All devices under my administration experience the issue that with redirect-gateway and seamless tunnel, push notifications are not working as expected: instead of almost immediate delivery of push notifications via an open channel with APN servers, when sleeping the notifications are polled from the servers with 10-15 min intervals.
Needless to say, this completely breaks real-time communications (VoIP) and severely impacts semi-realtime communications (messengers, urgent mails, etc.). From the user PoV everything appears broken and I get a lot of complaints, some users even turn the VPN off. At the same time we can't disable Seamless tunnel as this would allow a lot of connections to leak outside the tunnel and would defeat the VPN purpose if not entirely, at least partially.
We've already discussed this issue with ordex. As an immediate workaround the recommendation was to try to add a route to APN servers with "route x.x.x.x y.y.y.y net_gateway". I've tried it:
Code: Select all
route 17.0.0.0 255.0.0.0 net_gateway
Why this approach doesn't work? How can I debug it? The OpenVPN log shows:
Code: Select all
NIP: adding (excluded) IPv4 route 17.0.0.0/8
Then, I'd like to also ask if a "proper" solution could be implemented? The problems with the workaround described above is that on the 17.0.0.0/8 network there are a lot of other services, apart from APN, like Apple Ad services and many more that we'd prefer not to route outside the VPN. And finding the exact IPs (or at least a narrow block like /24) is quite difficult as the IPs change on each DNS request and depend on the region where the device is located.
For a robust solution I see 3 possibilities (all 3 would have an option in the settings so the users can decide):
- Request a permission from Apple to always stay awake (for the crypto component, as the GUI is not needed for the tunnel to work), like some internet music players and other classes of apps. In this case the tunnel would be always available (I guess this would be the easiest and the most stable solution).
- Somehow detect from within the app the exact routes that should be added and add them automatically on every reconnect. Probably Apple exposes some APIs for that, or maybe there's some API that instructs push to go directly.
- Implement VPN functionality as a network driver so no app would have to be running for the tunnels to work during sleep.
Please let me know I can contribute economically to help solve this issue.
Thanks,
Anatoli
[1]: https://support.apple.com/en-us/HT203609
[2]: https://developer.apple.com/library/con ... H1-TNTAG41
[3]: https://stackoverflow.com/questions/106 ... ns-servers