MacOS IPSEC VPNs and Little Snitch

[natronkeltner]

OS / Environment

MacOS, all versions up to and including Sierra.

Summary of the problem

Little Snitch is a popular host-based firewall for OSX, primarily used for egress filtering: https://www.obdev.at/products/littlesnitch/index.html

There's a known bug with OSX VPNs like IPSEC where the DNS information for a given connection isn't available to LS, which breaks all of the LS rules that rely on hostnames. More information is also discussed in this thread on the LS forums, where the LS devs are quoted:

"We are in fact aware of this issue where for some reason the LS filter does not get incoming packets (including DNS traffic) from a native IPSec VPN connection on OS X Yosemite. Unfortunately there is not much we can do from our side but we already send a bug report to Apple as this has to be fixed on their side, at least we hope that 10.10.3 will fix the issue but we will also do some further investigation."

I'm not aware of a workaround other than to silently accept or deny all connections, but am opening this ticket to document the problem in case anyone else comes searching for it. I expect a userland IPSEC VPN client would not have these same problems.

Steps to reproduce the behavior

Install LS, connect to IPSEC VPN.

Expected behavior

LS behaves.

Actual behavior

LS ignores all your rules, because they're based on hostnames which are unavailable.

[mrphs]

I wonder what is it that can be done here? I mean it's clearly an Apple issue. Unless there's something that can be done in IPSEC configs, which doesn't seem to be the case?

[jackivanov]

This issue should not be addressed to Algo

[dguido]

Little Snitch 3 is out today. Maybe it has different behavior?

https://www.obdev.at/products/littlesnitch/index.html

[dguido]

Oh darn, I misread. Never mind!

[mrphs]

I've also noticed that Little Snitch bandwidth monitor doesn't account for the traffic inside IPSEC VPN. I wonder if it's connected with this issue.

[irvingtelder]

Outgoing connections are still filtered...correct?

[Neal]

Does anyone know if this bug is fixed in macOS 10.13 High Sierra?

[xmijo]

This issue seems to have been fixed on macOS 10.13 High Sierra, using Little Snitch 4.0.3.

[pietgk]

I upgraded to the latest versions of macOS High Sierra 10.13.2 en LS 4.0.6 and in 'Silent Mode: Allow connections' operation mode it seems to work.