[GH-ISSUE #2633] MacOS DNS issues after updating to Sequoia #5497

Closed
opened 2026-08-05 01:03:32 -04:00 by saavagebueno · 10 comments
Owner

Originally created by @fab-sgnct on GitHub (Sep 23, 2024).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/2633

Describe the problem

Everything was working fine, using netbird 0.16.2
I update Sequoia and now:

  • when I am connected, I can SSH nodes from my private network, but I cannot open for example www.google.com in my web browser (nor curl it), it fails with DNS error.
  • when I am disconnected, I can reach those websites (but cannot reach nodes in my private network).

To Reproduce

Update macbook to MacOS Sequoia 15.0 24A335
Connect netbird ( netbird up)
Try curl https:///www.google.com

Expected behavior

curl returns HTML for google search page

Are you using NetBird Cloud?

Using netbird cloud

NetBird version

I tried 0.26.2 which was the version I was using before the update.
I tried 0.28.7 that a colleague is using
I tried 0.29.4, current latest version

NetBird status -dA output:

Daemon version: 0.28.7
CLI version: 0.26.2
Management: Connected to https://api.netbird.io:443
Signal: Connected to https://signal.netbird.io:443
Relays: 
  [stun:stun.netbird.io:5555] is Available
  [turns:turn.netbird.io:443?transport=tcp] is Available
FQDN: mbp-fabien-1.netbird.cloud
NetBird IP: 100.124.250.159/16
Interface type: Userspace
Quantum resistance: false
Peers count: 13/64 Connected

Do you face any (non-mobile) client issues?

% netbird debug for 1m -AS
Error: unknown command "debug" for "netbird"
Run 'netbird --help' for usage.

Additional context

I removed any other VPN app I got installed (fortinet, tunnelblick, openvpn connect).
I used to use netbird just fine with openvpn connect also connected.
It all started today with Sequoia update.
Doing a tcpdump, I can see successful DNS resolutions queries and responses going through

Originally created by @fab-sgnct on GitHub (Sep 23, 2024). Original GitHub issue: https://github.com/netbirdio/netbird/issues/2633 **Describe the problem** Everything was working fine, using netbird 0.16.2 I update Sequoia and now: - when I am connected, I can SSH nodes from my private network, but I cannot open for example www.google.com in my web browser (nor curl it), it fails with DNS error. - when I am disconnected, I can reach those websites (but cannot reach nodes in my private network). **To Reproduce** Update macbook to MacOS Sequoia 15.0 24A335 Connect netbird ( `netbird up`) Try `curl https:///www.google.com` **Expected behavior** `curl` returns HTML for google search page **Are you using NetBird Cloud?** Using netbird cloud **NetBird version** I tried 0.26.2 which was the version I was using before the update. I tried 0.28.7 that a colleague is using I tried 0.29.4, current latest version **NetBird status -dA output:** ``` Daemon version: 0.28.7 CLI version: 0.26.2 Management: Connected to https://api.netbird.io:443 Signal: Connected to https://signal.netbird.io:443 Relays: [stun:stun.netbird.io:5555] is Available [turns:turn.netbird.io:443?transport=tcp] is Available FQDN: mbp-fabien-1.netbird.cloud NetBird IP: 100.124.250.159/16 Interface type: Userspace Quantum resistance: false Peers count: 13/64 Connected ``` **Do you face any (non-mobile) client issues?** ``` % netbird debug for 1m -AS Error: unknown command "debug" for "netbird" Run 'netbird --help' for usage. ``` **Additional context** I removed any other VPN app I got installed (fortinet, tunnelblick, openvpn connect). I used to use netbird just fine with openvpn connect also connected. It all started today with Sequoia update. Doing a tcpdump, I can see successful DNS resolutions queries and responses going through
saavagebueno added the triage-neededdnsmacos labels 2026-08-05 01:03:32 -04:00
Author
Owner

@mlsmaycon commented on GitHub (Sep 23, 2024):

Hello @fab-sgnct, can you upgrade your version to 0.29.4? Also, from your netbird status output and because the debug command failed, we can see that your CLI and Daemon are running different version; they should usually match unless there are different binaries in different paths.

You can get the paths with ps aux | grep netbird and which netbird commands

After the upgrade, if the problem persists, can you run netbird debug for 1m -AS.

<!-- gh-comment-id:2368827053 --> @mlsmaycon commented on GitHub (Sep 23, 2024): Hello @fab-sgnct, can you upgrade your version to 0.29.4? Also, from your netbird status output and because the debug command failed, we can see that your CLI and Daemon are running different version; they should usually match unless there are different binaries in different paths. You can get the paths with `ps aux | grep netbird` and `which netbird` commands After the upgrade, if the problem persists, can you run `netbird debug for 1m -AS`.
Author
Owner

@fab-sgnct commented on GitHub (Sep 24, 2024):

we can see that your CLI and Daemon are running different version

Yesterday I got a first unrelated issue (likely this one) for which I tried multiple versions and it seems that one of them left behind a running daemon.
Today, uninstalling the netbird version I had, installing 0.29.4 again and doing some tests, it was working just fine.

I still have some error logs in /var/log/netbird/client.log but they are very likely unrelated (leaving them here in case someone reads this later having the same issue):

2024-09-24T10:22:50+02:00 ERRO util/net/dialer_nonios.go:66: Failed to call dialer hooks: failed to resolve address :51820: lookup : no such host
2024-09-24T10:22:50+02:00 ERRO client/internal/networkmonitor/monitor_bsd.go:64: Network monitor: error parsing routing message: parse RIB: invalid address
2024-09-24T10:22:50+02:00 ERRO client/internal/networkmonitor/monitor_bsd.go:64: Network monitor: error parsing routing message: parse RIB: invalid address

Anyway, conclusion is that it works for me now, sorry for the false bug, I only hope this thread will help others if they have a similar issue.

<!-- gh-comment-id:2370603658 --> @fab-sgnct commented on GitHub (Sep 24, 2024): ``` we can see that your CLI and Daemon are running different version ``` Yesterday I got a first unrelated issue (likely [this one](https://github.com/netbirdio/netbird/issues/894#issuecomment-1593390677)) for which I tried multiple versions and it seems that one of them left behind a running daemon. Today, uninstalling the netbird version I had, installing 0.29.4 again and doing some tests, it was working just fine. I still have some error logs in `/var/log/netbird/client.log` but they are very likely unrelated (leaving them here in case someone reads this later having the same issue): ``` 2024-09-24T10:22:50+02:00 ERRO util/net/dialer_nonios.go:66: Failed to call dialer hooks: failed to resolve address :51820: lookup : no such host 2024-09-24T10:22:50+02:00 ERRO client/internal/networkmonitor/monitor_bsd.go:64: Network monitor: error parsing routing message: parse RIB: invalid address 2024-09-24T10:22:50+02:00 ERRO client/internal/networkmonitor/monitor_bsd.go:64: Network monitor: error parsing routing message: parse RIB: invalid address ``` Anyway, conclusion is that it works for me now, sorry for the false bug, I only hope this thread will help others if they have a similar issue.
Author
Owner

@fab-sgnct commented on GitHub (Sep 24, 2024):

Well, no ...
A bit later during the day and a brew update and it is broken again. Uninstall + service kill + reinstall does not help this time.
A colleague shared me this link talking about Sequoia update that could have undesired side effects.

<!-- gh-comment-id:2371176960 --> @fab-sgnct commented on GitHub (Sep 24, 2024): Well, no ... A bit later during the day and a `brew update` and it is broken again. Uninstall + service kill + reinstall does not help this time. A colleague shared me [this link](https://mjtsai.com/blog/2024/09/18/macos-firewall-regressions-in-sequoia/) talking about Sequoia update that could have undesired side effects.
Author
Owner

@fab-sgnct commented on GitHub (Sep 25, 2024):

Today I did:

  • uninstall netbird 0.29.4, killed the process
  • uninstall the openvpn I am also using for other system
  • reboot the mac
  • check I can browse the internet
  • install netbird 0.29.4 that connects
  • check I can ssh to some system on private network
  • check browsing the internet: still DNS issue.

So "a fresh" install (not so fresh probably) is enough to reproduce the issue.

<!-- gh-comment-id:2373192696 --> @fab-sgnct commented on GitHub (Sep 25, 2024): Today I did: - uninstall netbird 0.29.4, killed the process - uninstall the openvpn I am also using for other system - reboot the mac - check I can browse the internet - install netbird 0.29.4 that connects - check I can ssh to some system on private network - check browsing the internet: still DNS issue. So "a fresh" install (not so fresh probably) is enough to reproduce the issue.
Author
Owner

@mlsmaycon commented on GitHub (Sep 25, 2024):

@fab-sgnct can you please share the output of:

netbird debug for 1m -S
scutil --dns
<!-- gh-comment-id:2373373311 --> @mlsmaycon commented on GitHub (Sep 25, 2024): @fab-sgnct can you please share the output of: ```shell netbird debug for 1m -S scutil --dns ```
Author
Owner

@fab-sgnct commented on GitHub (Sep 26, 2024):

@mlsmaycon Please find attached the requested zip file.
As it was containing host names containing colleagues names or client names, I had to redact it a bit (see redactedXXX strings) in a consistent way. Please also note that some colleagues have updated to Sequoia too and have it working (and never faced such issues) as it was for me on Tuesday for some time, after removing some older VPN setup, fixing version discrepancies and before updating some brew formulas.

Reminder of the history:

  • all working
  • upgrade macos to Sequoia
  • Issue = DNS resolutions (chrome, curl, safari, ...) not working when netbird connected. All ok when not
  • Remove forticlient, fix version discrepancies and working again
  • brew update a few hours later and back to same issue
% scutil --dns           
DNS configuration

resolver #1
  nameserver[0] : 80.58.61.254
  nameserver[1] : 80.58.61.250
  if_index : 14 (en0)
  flags    : Request A records
  reach    : 0x00000002 (Reachable)

resolver #2
  domain   : local
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300000

resolver #3
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300200

resolver #4
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300400

resolver #5
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300600

resolver #6
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300800

resolver #7
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  nameserver[0] : 80.58.61.254
  nameserver[1] : 80.58.61.250
  if_index : 14 (en0)
  flags    : Scoped, Request A records
  reach    : 0x00000002 (Reachable)

netbird.debug.1558652651.zip

<!-- gh-comment-id:2376102975 --> @fab-sgnct commented on GitHub (Sep 26, 2024): @mlsmaycon Please find attached the requested zip file. As it was containing host names containing colleagues names or client names, I had to redact it a bit (see `redactedXXX` strings) in a consistent way. Please also note that some colleagues have updated to Sequoia too and have it working (and never faced such issues) as it was for me on Tuesday for some time, after removing some older VPN setup, fixing version discrepancies and before updating some brew formulas. Reminder of the history: - all working - upgrade macos to Sequoia - Issue = DNS resolutions (chrome, curl, safari, ...) not working when netbird connected. All ok when not - Remove forticlient, fix version discrepancies and working again - brew update a few hours later and back to same issue ``` % scutil --dns DNS configuration resolver #1 nameserver[0] : 80.58.61.254 nameserver[1] : 80.58.61.250 if_index : 14 (en0) flags : Request A records reach : 0x00000002 (Reachable) resolver #2 domain : local options : mdns timeout : 5 flags : Request A records reach : 0x00000000 (Not Reachable) order : 300000 resolver #3 domain : 254.169.in-addr.arpa options : mdns timeout : 5 flags : Request A records reach : 0x00000000 (Not Reachable) order : 300200 resolver #4 domain : 8.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records reach : 0x00000000 (Not Reachable) order : 300400 resolver #5 domain : 9.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records reach : 0x00000000 (Not Reachable) order : 300600 resolver #6 domain : a.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records reach : 0x00000000 (Not Reachable) order : 300800 resolver #7 domain : b.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records reach : 0x00000000 (Not Reachable) order : 301000 DNS configuration (for scoped queries) resolver #1 nameserver[0] : 80.58.61.254 nameserver[1] : 80.58.61.250 if_index : 14 (en0) flags : Scoped, Request A records reach : 0x00000002 (Reachable) ``` [netbird.debug.1558652651.zip](https://github.com/user-attachments/files/17144287/netbird.debug.1558652651.zip)
Author
Owner

@fab-sgnct commented on GitHub (Sep 26, 2024):

Addition: when connected to netbird here is the output:

% scutil --dns     
DNS configuration

resolver #1
  search domain[0] : netbird.cloud
  nameserver[0] : 80.58.61.254
  nameserver[1] : 80.58.61.250
  if_index : 14 (en0)
  flags    : Request A records
  reach    : 0x00000002 (Reachable)

resolver #2
  domain   : netbird.cloud
  nameserver[0] : 100.124.255.254
  port     : 53
  flags    : Supplemental, Request A records
  reach    : 0x00000002 (Reachable)
  order    : 102200

resolver #3
  domain   : local
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300000

resolver #4
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300200

resolver #5
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300400

resolver #6
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300600

resolver #7
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300800

resolver #8
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  nameserver[0] : 80.58.61.254
  nameserver[1] : 80.58.61.250
  if_index : 14 (en0)
  flags    : Scoped, Request A records
  reach    : 0x00000002 (Reachable)
<!-- gh-comment-id:2376140539 --> @fab-sgnct commented on GitHub (Sep 26, 2024): Addition: when connected to netbird here is the output: ``` % scutil --dns DNS configuration resolver #1 search domain[0] : netbird.cloud nameserver[0] : 80.58.61.254 nameserver[1] : 80.58.61.250 if_index : 14 (en0) flags : Request A records reach : 0x00000002 (Reachable) resolver #2 domain : netbird.cloud nameserver[0] : 100.124.255.254 port : 53 flags : Supplemental, Request A records reach : 0x00000002 (Reachable) order : 102200 resolver #3 domain : local options : mdns timeout : 5 flags : Request A records reach : 0x00000000 (Not Reachable) order : 300000 resolver #4 domain : 254.169.in-addr.arpa options : mdns timeout : 5 flags : Request A records reach : 0x00000000 (Not Reachable) order : 300200 resolver #5 domain : 8.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records reach : 0x00000000 (Not Reachable) order : 300400 resolver #6 domain : 9.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records reach : 0x00000000 (Not Reachable) order : 300600 resolver #7 domain : a.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records reach : 0x00000000 (Not Reachable) order : 300800 resolver #8 domain : b.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records reach : 0x00000000 (Not Reachable) order : 301000 DNS configuration (for scoped queries) resolver #1 nameserver[0] : 80.58.61.254 nameserver[1] : 80.58.61.250 if_index : 14 (en0) flags : Scoped, Request A records reach : 0x00000002 (Reachable) ```
Author
Owner

@fab-sgnct commented on GitHub (Sep 26, 2024):

Note: when netbird is up:

  • dig and nslookup are providing responses when trying to resolve some domain
  • dscacheutil -q host -a name <domain> is hanging and ends without providing any response -> this is querying the system to get the DNS resolution
  • curl and browsers (chrome, safari, ...) are not opening pages due to DNS resolution error.

Also, from what it seems using tcpdump, DNS queries are going out and responses coming in on the laptop, but responses "lost" before reaching the system resolver.

All works fine when netbird is down.

<!-- gh-comment-id:2377289808 --> @fab-sgnct commented on GitHub (Sep 26, 2024): Note: when netbird is up: - `dig` and `nslookup` are providing responses when trying to resolve some domain - `dscacheutil -q host -a name <domain>` is hanging and ends without providing any response -> this is querying the system to get the DNS resolution - `curl` and browsers (chrome, safari, ...) are not opening pages due to DNS resolution error. Also, from what it seems using `tcpdump`, DNS queries are going out and responses coming in on the laptop, but responses "lost" before reaching the system resolver. All works fine when netbird is down.
Author
Owner

@fab-sgnct commented on GitHub (Oct 3, 2024):

Note: I also have Microsoft Defender installed. Checking with my company to get the policy relaxed and disable it.

<!-- gh-comment-id:2391625117 --> @fab-sgnct commented on GitHub (Oct 3, 2024): Note: I also have [Microsoft Defender](https://www.pcmag.com/news/macos-sequoia-causing-vpn-web-browsing-antivirus-software-problems) installed. Checking with my company to get the policy relaxed and disable it.
Author
Owner

@fab-sgnct commented on GitHub (Oct 4, 2024):

After updating MacOS to 15.0.1, all issues are gone.

<!-- gh-comment-id:2393987986 --> @fab-sgnct commented on GitHub (Oct 4, 2024): After updating MacOS to 15.0.1, all issues are gone.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#5497