AWS vpn documentation change
Summary
Added troubleshooting section for VPN DNS settings not applying due to manual network configuration conflicts
Security assessment
Addresses a DNS configuration conflict scenario that could impact security monitoring (by bypassing VPN DNS), but documents a known behavior rather than fixing a vulnerability. The guidance helps maintain secure DNS routing but isn't a security feature documentation.
Diff
diff --git a/vpn/latest/clientvpn-user/macos-troubleshooting.md b/vpn/latest/clientvpn-user/macos-troubleshooting.md index a34fa2c9b..8792639c0 100644 --- a//vpn/latest/clientvpn-user/macos-troubleshooting.md +++ b//vpn/latest/clientvpn-user/macos-troubleshooting.md @@ -5 +5 @@ -AWS provided client event logsClient cannot connectClient is stuck in a reconnecting stateClient cannot create profileHelper tool is required errorTunnelblickCipher algorithm 'AES-256-GCM' not foundConnection stops responding and resetsExtended key usage (EKU)Expired certificateOpenVPNCannot resolve DNS +AWS provided client event logsClient cannot connectClient is stuck in a reconnecting stateClient cannot create profileHelper tool is required errorTunnelblickCipher algorithm 'AES-256-GCM' not foundConnection stops responding and resetsExtended key usage (EKU)Expired certificateOpenVPNCannot resolve DNSVPN-provided DNS is not being applied to a device @@ -61,0 +62,2 @@ The AWS provided client stores the configuration files in the following location + * VPN-provided DNS is not being applied to a device + @@ -299,0 +302,17 @@ See the solution for [Unable to Resolve Client VPN Endpoint DNS Name](https://do +## VPN-provided DNS is not being applied to a device + +###### Problem + +VPN-provided DNS is not being applied to the device, even though the VPN connection was established successfully. The following is written to the daemon log: + + + 15:23:47 *UpScript: WARNING: Ignoring ServerAddresses '172.16.1.53' because ServerAddresses was set manually and '-allowChangesToManuallySetNetworkSettings' was not specified + +###### Cause + +The client will not override DNS settings that are already configured manually by other VPNs, MDM profiles, or third-party network tools. + +###### Solution + +Remove all DNS servers specified in **System Settings > Network > [Active Network Interface] > Details > DNS**. +