IP & domain access not working with Surge TUN mode

[te-simonren]

Describe the bug

ip & domain direct access not working with surge's tun mode VPN (https://nssurge.com)

turn off the TUN mode works fine

To Reproduce

1. start a nginx container
2. access via ip or domain
3. not working

Expected behavior

No response

Diagnostic report (required)

OrbStack info:
Version: 0.16.0 (160000)
Commit: b92cc5239da462d9918d844fc5b04ec110a35e1a (v0.16.0)

System info:
macOS: 13.4.1 (22F82)
CPU: arm64, 12 cores
CPU model: Apple M2 Max

Full report: https://orbstack.dev/_admin/diag/orbstack-diagreport_2023-08-11T07-29-11.454063Z.zip

Screenshots and additional context (optional)

No response

[kdrag0n]

Can you try:

traceroute container.orb.local
curl -v container.orb.local
curl -v -4 container.orb.local
curl -v -6 container.orb.local

... and share the output of each command?

[PhilETaylor]

I have one like this - reproducible.

docker run -p 8025:8025 -p 1025:1025 axllent/mailpit

INFO[2023/08/11 09:11:16] [smtpd] starting on 0.0.0.0:1025
INFO[2023/08/11 09:11:16] [http] starting server on http://localhost:8025/

http://localhost:8025/ is available and works well.

When selecting "Open in browser" in Orbstack it opens in Safari to http://brave_goldwasser.orb.local and just hangs there

~/Sites traceroute http://brave_goldwasser.orb.local
^C
~/Sites traceroute brave_goldwasser.orb.local
traceroute to brave_goldwasser.orb.local (192.168.215.2), 64 hops max, 52 byte packets
 1  192.168.215.2 (192.168.215.2)  3.157 ms  1.090 ms  0.583 ms
~/Sites curl -v http://brave_goldwasser.orb.local
*   Trying 192.168.215.2:80...
* Connected to brave_goldwasser.orb.local (192.168.215.2) port 80 (#0)
> GET / HTTP/1.1
> Host: brave_goldwasser.orb.local
> User-Agent: curl/8.1.2
> Accept: */*
>
* Received HTTP/0.9 when not allowed
* Closing connection 0
curl: (1) Received HTTP/0.9 when not allowed
~/Sites curl -v -4 http://brave_goldwasser.orb.local
*   Trying 192.168.215.2:80...
* Connected to brave_goldwasser.orb.local (192.168.215.2) port 80 (#0)
> GET / HTTP/1.1
> Host: brave_goldwasser.orb.local
> User-Agent: curl/8.1.2
> Accept: */*
>
* Received HTTP/0.9 when not allowed
* Closing connection 0
curl: (1) Received HTTP/0.9 when not allowed
~/Sites curl -v -6 http://brave_goldwasser.orb.local
*   Trying [fd07:b51a:cc66:1:0:242:c0a8:d702]:80...
* Connected to brave_goldwasser.orb.local (fd07:b51a:cc66:1:0:242:c0a8:d702) port 80 (#0)
> GET / HTTP/1.1
> Host: brave_goldwasser.orb.local
> User-Agent: curl/8.1.2
> Accept: */*
>
* Received HTTP/0.9 when not allowed
* Closing connection 0
curl: (1) Received HTTP/0.9 when not allowed
~/Sites

[kdrag0n]

@PhilETaylor That's a different issue. Mailpit's SMTP server on port 1025 trips up the auto port detection. It's been improved for the next version, but in the meantime you can use http://brave_goldwasser.orb.local:8025.

[PhilETaylor]

yeah I see that now that I stopped the container after sending the last message, I returned to the browser and I see

220 519b0ca15e80 Mailpit ESMTP Service ready
500 5.5.2 Syntax error, command unrecognized
500 5.5.2 Syntax error, command unrecognized
500 5.5.2 Syntax error, command unrecognized
500 5.5.2 Syntax error, command unrecognized
500 5.5.2 Syntax error, command unrecognized
500 5.5.2 Syntax error, command unrecognized
500 5.5.2 Syntax error, command unrecognized
500 5.5.2 Syntax error, command unrecognized
500 5.5.2 Syntax error, command unrecognized

which confirms what you said, it was bound to the wrong open port :)

If unrelated to the OP then sorry for the noise.

[te-simonren]

Hi, here is the log. It appears that there is a problem when enabling TUN VPN. Should I exclude the *.orb.local DNS query from the VPN?

nssurge offers a 14-day trial version, and several VPNs use TUN mode to capture all data packets from the entire system.

➜  ~ traceroute container.orb.local
traceroute to container.orb.local (198.18.3.187), 64 hops max, 52 byte packets
 1  198.18.0.1 (198.18.0.1)  0.761 ms  0.334 ms  0.152 ms
 2  * * *
 3  * * *
 4  * * *
^C
➜  ~ curl -v container.orb.local

*   Trying 198.18.3.187:80...
* Connected to container.orb.local (198.18.3.187) port 80 (#0)
> GET / HTTP/1.1
> Host: container.orb.local
> User-Agent: curl/7.88.1
> Accept: */*
>
* Empty reply from server
* Closing connection 0
curl: (52) Empty reply from server
➜  ~ curl -v -4 container.orb.local

*   Trying 198.18.3.187:80...
* Connected to container.orb.local (198.18.3.187) port 80 (#0)
> GET / HTTP/1.1
> Host: container.orb.local
> User-Agent: curl/7.88.1
> Accept: */*
>
* Empty reply from server
* Closing connection 0
curl: (52) Empty reply from server
➜  ~ curl -v -6 container.orb.local

* Closing connection 0
curl: (7) Couldn't connect to server
➜  ~

[kdrag0n]

What about scutil --dns?

[te-simonren]

➜  ~ scutil --dns
DNS configuration

resolver #1
  search domain[0] : localdomain
  nameserver[0] : 198.18.0.2
  flags    : Request A records
  reach    : 0x00000002 (Reachable)

resolver #2
  domain   : local
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300000

resolver #3
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300200

resolver #4
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300400

resolver #5
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300600

resolver #6
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300800

resolver #7
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  search domain[0] : localdomain
  nameserver[0] : 198.18.0.2
  if_index : 14 (en0)
  flags    : Scoped, Request A records
  reach    : 0x00000002 (Reachable)

[te-simonren]

after bypass the 192.168.0.0/16 in VIF Excluded Routers, ip direct access works, but domain access still fail.

➜  ~ traceroute clever_heisenberg.orb.local
traceroute to clever_heisenberg.orb.local (198.18.3.156), 64 hops max, 52 byte packets
 1  198.18.0.1 (198.18.0.1)  0.828 ms  0.253 ms  0.172 ms
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * *^C
➜  ~ traceroute 192.168.215.2
traceroute to 192.168.215.2 (192.168.215.2), 64 hops max, 52 byte packets
 1  192.168.215.2 (192.168.215.2)  1.373 ms  0.923 ms  0.371 ms
➜  ~
➜  ~
➜  ~
➜  ~ curl -v clever_heisenberg.orb.local
*   Trying 198.18.3.156:80...
* Connected to clever_heisenberg.orb.local (198.18.3.156) port 80 (#0)
> GET / HTTP/1.1
> Host: clever_heisenberg.orb.local
> User-Agent: curl/7.88.1
> Accept: */*
>
* Empty reply from server
* Closing connection 0
curl: (52) Empty reply from server
➜  ~ curl -v 192.168.215.2
*   Trying 192.168.215.2:80...
* Connected to 192.168.215.2 (192.168.215.2) port 80 (#0)
> GET / HTTP/1.1
> Host: 192.168.215.2
> User-Agent: curl/7.88.1
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: nginx/1.23.3
< Date: Fri, 11 Aug 2023 13:56:29 GMT

[JunJie-zhang-o]

Have you added orb.local to the bypass proxy list in Surge yet?

[te-simonren]

Yes, I have already added *.orb.local to the bypass proxy settings.

After further testing, it appears that Safari is functioning properly. However, Chrome and Edge (OSX) are not working.

[kdrag0n]

@te-simonren Can you run all the commands again and share the output, along with a new diagnostic report?

[te-simonren]

here are the logs and diagnostic report:

OrbStack info:
Version: 0.16.1 (160100)
Commit: 4235b341267c814080ec0e117d1e680d8f8f8676 (v0.16.1)

System info:
macOS: 13.5.1 (22G90)
CPU: arm64, 12 cores
CPU model: Apple M2 Max

Full report: https://orbstack.dev/_admin/diag/orbstack-diagreport_2023-08-18T06-45-18.172002Z.zip

➜  ~ traceroute clever_heisenberg.orb.local
traceroute to clever_heisenberg.orb.local (192.168.215.2), 64 hops max, 52 byte packets
 1  192.168.166.1 (192.168.166.1)  5.554 ms  2.373 ms  2.511 ms
 2  192.168.0.1 (192.168.0.1)  2.847 ms  3.089 ms  3.570 ms
 3  * *^C
➜  ~ curl -v clever_heisenberg.orb.local
*   Trying [fd07:b51a:cc66:0:a617:db5e:c0a8:d702]:80...
* Connected to clever_heisenberg.orb.local (fd07:b51a:cc66:0:a617:db5e:c0a8:d702) port 80 (#0)
> GET / HTTP/1.1
> Host: clever_heisenberg.orb.local
> User-Agent: curl/8.1.2
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: nginx/1.23.3
< Date: Fri, 18 Aug 2023 06:40:54 GMT
< Content-Type: text/html
< Content-Length: 8702
< Last-Modified: Thu, 22 Dec 2022 20:49:18 GMT
< Connection: keep-alive
< ETag: "63a4c2ce-21fe"
< Accept-Ranges: bytes

➜  ~ curl -v -4 clever_heisenberg.orb.local
*   Trying 192.168.215.2:80...
^C
➜  ~ curl -v -6 clever_heisenberg.orb.local
*   Trying [fd07:b51a:cc66:0:a617:db5e:c0a8:d702]:80...
* Connected to clever_heisenberg.orb.local (fd07:b51a:cc66:0:a617:db5e:c0a8:d702) port 80 (#0)
> GET / HTTP/1.1
> Host: clever_heisenberg.orb.local
> User-Agent: curl/8.1.2
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: nginx/1.23.3
< Date: Fri, 18 Aug 2023 06:41:39 GMT
< Content-Type: text/html
< Content-Length: 8702
< Last-Modified: Thu, 22 Dec 2022 20:49:18 GMT
< Connection: keep-alive
< ETag: "63a4c2ce-21fe"
< Accept-Ranges: bytes
<

➜  ~ scutil --dns
DNS configuration

resolver #1
  search domain[0] : localdomain
  nameserver[0] : 114.114.114.114
  flags    : Request A records
  reach    : 0x00000002 (Reachable)

resolver #2
  domain   : local
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300000

resolver #3
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300200

resolver #4
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300400

resolver #5
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300600

resolver #6
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300800

resolver #7
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  search domain[0] : localdomain
  nameserver[0] : 114.114.114.114
  if_index : 15 (en0)
  flags    : Scoped, Request A records
  reach    : 0x00000002 (Reachable)