Mismatch between FortiClient VPN connection and Mac OS setting

[nedahejazi]

Hello,

 I installed FortiClient on MacOS 26.1 and after following the instruction from our IT, I am apparently connected to the VPN. Everything seems fine in the FortiClient window, showing it is "connected", but I have two problems: first in the Mac system setting, VPN & Filters, it shows VPN is "disconnected", second I lose the internet after connecting to the VPN. In the same system setting, under Filters & Proxies, I cannot add FortiClient to the list, while I can still see Cisco Secure. I checked some posts regarding  internet disconnection, but all are confusing to me and have not been helpful. I would be thankful if anyone would help to solve this issue.

Thank you.

[funkylicious · Accepted solution]

according to the "netstat -rn" table, you VPN pushes/installs a route for 10.11.42.0/24 network via utun interface and the IP assigned to you is 10.254.0.219 , which means it's split tunnel.

as for DNS settings/servers, these usually are assigned via DHCP from your home/local network when you connect to it, no need to change/set anything manually and based on the scutils --dns you can reach 8.8.8.8 therefore you should have internet access.

[funkylicious]

this means that whatever DNS server(s) is/are being pushed/changed via VPN ( look at resolv.conf before and after to check what changes ) is likely unreachable and setting/changing it manually will solve the issue.

[nedahejazi]

Yes. Back to resolv.conf:

 At the very end, it shows something reachable. Do you have any idea what this is?

[funkylicious]

i assume that it says that 8.8.8.8 is reachable.

try disabling private relay and/or limit ip tracking and also perform different tests with nslookup

nslookup google.com

nslookup google.com 8.8.8.8

nslookup google.com 1.1.1.1

nslookup google.com 8.8.4.4

[nedahejazi]

Thank you again for your time.

I disabled "Limit IP address tracking", but my computer is not upgraded for having active "Private Relay". I tested these after VPN connection:

 Any clue?

[funkylicious]

scutil --dns isnt a real test from my perspective.

rely more on tools like ping/nslookup/traceroute etc 

please make use of those and test towards public DNS servers from above and show what you get while connected to VPN

[nedahejazi]

Terribly sorry, I attached a wrong screenshot in the previous message:

 

[funkylicious]

ok, so this means that internet access is granted and can resolve public dns entries with public dns servers.

doing a nslookup google.com , w/o specifying the server to use has the same result? if not then just add any of those dns servers to resolv.conf and you should be able to surf the internet ( assuming that they are not present after connecting ) 

[nedahejazi]

Before VPN connection:

 and after VPN connection:

(The previous tests with the specific servers that I attached were all after VPN connection.) But there seems to be a problem here after VPN connection w/o the server.

[funkylicious · Accepted solution]

ok, this means that connecting to the IPsec is pushing a specific DNS server to the station ( most likely its configured on the FGT as DNS server and there it works and IT enabled Use system DNS in mode config in IPsec ) - https://community.fortinet.com/t5/Support-Forum/Can-t-enable-DNS-on-VPN-Tunnel/m-p/52350 which breaks your connection.

remove it from resolv.conf and add any other DNS and it should be ok.

cannot resolve from Internet/my home queries using it

nslookup google.com 146.155.1.155
Server: 146.155.1.155
Address: 146.155.1.155#53

** server can't find google.com: REFUSED

[nedahejazi]

Hello funkylicious, I do not know how to thank you properly for all your help. I sent your message to the IT and then they made a change to the VPN system at DNS level, and my problem was solved.