[Bug]: Hosts behind OpenVPN (Tunnelblick) not reachable from container

[jschacher-dg-i]

I have done the following

• I have searched the existing issues
• If possible, I've reproduced the issue using the 'main' branch of this project

Steps to reproduce

1. Establish an OpenVPN connection using Tunnelblick.
2. Start any kind of container (tested with Debian).
3. Try connecting to a host, only reachable through the OpenVPN connection, from the container.
4. Observe the connection not establishing and hanging instead.

Problem description

It's not possible to reach hosts, which are only reachable via OpenVPN (using Tunnelblick), from a container.

Environment

- OS: macOS 26.4.1 (25E253)
- Xcode: /
- Container: container CLI version 0.12.3 (build: release, commit: unspeci)

Code of Conduct

• I agree to follow this project's Code of Conduct

[jglogan]

@jschacher-dg-i Did you connect to OpenVPN before or after starting the container runtime / Vessel service?

What happens if you disconnect the VPN, stop and restart the container system service, reconnect the VPN, then try again?

On my system If I run sudo pfctl -a "com.apple.internet-sharing/shared_v4" -sn, I see a nat on utun<n> rule that corresponds to the VPN tunnel interface I have:

nat on utun6 inet from 192.168.65.0/24 to any -> (utun6:0) extfilter ei

[jschacher-dg-i]

I just tried first starting the container service and then connecting to the VPN, but without luck.

Running sudo pfctl -a "com.apple.internet-sharing/shared_v4" -sn I also don't see a nat on utun<n> rule as you described.