1

When connected to my VPN (in this case using the OpenVPN app Viscosity) it creates a utun interface that looks like this when queried using ifconfig utun10:

utun10: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
    inet 10.20.0.30 --> 10.20.0.30 netmask 0xffff0000
    inet6 aaaa::bbbb:cccc:dddd:eeee%utun10 prefixlen 64 scopeid 0x17
    inet6 ffff:aaaa:bbbb:cccc::dddd prefixlen 64
    nd6 options=201<PERFORMNUD,DAD>

From the command line or (better yet) programmatically, is there any way I can figure out the hostname or IP address of the VPN server that's on the other end of utun10?

Improve this question
3
  • I don’t think sparklab documents where on the filesystem (if even it logs to the filesystem) the connection log containing this data resides. You need the application logs to tell you what the host is - it’s too late to back track from the utun10 since the other active interfaces will have the live connection to the server - the tunnel describes what gets tunneled - not to where the first hop is
    – bmike ♦
    Commented May 30, 2022 at 15:38
  • @bmike Is that to say then that utun10 (and any utun interface in general) does not have any kind of metadata or method for figuring out where its traffic goes? I'm still new to virtual interfaces, so I wasn't sure if their data goes somewhere identifiable or if it's just a general purpose channel where the app that created it simply receives its input and then does whatever it wants with it. (In the case of Viscosity, that's probably sending it over a UDP connection to the VPN server.)
    – Bri Bri
    Commented May 30, 2022 at 15:54
  • Yes - I’ll answer as best I can. My VPN that hits AT&T goes out en0 to a 12.x.x.x and my other VPN that hits Level 3 goes out en0 to 4.x.x.x on IPv4 but you could have an IPv6 endpoint, so be sure to check both
    – bmike ♦
    Commented May 30, 2022 at 16:16

1 Answer 1

Reset to default
2
+200

The best / worst you can do from the tunnel is get the routing for all networks that that tunnel has established:

netstat -lnI utun10

It should track closely to what you see for the ifconfig on the routing. It’s not really possible to deduce from which gateway you brought up this tunnel since you contacted the VPN server on another interface (likely en0) if you have one Ethernet only built in on the Mac. So the short answer to your question is that information isn’t retrievable from utunX

You will need to get at the logs of your VPN client and/or run netstat on another interface to see which gateway takes the tunneled traffic.

Here is the information for the mac client I think you are using:

Once you have that application log, you might be able to search in console.app if it perhaps logs to the unified database / file storage logs on macOS. Worst case, you need that client (or another client) to log connection details so you can automate scripting your query.

Improve this answer
7
  • Is there a way to get netstat not to truncate IPv6 addresses when using -I utun10? The -W argument doesn't appear to work in this case.
    – Bri Bri
    Commented May 30, 2022 at 17:01
  • The -l in my answer prints the full IPv6 on Monterey. Adding W isn’t needed @BriBri
    – bmike ♦
    Commented May 30, 2022 at 17:25
  • Looks like that's just an issue with netstat in macOS 10.14 then. Tried it out on a Monterey system and got the full addresses. Currently it looks like you are correct that it's not possible, and in the case of the VPN I'm testing with, there's nothing useful that can be gleamed from any of the IP addresses (v4 or v6) that are associated with utun10.
    – Bri Bri
    Commented May 30, 2022 at 18:22
  • You’ve got a great bounty up - if someone else is more clever, I bet you’ll get another answer. Short of dumping the traffic from en0 or whichever interface sends packets to the tunnel endpoint and then filtering out other traffic to all non-VPN gateways, I can’t think of a way besides getting the client to tell you directly what happened when you connected…
    – bmike ♦
    Commented May 30, 2022 at 18:31
  • 1
    @bmike Alas no one that was more clever than us posted an answer, but I think your answer is likely the correct one nonetheless. The good news is that I have found alternative methods for discovering which VPN a utun interface corresponds to. (e.g. sending requests through the interface to a VPN's API that checks its public IP address, or scripting Viscosity with AppleScript to check what its active connections are)
    – Bri Bri
    Commented Jun 6, 2022 at 16:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .