Bugs Discovered in macOS Versions 14.6 to 15.1: VPN Connections Leak Small Amounts of Traffic

Many businesses rely on internal VPNs to encrypt web traffic and enhance security, necessitating employees to connect to the company's intranet via a VPN using their account credentials.

However, a bug has been identified in Apple's macOS versions 14.6 to 15.1 (currently still in testing) that allows small amounts of traffic to bypass the encrypted tunnel, leading to a leakage.

Under normal circumstances, once a global VPN connection is activated, all traffic should be transmitted through the encrypted tunnel as directed by the routing table.

Due to an unknown issue, the macOS firewall might not function properly, potentially ignoring firewall rules. Despite this, the majority of traffic continues through the tunnel, but certain applications do not adhere to the routing table, thus some traffic may pass through a regular connection.

The software developer Mullvad discovered this issue and has reported it to the Apple security team. As of the publication of this article, Apple has not yet issued a statement, so it is unclear whether this is a bug in the system or related to third-party software.

Here is how to verify the bug:

1. Add a firewall rule to block all traffic

echo "block drop quick all" | sudo pfctl -ef -

2.Attempt to direct traffic outside the encrypted tunnel.

curl https://am.i.mullvad.net/connected

3.For post-test cleanup, disable the firewall and clear all rules.

sudo pfctl -d
sudo pfctl -f /etc/pf.conf

4.Ensure all encrypted tunnel connections are disconnected, then identify the default network interface.

route get mullvad.net | sed -nE's/.*interface: //p'

5.Connect to the encrypted tunnel and run the following command (replace <interface> with the interface identified in the previous step):

curl --interface <interface> https://am.i.mullvad.net/connected

6.In the last step, if you experience a connection timeout, it indicates normal operation; however, if you still receive a response, it indicates a traffic leakage issue.