- Newest
- Most votes
- Most comments
It appears you're experiencing an issue with internet connectivity when using the AWS VPN Client on your MacOS device. This is a known issue that can occur with AWS Client VPN, especially on MacOS systems. Here are some troubleshooting steps you can try:
-
Check your route table: When connected to the VPN, the default route may be incorrectly set. You can verify this by checking your route table before and after connecting to the VPN. If you notice that the default route changes to the VPN interface, this could be causing your internet connectivity issues.
-
Modify the route table manually: If the default route is being changed, you can try manually modifying it after connecting to the VPN. You can do this by using the following commands in the terminal:
sudo route delete -net 0.0.0.0/0 sudo route add -net 0.0.0.0/0 <your_gateway_ip>
Replace <your_gateway_ip> with your actual gateway IP address.
-
Check the Client VPN endpoint configuration: Ensure that the split-tunnel option is correctly configured on the AWS side. Even if it's enabled, there might be an issue with how it's being applied.
-
Use the AWS Client VPN GUI: Some users have reported that using the official AWS Client VPN GUI application instead of the built-in OpenVPN client can resolve this issue. If you're not already using it, try installing and using the AWS Client VPN application.
-
Verify the mssfix setting: If you're having trouble with larger packets, you might need to adjust the maximum segment size. You can do this by adding the following line to your Client VPN endpoint .ovpn configuration file:
mssfix 1328
-
Check for non-RFC1918 IP addresses: Ensure that none of your network interfaces have non-RFC1918 IP addresses, as this can sometimes cause routing issues with the VPN.
If these steps don't resolve the issue, you may need to contact AWS support for further assistance, as there could be a configuration problem on the AWS side that's specific to your setup.
Sources
Troubleshooting AWS Client VPN connections with macOS clients - AWS Client VPN
Troubleshooting AWS Client VPN: Clients can't access a peered VPC, Amazon S3, or the internet - AWS Client VPN
AWS Client VPN with split tunnel add default route even though it shouldn't | AWS re:Post
Losing internet access with split tunnel on in aws client VPN | AWS re:Post
Have you enabled SPLIT Tunnel on the VPN Client endpoint? This will likely fix your issue. https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/split-tunnel-vpn.html
If you want to route ALL traffic over your VPN, we will need to take a look at how you have your VPC setup
Formatted my opening question a bit for readability, we have already configured splitting and it IS working fine on all other machines. Also see the tentatively positive reply on the AI's answer.
We used to have a lot of issues with internet outages on disconnect from our split-tunnel Client VPN Endpoints because we had old 0.0.0.0/0 routes configured in the route table. We had previously used a full-tunnel configuration and just never cleaned up the route table when we switched to split tunnel for that endpoint. As such, removing the internet routes from our CVPNE route table configuration eliminated the issue.
Before figuring that out, I wrote a daemon for MacOS that automatically resets your network interfaces and flushes your system's route tables when DNS changes are detected coming off of a VPN. It was a quick little project, but maybe you or someone else will find a use-case for it to help as well: https://github.com/bmartinson/netrestarterd.
Relevant content
- AWS OFFICIALUpdated 9 months ago
The problem does indeed appear to be with routing, adding the route back again (sudo route delete -net 0.0.0.0/0 && sudo route add -net 0.0.0.0/0 <your_gateway_ip>) AFTER connecting to VPN does resolve the issue. But it's only temporary, for that 1 session. The next time I connect the routes are replaced again. This seems like a VERY similar issue we had when our office private network IP CIDR was wrong (https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/routing-to-lan.html). That could also be manually resolved by adding the route again. But as stated I think my gateway address of 192.168.2.1 is correct right? I also don't see any errors in the logs which we did in the past at the office.
Strangely enough the default route added appears to persist, even after a reboot. I'll keep an eye on it but for now adding the route to my gateway manually "appears to have" resolved the issue. I'll update in a few days.
Tested it for a week at home and at the office and I haven't seen the issue anymore.