Skip to main content

macOS Client: 3rd Party Network Packet Filter Incompatible on Some Monterey 12.x Devices

Aaron
  • Updated
In this article:
    Applicable to:
    • Twingate Component: Client
    • Platform: macOS
    • OS version: Monterey versions below 12.4
    • Hardware: Currently only known to impact some MacBook Pro M1 based devices, possibly with an ethernet adapter utilized.
    • 3rd Party Component: Endpoint Detection and Response (EDR) packet filter enabled on the network extension

    Overview

    Users on a MacBook Pro M1 chipset running macOS versions below 12.4 (Monterey) with an Endpoint Detection and Response (EDR) sensor deployed may experience network connectivity issues when the Twingate macOS Client connects. The EDR agent’s packet filter on these devices can impact the macOS Client from operating as expected. As such, on some macOS devices, traffic that should be routed to the macOS Client, including DNS resolution against Twingate’s DNS proxy, is dropped before reaching the Twingate Client.

    The result seen is that the macOS Client’s networking is impacted. Intercepted DNS lookups fail, thus the internet connectivity appears to be broken as web pages fail to load by FQDN.

    Symptoms

    • Internet connectivity appears to be broken, such as non Twingate protected websites fail to load once the macOS Client is connected.
    • DNS resolution fails when utilizing macOS Client. 
    • DNS resolution is successful when bypassing the macOS Client. 

    Troubleshooting

    The below steps are in place to confirm that no other item is the cause of the issue at hand.

    1. Verify the above symptoms apply.

      1. To verify Twingate macOS Client DNS resolution: Via terminal, run the command dig twingate.com. This should not resolve an expected IP address.
      2. Via terminal, run the command dig @9.9.9.9 twingate.com. This should resolve an IP address as expected.

    2. See if EDR network filter (network extension) or other network extensions are in use.

      1. To verify if any network extensions are active, you can run the below command from Terminal.

        % systemextensionsctl list

      2. If no extensions are active, the command will output the below.

        % systemextensionsctl list
			0 extension(s)

    Resolution

    This issue was resolved in macOS 12.4.x update. It is advised to upgrade to 12.4+. See the following link for further information: What's new for enterprise in macOS Monterey

    Related articles