2

I am now looking after someone else's Mac, running Ventura 13.4. Everything was fine up until last Friday. And then it suddenly lost "most" Internet connectivity.

To be precise, Zoom, virus scanner updates, Safari, etc. does not work. I cannot go anywhere.

The computer previously had access to our company's LAN and WiFi. Both still work -- I get green lights in the System Settings. But that's all -- only confirmation in the system settings that they are connected. I then disabled both and tried to tether it through my phone. Again, I get connected, but none of the above applications work -- I cannot access anything.

I also tried to go to www.google.com using curl and I get a "Couldn't connect to server". Repeating this with its IP address doesn't work as well.

So, I think this safely eliminates any problem with our company's network...

What does work on all 3 (WiFi, LAN, and tethering) is I can open up a terminal and ping. In fact, I can ping www.google.com by domain name, which gets translated to its IP address with no problems.

I browsed through the system's log files in /var/log and nothing caught my eye, though I don't know what I'm looking for.

I don't have much Mac experience, but I do have Linux experience. I don't believe I've seen something like this before.

Any help would be appreciated!


Edit 1:

I was unable to run ipconfig getpacket en0 because nothing was returned. However, I ran ifconfig and noticed two interfaces were "active" (en0 was inactive). en1 and awdl0 were the only two out of 23 that are active. With en1, I get:

% ipconfig getpacket en1 | grep -i "router\|domain\|ciaddr"
ciaddr = 0.0.0.0
yiaddr = 10.206.233.147
router (ip_mult): {10.206.128.1}
domain_name_server (ip_mult): {10.255.250.1, 10.255.250.2}
domain_name (string): XXX.ac.uk

(Nothing gets returned with awdl0.)

Edit 2:

The computer in question has a LAN cable that is currently unplugged. Presumably, that is en0.

Edit 3:

% host bing.com            
bing.com has address 204.79.197.200
bing.com has address 13.107.21.200
bing.com has IPv6 address 2620:1ec:c11::200
bing.com mail is handled by 10 bing-com.mail.protection.outlook.com.

% ping 204.79.197.200
PING 204.79.197.200 (204.79.197.200): 56 data bytes
64 bytes from 204.79.197.200: icmp_seq=0 ttl=116 time=9.737 ms
64 bytes from 204.79.197.200: icmp_seq=1 ttl=116 time=6.555 ms
64 bytes from 204.79.197.200: icmp_seq=2 ttl=116 time=9.262 ms
64 bytes from 204.79.197.200: icmp_seq=3 ttl=116 time=10.751 ms
^C
--- 204.79.197.200 ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 6.555/9.076/10.751/1.552 ms

% traceroute 204.79.197.200
traceroute to 204.79.197.200 (204.79.197.200), 64 hops max, 52 byte packets
 1  10.206.128.2 (10.206.128.2)  9.470 ms  3.529 ms  3.309 ms
 2  10.3.4.46 (10.3.4.46)  4.026 ms  3.421 ms  3.198 ms
 3  10.3.1.53 (10.3.1.53)  4.545 ms  3.974 ms  3.930 ms
 4  10.3.2.9 (10.3.2.9)  4.893 ms  5.478 ms  4.011 ms
 5  * * *
 6  * * *
 7  * * *
^C

% curl 204.79.197.200
curl: (7) Failed to connect to 204.79.197.200 port 80 after 10 ms: Couldn't connect to server
20
  • Let's start with some basic info. Issue the command ipconfig getpacket en0 | grep -i "router\|domain\|ciaddr" Paste that with an edit to your question. You can send it directly to your clipboard by piping the output with | pbcopy at the end of the command. (And no, it's not a typo, the command is ipconfig with a "P")
    – Allan
    Jun 22, 2023 at 14:28
  • Thanks @Allan! I've updated the question using the command you suggested. I don't know what the output means, but something seems wrong with ciaddr... Thank you in advance!
    – Ray
    Jun 22, 2023 at 19:08
  • Thanks for the update. ciaddr is "Client IP Address." Seeing that yours is coming back empty, rerun and add \|yiaddr before the last quote. Both of these should be your assigned address (from DHCP) and are usually the same, but let's check to make sure.
    – Allan
    Jun 22, 2023 at 20:12
  • awdl0 is a Bluetooth connection so unless you're internet sharing using your phone via BT, there's no worry there.
    – Allan
    Jun 22, 2023 at 20:15
  • You're not behind a firewall? Did you say you were on the "company LAN?"
    – Allan
    Jun 23, 2023 at 14:27

2 Answers 2

1

From your description of your problem it is a typical GlobalProtect VPN filtering misbehaving, either because of an error at the filtering on the PaloAlto firewall of your company or within the macOS client.

For anyone seeing the same problem:

  • ping is OK, DNS is OK,
  • http/https through any physical interface ( Ethernet, Wi-Fi, USB toward an iPhone…) is blocked,

the cleanest solution is to completly uninstall GlobalProtect: uninstall GlobalProtect on macOS and next to report the problem to the security admins of your company for them to test, analyze and fix it.

2
  • 1
    Thanks for this! Your description is fairly accurate. I didn't know it was "typical" for GlobalProtect. Obviously, I didn't choose them but looking online, it seems some people aren't happy with it.
    – Ray
    Jul 6, 2023 at 10:05
  • 1
    This has been a professionnal nightmare for me. Made more damage than cyber-attacks. But a firewall with one of the sexiest interface as long as you don't touch it too often.
    – dan
    Jul 6, 2023 at 21:19
0

Here are a few troubleshooting steps you can try:

  1. Clear DNS cache: Open the Terminal and enter the command sudo dscacheutil -flushcache to clear the DNS cache. This can help resolve any potential DNS-related issues.

  2. Reset network settings: Go to "System Preferences" > "Network" and select the active network connection (e.g., Wi-Fi or Ethernet). Click the minus (-) button to remove it, then click the plus (+) button to add it back. This will reset the network settings for that connection.

  3. Check proxy settings: In "System Preferences," go to "Network" and select the active network connection. Click on "Advanced" and navigate to the "Proxies" tab. Ensure that no proxy settings are enabled unless required by your network configuration.

  4. Reset TCP/IP stack: Open the Terminal and enter the following commands one by one:

    • sudo dscacheutil -flushcache
    • sudo killall -HUP mDNSResponder
    • sudo killall mDNSResponderHelper
    • sudo dscacheutil -flushcache
  5. Disable firewall and security software temporarily: Temporarily disable any firewall or security software you have installed and check if that resolves the issue. Remember to re-enable them afterward for security purposes.

  6. Verify date and time settings: Ensure that the date and time settings on your MacBook are accurate. Incorrect date and time settings can sometimes cause issues with secure connections.

2
  • 1
    There is no "System Preferences" in macOS Ventura. Also, if you copy answers from somewhere else, please link back to the source for reference.
    – nohillside
    Jul 1, 2023 at 7:26
  • @nohillside Thank you for pointing this out so that I don't keep looking... macOS does change from version to version slightly...
    – Ray
    Jul 5, 2023 at 9:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .