Issue with In app Tunnel configuration

[TUMAS]

Hi all,

So I am testing out in app vpn on WS1. I created the UAG and is all setup as it should. Tunnel is installed on my android device and show green and "Connected"

Now my issue is here.. I have a policy which pushes the web app onto my device which has the vpn creds binded to it it so it connect directly to the UAG and eventually access the internal app required. This is not happening for some reason. When I looked at the tunnel logs I get the following:

Tunnel Session connected

Tunnel DNS servers: 127.0.0.53

Tunnel Session successfully established.

Now on my UAG i have my proper DNS settings configured so the question is: Is the 127.0.0.53 not allowing me to access my internal apps?

Also I went to the path where the 1270.0.53 is and I changed it but after a reboot it goes back to default. What am I doing wrong here?

Any help and guidance would be appreciated!         

[rsaulitis]

Hi TUMAS​

Have you configured Tunnel in WS1 ? Under device traffic rules you must configure application and url to which allow access. Remember to configure tunnel configuration under correct OG, because it can be different in each.

[TUMAS]

Thanks for your reply. Yes I configured tunnel and the icon is green showing that its up and running. DNS is also configured with correct IPS. When i go on the tunnel diagnostics on the device it shows a dns of 127.0.0.53 which I have no idea where it came from.

[rsaulitis]

Ok, but what you see under device traffic rules? Is all traffic bypass or tunnel ? Or specific app's configured to access VPN?

[TUMAS]

I have one rule - Action: Tunnel application: web-woekspace ONE Android and destination our proxy

[rsaulitis]

Destination should be url of website what you would like to access not proxy. If I understood correctly then you have configured device to be able access only your proxy via workspace ONE web app.

[TUMAS]

OK so destination should be the actual internal URL? What about the logs on the tunnel. Why is it showing 127.0.0.53?

[TUMAS]

I changed the destination to the path we access the link internally, however the same issue.

[rsaulitis]

Yes destination should be actual URL. About logs have no idea, could you say where did you find that DNS entry in logs? I will check there in our environment.

[TUMAS]

The logs I found them when i open the tunnel app and go to diagnostics

[rsaulitis]

Strange, I don't see anything related to DNS there in diagnostics.

[TUMAS]

Thats because yours is working correctly

This is what shows on mine

[TUMAS]

Sorry previous post didnt have the screen shot

[TUMAS]

Any idea pls?

[AlexanderMuc]

Hi Tumas,

the Tunnel DNS server is completely normal with 127.0.0.53 on Android. Prior the UAG version ~3.7 you could see there the DNS servers of the UAG.

I can guess from the text that the settings in WS1 for VMware Tunnel has been configured and a VPN profile has been created for the device. The tunnel application was successfully installed on the UAG and the device can reach the UAG.

1) Is the VPN profile assigned to the application the App-Assignment? (The app should be visible in the tunnel client)

2) Is the default rule for Device Traffic Rules configured correctly in the WS1 Tunnel Configuration? (Action = Tunnel; For three destinations you should set BYPASS to prevent problems with some WorkspaceONE-Apps: *api.na1.region.data.vmwservices.com*,*discovery.awmdm.com*,*signing.awmdm.com*)

3) Are the server traffic rules in the WS1 tunnel configuration correctly configured? (Should be "Bypass" for internal addresses and "Proxy" for external addresses)

4) Which DNS servers are configured in the UAG settings? *

5) Are you sure that the problem is not caused by the firewall?

* With Android, in some cases the subject around DNS does not work properly. If you are using an internal DNS server, which only resolves internal addresses and does not do any DNS-forwarding, you have a problem.

If traffic is tunneled with the UAGs and routed to the internet via proxy, there is a difference between Android and iOS:

- With iOS, the hostname is resolved at the last endpoint. This is your proxy for external traffic and the UAG for internal traffic.

- With Android the name resolution is always done by the UAG. You can also add host entries in the tunnel settings on the UAG to fix the problem for individual servers.

Anyway: 127.0.0.53 is normal on Android. The DNS servers configured in the UAG are used for name resolution.

[TUMAS]

1) Is the VPN profile assigned to the application the App-Assignment? (The app should be visible in the tunnel client)

Yes its assigned to the web app

2) Is the default rule for Device Traffic Rules configured correctly in the WS1 Tunnel Configuration? (Action = Tunnel; For three destinations you should set BYPASS to prevent problems with some WorkspaceONE-Apps: *api.na1.region.data.vmwservices.com*,*discovery.awmdm.com*,*signing.awmdm.com*)

Not sure what you mean by this. My settings are at Tunnel. I added all the applications to be sure it works and then as for destination I entered the internal link we use to access our internal webapp. Is this correct?

3) Are the server traffic rules in the WS1 tunnel configuration correctly configured? (Should be "Bypass" for internal addresses and "Proxy" for external addresses)

Depends if the above is correct.

4) Which DNS servers are configured in the UAG settings? *

Our internal DNS Servers

5) Are you sure that the problem is not caused by the firewall?

It shouldn't be the case.

Really not sure why its not working here. Any help thrown this way would be greatly appreciated.

[AlexanderMuc]

You can configure the Device Traffic Rules as shown in the screenshot. This config tunnels all apps with a VPN profile.

Specific apps or destinations only need to be specified if you want to control the traffic in detail.

For the server traffic rules you should only enter one rule for testing:

Destination: *

Action: BYPASS

If you do not have specific error messages (e.g. from the browser), we can only make guesses about the cause of the error.

You should also check out the dokumentation: Configure Network Traffic Rules for the Per-App Tunnel

[TUMAS]

Thanks for the reply. I did the below and the browser did load so thats a big improvement!

I now got an net::ERR_CONNECTION_TIMED_OUT error which is pointing to my identity provider (OKTA)

[TUMAS]

Anyone ever had this issue?

[AlexanderMuc]

If we get an error message without any context to the configuration, nobody will be able to help you here.

If you used an FQDN, at least the name resolution works. However, your destination is not reachable. This may be due to missing firewall rules. (If you have a web service that is only accessible with 443tcp, it is recommended to write "https://" in front of the URL, so that no http-request on port 80tcp is triggered)