macOS counterpart of #765 (Linux side fixed in #771).
The NE transparent proxy rewrites a child's own UDP/53 flows to <gateway>:53 (Provider.swift pumpUDP), but apps that resolve via the system resolver — getaddrinfo, curl 8+, anything using mDNSResponder — never emit an NE-visible UDP/53 flow: mDNSResponder runs outside the registered PPID subtree, so its upstream queries are answered off-tunnel. For tunnel-backed endpoints (kubernetes_port_forward, local_command, postgres) that answer is a raw upstream IP, which black-holes exactly as described in #765. Already acknowledged in the Provider.swift comment near the tsnetGatewayIP field; no mitigation exists.
Candidate directions (all greenfield — none of these APIs are used in the repo today):
NEDNSProxyProvider to intercept system-resolver traffic;NEDNSSettings / per-session resolver configuration pointing at the gateway;- a loopback forwarder +
/etc/resolver entries.
Distinct from #754, which is about VIP answers/routing being broken even for flows the NE does intercept; this issue is about lookups the NE never sees.
macOS counterpart of #765 (Linux side fixed in #771).
The NE transparent proxy rewrites a child's own UDP/53 flows to
<gateway>:53(Provider.swiftpumpUDP), but apps that resolve via the system resolver —getaddrinfo, curl 8+, anything usingmDNSResponder— never emit an NE-visible UDP/53 flow:mDNSResponderruns outside the registered PPID subtree, so its upstream queries are answered off-tunnel. For tunnel-backed endpoints (kubernetes_port_forward,local_command, postgres) that answer is a raw upstream IP, which black-holes exactly as described in #765. Already acknowledged in theProvider.swiftcomment near thetsnetGatewayIPfield; no mitigation exists.Candidate directions (all greenfield — none of these APIs are used in the repo today):
NEDNSProxyProviderto intercept system-resolver traffic;NEDNSSettings/ per-session resolver configuration pointing at the gateway;/etc/resolverentries.Distinct from #754, which is about VIP answers/routing being broken even for flows the NE does intercept; this issue is about lookups the NE never sees.