VPN Connection Blocks Internet Access on MacBook M3 (macOS Sequoia 15.3) - FortiClient 7.4.2

[DaveRDev]

I am experiencing an issue with FortiClient VPN on a MacBook Pro M3. After successfully connecting to the corporate VPN server, I lose access to external internet services (e.g., Google, Spotify, and general web browsing), even though the VPN status shows as “Connected.” Below are the details for your reference:

Environment Details:

• FortiClient Version: 7.4.2
• macOS Version: Sequoia 15.3
• Device: MacBook Pro M3
• VPN Configuration: IPsec VPN

Symptoms:

• VPN connection establishes successfully.
• No internet access for external services (e.g., browsers, apps like Spotify).
• Internal corporate resources (e.g., intranet, servers) are accessible without issues.
• DNS resolution fails for public domains (e.g., google.com), but IP-based pinging (e.g., 8.8.8.8) works.

Troubleshooting Steps Already Performed:

• Tested with IPsec protocol (issue persists).
• Temporarily disabled macOS firewall (no impact).
• Confirmed the issue occurs only when VPN is active

Additional Information:

• No errors appear in FortiClient logs, but VPN connectivity seems to override external routing.
• Note: The same VPN configuration was tested on a Windows 11 device (FortiClient 7.4.2), and internet access worked correctly alongside the VPN connection. This confirms the issue is isolated to the macOS Sequoia environment.

 FortiClient 

[AEK]

The VPN is injecting to your MacOS a default route through the tunnel. You can confirm by displaying the routing table.

Can you confirm that the split tunnel config is enabled on your IPsec config from FGT side?

If so, then it is probably a bug related to FCT on MacOS, or due to the MacOS version. A workaround would be to remove the injected default route manually every time you connect, until a new FCT version fixes the issue.

[DaveRDev]

Thank you for your prompt response.

1. Split Tunneling:
   As mentioned earlier, the split tunneling option is not visible in the FortiClient GUI.
2. Routing Table:
   Below is a sanitized version of the routing table after connecting to the VPN:

Destination        Gateway            Flags               Netif Expire
default            [LAN_GATEWAY]      UGScg                 en0       
default            [LAN_GATEWAY]      UGScIg                en0        
[VPN_GATEWAY]      [LAN_GATEWAY]      UGSc                  en0       
169.254            link#14            UCS                   en0      !
169.254.x.x/x      [VPN_GATEWAY]      UGSc                utun4       
169.254.x.x        link#14            UHLSW                 en0      !
[VPN_GATEWAY]      [VPN_GATEWAY]      UGSc                utun4       
[VPN_GATEWAY]      [VPN_GATEWAY]      UHr                 utun4       
[VPN_GATEWAY]      link#22            UCS                 utun4       
[LAN_GATEWAY]      link#14            UCS                   en0      !
[LAN_GATEWAY]      link#14            UCS                   en0      !

Additional Context:

• The issue persists despite reinstalling FortiClient and testing multiple VPN profiles.

• As mentioned earlier, the same configuration works flawlessly on Windows 11.

[btan]

Hi DaveRDev,

I have seen this issue before in Windows, it was caused by 'persistent routes' leftover in that Windows machine. As per quick research, persistent routes sometime do exist in macOS as well. 

Perhaps you can check if there is persistent route in this particular macOS:
https://chatgpt.com/share/67aff9a8-272c-8006-bb76-d13492fb373b

[AEK]

If I'm not wrong I see there is no default gateway injected in your routing table. In that case you need to confirm if it is actually sending all traffic through the tunnel or not.

But now I'm suspecting that your DNS queries are being sent through the tunnel. Can you confirm that? If it is confirmed then you will need to disable injecting DNS server info.

On the other hand here is how you confirm if split tunneling is enabled on your FGT IPsec config.

[DaveRDev]

Thank you for your feedback.

I am using FortiClient VPN-only version and there is no split tunneling option available in the GUI or advanced settings.

To clarify my setup:

• I am connecting to a remote organizational network via IPsec VPN (FortiClient VPN-only version).

• I do not have administrative access to the FortiGate server or internal network configurations. The VPN profile is managed by the organization, and I cannot modify server-side settings (e.g., split tunneling, DNS policies).

I believe the issue may be related to a specific configuration on my MacBook (i.e., client-side), as the same VPN connection works correctly on a Windows device using the same network and credentials. This leads me to rule out a server-side misconfiguration or internal network policy issue, since the behavior is consistent across other devices. I suspect factors such as macOS network settings, local firewall conflicts, or even the macOS Sequoia might be interfering with the VPN connection.

[bklever]

Exact same issue here, colleagues on windows machine's have no problem. Using VPN Only app, MacOS Sequoia 15.5. Did you find a solution Dave?