CloudConnexa: macOS Applications Use the Local Gateway Instead of CloudConnexa

Overview

If you're connected to CloudConnexa on macOS but can't reach an Application configured under Networks → Applications, another application or service on your Mac may be intercepting DNS requests before CloudConnexa can process them.

When this occurs, the VPN tunnel remains connected, but applications resolve the destination using its public IP address instead of the CloudConnexa intermediary address.

Symptoms

You may observe one or more of the following:

• Browsing to the application's domain times out, connects to the wrong server, or is blocked.

• ping, or ssh to the appplication hostname fails.

• The same application works from Windows or from a Mac running a different macOS version.

• The destination is reachable when configured as an IP Service rather than an Application (reachable via IP, if applicable).

Cause

When an Application is configured with a domain, CloudConnexa acts as the DNS proxy and returns a lookup response with an intermediary IP address from the WPC Domain Routing range (default: 100.80.0.0/12). Your Mac then routes that intermediary IP through the tunnel. The DNS resolver itself sits in the WPC subnet (default 100.96.0.0/11).

Some macOS applications and services can intercept DNS requests before the CloudConnexa resolver receives them, returning the destination's public IP address instead. As a result, the tunnel remains connected, but traffic for that application bypasses CloudConnexa.

Common causes include:

• MDM DNS profiles: Mosyle, Jamf Pro, Intune.

• Endpoint protection and EDR: SentinelOne, CrowdStrike Falcon, JumpCloud Agent.

• Secondary DNS or VPN clients: Cloudflare WARP, Cisco Umbrella Roaming Client, NextDNS, ControlD, Tailscale MagicDNS, or another active VPN.

• Apple Private Relay (iCloud+).

• Firewalls with DNS filtering: Little Snitch, LuLu.

Verify the Cause

1. Connect to CloudConnexa from the Mac.
2. Reproduce the issue by attempting to navigate to the application's domain.

3. Run the following commands:

   nslookup <your-application-domain>

   dscacheutil -q host -a name <your-application-domain>

4. Compare the results:

   • If nslookup returns an address in the Domain Routing range (by default, 100.80.0.0/12) but dscacheutil returns the destination's public IP address, another macOS service is intercepting DNS requests before CloudConnexa.
   • If both commands return the destination's public IP address, verify your CloudConnexa configuration, including the Application, Access Groups, and user or group synchronization.

   Note: nslookup and dig query the configured DNS resolver directly. dscacheutil uses the same macOS API (getaddrinfo) as applications such as web browsers and SSH clients, so it reflects the addresses those applications actually use.

   Important: The Domain Routing range defaults to 100.80.0.0/12, but your organization may use a different range. Verify the configured range in the CloudConnexa Administration Portal under Settings → WPC.