pgrenaud/northsec-2023-additional-vpn-instructions-for-macos.md

I found a functional workaround to make the DNS works on macOS Ventura and Monterey (should work on both Intel and Apple Silicon). It involve installing and configuring dnsmasq as the sole DNS provider for you main network interface. I try other less intrusive solution (live setting resolver for nsec and ctf in /etc/resolver, but that was not enough). I might have forgot something, so let me know if something is not working.

1. First, follow macOS specific instructions at https://nsec.io/vpn/
2. Disconect the VPN and close Tunnelblick.
3. Install homebrew if not installed already: https://brew.sh/
4. Install dnsmasq:

brew install dnsmasq

5. Configure dnsmasq to only listen locally (optional):

/usr/bin/sed -Ei '' 's/^#?listen-address=.*$/listen-address=127.0.0.1/g' "$HOMEBREW_PREFIX/etc/dnsmasq.conf"

6. Enable dnsmasq config directory:

/usr/bin/sed -i '' "s|^#\(conf-dir=${HOMEBREW_PREFIX}/etc/dnsmasq.d\)$|\1|g" "$HOMEBREW_PREFIX/etc/dnsmasq.conf"

7. Configure the desired DNS servers:

cat >> "$HOMEBREW_PREFIX/etc/dnsmasq.d/nsec" <<EOL
server=/nsec/2602:fc62:ef:2::1
server=/ctf/2602:fc62:ef:2::1
server=8.8.4.4
server=8.8.8.8
EOL

8. Restart dnsmasq:

sudo brew services restart dnsmasq

9. Validate that dnsmasq is working properly (you should obtain an IP address):

dig google.ca @127.0.0.1

10. Open System preferences, then go to Network, select your network interface (should be Wi-Fi), click Advanced..., select DNS tab and add 127.0.0.1 as the sole DNS server.

11. Validate that dnsmasq is still working properly (you should obtain an IP address from the server 127.0.0.1):

dig google.ca

12. Open Tunnelblick, go to the Configurations main tab, select your team VPN, go to the Settings inner tab and set Set DNS/WINS to Do not set nameserver.

13. Connect to the VPN.

14. Validate that dnsmasq is working properly (you should obtain a reply for each):

dig google.ca
dig www.nsec

15. Check that everything is working by visiting https://test.nsec/ in your web browser.

16. You might need to flush the DNS cache:

sudo killall -HUP mDNSResponder; sudo killall mDNSResponderHelper; sudo dscacheutil -flushcache

16. You might also need to disable all network interfaces but the one that you need, restart Tunnelblick or restart macOS.

17. Other useful commands:

scutil --dns