11-24 16:14:23.407 +00:00 [DBG] CM received state: >LOG:1606234463,,MANAGEMENT: >STATE:1606234463,CONNECTED,SUCCESS,10.0.5.34,18.134.186.180,443,, 2020-11-24 16:14:23.408 +00:00 [DBG] Management port password authenticated. 2020-11-24 16:14:23.410 +00:00 [DBG] CM processsing: >STATE:1606234463,CONNECTED,SUCCESS,10.0.5.34,18.134.186.180,443,, 2020-11-24 16:14:23.410 +00:00 [DBG] CM received state: >STATE:1606234463,CONNECTED,SUCCESS,10.0.5.34,18.134.186.180,443,, 2020-11-24 16:14:23.414 +00:00 [DBG] Management port password authenticated. 2020-11-24 16:14:23.414 +00:00 [DBG] Destroyed management port password file on authentication. 2020-11-24 16:14:23.414 +00:00 [DBG] CM processsing: 2020-11-24 16:14:23.414 +00:00 [DBG] 🥶 APPEND line 2020-11-24 16:14:23.414 +00:00 [INF] Begin receive init again 2020-11-24 16:14:33.934 +00:00 [DBG] 🏞 BeginConnectionDetails 2020-11-24 16:14:33.945 +00:00 [INF] Received bytes: 222 2020-11-24 16:14:33.945 +00:00 [DBG] Message marshalling complete 2020-11-24 16:14:33.948 +00:00 [DBG] CM received: >LOG:1606234473,D,MANAGEMENT: CMD 'status' OpenVPN STATISTICS Updated,Tue Nov 24 16:14:33 2020 TUN/TAP read bytes,588 TUN/TAP write bytes,0 TCP/UDP read bytes,3601 TCP/UDP write bytes,4061 Auth read bytes,176 END

Edit 1 - Routing Tables

Connected Via OpenVPN Connect via Starbucks Wifi

No internet connection.

Internet: Destination Gateway Flags Netif Expire 0/1 10.0.4.33 UGSc utun2 default 192.168.99.1 UGSc en0 10.0.4.32/27 10.0.4.35 UGSc utun2 10.0.4.33 10.0.4.35 UHr utun2 18.135.71.242/32 192.168.99.1 UGSc en0 127 127.0.0.1 UCS lo0 127.0.0.1 127.0.0.1 UH lo0 128.0/1 10.0.4.33 UGSc utun2 169.254 link#4 UCS en0 ! 192.168.99 link#4 UCS en0 ! 192.168.99.1/32 link#4 UCS en0 ! 192.168.99.1 c:8d:db:1a:34:8 UHLWIir en0 1196 192.168.99.235/32 link#4 UCS en0 ! 192.168.99.255 ff:ff:ff:ff:ff:ff UHLWbI en0 ! 224.0.0/4 link#4 UmCS en0 ! 224.0.0.251 1:0:5e:0:0:fb UHmLWI en0 239.255.255.250 1:0:5e:7f:ff:fa UHmLWI en0 255.255.255.255/32 link#4 UCS en0 ! 255.255.255.255 ff:ff:ff:ff:ff:ff UHLWbI en0 ! Internet6: Destination Gateway Flags Netif Expire default fe80::%utun0 UGcI utun0 default fe80::%utun1 UGcI utun1 ::1 ::1 UHL lo0 fe80::%lo0/64 fe80::1%lo0 UcI lo0 fe80::1%lo0 link#1 UHLI lo0 fe80::%en0/64 link#4 UCI en0 fe80::1c8a:3291:7867:e3d3%en0 d4:61:9d:2c:1b:d8 UHLI lo0 fe80::%awdl0/64 link#8 UCI awdl0 fe80::c4eb:e3ff:fe52:cd45%awdl0 c6:eb:e3:52:cd:45 UHLI lo0 fe80::%llw0/64 link#9 UCI llw0 fe80::c4eb:e3ff:fe52:cd45%llw0 c6:eb:e3:52:cd:45 UHLI lo0 fe80::%utun0/64 fe80::9ef:48ff:d4a1:367d%utun0 UcI utun0 fe80::9ef:48ff:d4a1:367d%utun0 link#10 UHLI lo0 fe80::%utun1/64 fe80::425f:be76:db08:d4c%utun1 UcI utun1 fe80::425f:be76:db08:d4c%utun1 link#11 UHLI lo0 ff01::%lo0/32 ::1 UmCI lo0 ff01::%en0/32 link#4 UmCI en0 ff01::%awdl0/32 link#8 UmCI awdl0 ff01::%llw0/32 link#9 UmCI llw0 ff01::%utun0/32 fe80::9ef:48ff:d4a1:367d%utun0 UmCI utun0 ff01::%utun1/32 fe80::425f:be76:db08:d4c%utun1 UmCI utun1 ff02::%lo0/32 ::1 UmCI lo0 ff02::%en0/32 link#4 UmCI en0 ff02::%awdl0/32 link#8 UmCI awdl0 ff02::%llw0/32 link#9 UmCI llw0 ff02::%utun0/32 fe80::9ef:48ff:d4a1:367d%utun0 UmCI utun0 ff02::%utun1/32 fe80::425f:be76:db08:d4c%utun1 UmCI utun1

Edit 2 - Removing IPv6 via Config

AWS Client VPN does not support IPv6 (although not explicitly, you won't find it in any documentation). I cannot get the remote user to mess with routing tables or switch it off because they are not technical and I need to roll out the VPN to other users.

I added the following lines to the config to filter out the IPv6 traffic. The route tables above looked the same.

pull-filter ignore "ifconfig-ipv6 " pull-filter ignore "route-ipv6 "
Improve this question
4
  • Have you tried editing /etc/hosts and adding the gateway manually? It's supposed to work regardless, but I had a similar problem (different VPN) that I solved by adding routes to the host file. Commented Dec 1, 2020 at 19:54
  • What's your user's routing table look like? Try netstat -nr in terminal to display it. Commented Dec 2, 2020 at 5:52
  • @DavidWatson thanks for the feedback - my user is not technical and I am not a Mac user, I cannot ask them to perform host updates over the phone. Commented Dec 8, 2020 at 11:55
  • @mforsetti Thank you, I managed to get the route table when the VPN is connected but there is no gateway access ⬆ Commented Dec 8, 2020 at 11:55

2 Answers 2

Reset to default
3

I had the same issue. Changing IPv6 from automatic to link local only or disabling IPv6 on my LAN resolved this for me. Win10 didn't have an issue as IPv6 was disabled. mforsetti's idea to look at the routing table helped me see that IPv6 was the culprit in my case

Improve this answer
2
  • Welcome to SE! Thank you, that's helpful but these are not instructions I can follow, nor can I explain them down a phone to a remote user, so it doesn't answer my question. Commented Dec 8, 2020 at 11:39
  • 1
    @DrRobLang this is easy to google. In summary, click open the network window, click advanced for the appropriate network, tcp/ip tab on top, then configure IPv6 dropdown to Link-local only on Monterey (and probably most others). Commented Oct 27, 2022 at 19:58
0

Check your dns requests. The user without internet should have access to ping googles nameservers for example (8.8.8.8) but resolving the google.com dns name should fail (dig google.com).

If this is true you need to go into your AWS vpn client endpoints and allow the users access (via an authorization rule) to the subnet IP addresses the endpoint drops them into so that their host machines can use that subnets DNS server. If you don't want to do this then you will have to have the MAC users reconfigure their devices to point to the nameservers they actually want.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.