2 ms·

FYI the standalone encrypted DNS profiles for macOS (.mobileconfig files) do not work if you're using Little Snitch or Lulu to block unwanted network traffic. T

FYI the standalone encrypted DNS profiles for macOS (.mobileconfig files) do not work if you're using Little Snitch or Lulu to block unwanted network traffic. This is a limitation of macOS that Apple hasn't bothered to fix.

WirelessGigabit 3y ago
Doesn't work how? Little Snitch / Lulu don't use the profile? As in DNS traffic is not encrypted? Little Snitch / Lulu die? Do you have like a ticket for more explanation?
- Etheryte 3y ago
  You can have one or the other active at a time, but not both simultaneously. If you have the DNS profile turned on and then proceed to turn on Little Snitch/Lulu, the DNS profile will get turned off by macOS and whatever other DNS configuration you have will take precedence. It's mentioned in passing by Mullvad in the docs [0]: > If you have more than one profile added then macOS seems to use only the last one that you installed. If you remove a profile then it appears that it will not use any of the other profiles. This isn't unique to Little Snitch/Lulu and Mullvad though, you would run into the same problem with any application that creates a network filter by using a profile, see [1] for example. Since the full blown Mullvad VPN app does not use system profiles, it does work in tandem with Little Snitch/Lulu. [0] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#macOS https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#... [1] https://git.codeproxy.net/paulmillr/encrypted-dns/issues/13 https://git.codeproxy.net/paulmillr/encrypted-dns/issues/13
  - TheNewsIsHere 3y ago
    As a tangential aside: this limitation on Network Extensions is infuriating. I can understand why it exists, but one of the results is that if you’re using an Endpoint Security extension, it can’t also act as a filter. I’ve never been able to get CrowdStrike Falcon and Little Snitch to work on the same machine because of this. It would be nice if you could have n filters (and a limit on n isn’t unreasonable).
Erratic6576 3y ago
I guess the solution is to use unbound
quyleanh 3y ago
Even when I don’t use any firewall app, the DNS profile doesn’t work on macOS. There is a bug that other apps (and even system) can bypass it. Not like in iOS, DNS profile work very well.

WirelessGigabit 3y ago

Doesn't work how? Little Snitch / Lulu don't use the profile? As in DNS traffic is not encrypted? Little Snitch / Lulu die? Do you have like a ticket for more explanation?

Etheryte 3y ago
You can have one or the other active at a time, but not both simultaneously. If you have the DNS profile turned on and then proceed to turn on Little Snitch/Lulu, the DNS profile will get turned off by macOS and whatever other DNS configuration you have will take precedence. It's mentioned in passing by Mullvad in the docs [0]: > If you have more than one profile added then macOS seems to use only the last one that you installed. If you remove a profile then it appears that it will not use any of the other profiles. This isn't unique to Little Snitch/Lulu and Mullvad though, you would run into the same problem with any application that creates a network filter by using a profile, see [1] for example. Since the full blown Mullvad VPN app does not use system profiles, it does work in tandem with Little Snitch/Lulu. [0] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#macOS https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#... [1] https://git.codeproxy.net/paulmillr/encrypted-dns/issues/13 https://git.codeproxy.net/paulmillr/encrypted-dns/issues/13
- TheNewsIsHere 3y ago
  As a tangential aside: this limitation on Network Extensions is infuriating. I can understand why it exists, but one of the results is that if you’re using an Endpoint Security extension, it can’t also act as a filter. I’ve never been able to get CrowdStrike Falcon and Little Snitch to work on the same machine because of this. It would be nice if you could have n filters (and a limit on n isn’t unreasonable).

Erratic6576 3y ago

I guess the solution is to use unbound

quyleanh 3y ago

Even when I don’t use any firewall app, the DNS profile doesn’t work on macOS. There is a bug that other apps (and even system) can bypass it. Not like in iOS, DNS profile work very well.