Lulu breaks Microsoft Remote Desktop on macOS Sequoia

[Hawkedon]

When enabling Lulu, after about 15 seconds with Microsoft Remote Desktop, I received the following error message:

Your session ended because of a data encryption error. If this keeps happening, contact your network administrator for assistance.

Error code: 0x407

Disabling Lulu fixed the problem. I never encountered this problem on macOS before Sequoia. Seems some updates in macOS Sequoia break Lulu.

[xorxoxor]

I am having similar Problems since the update with SSH connections. I'm randomly getting disconnects. Yesterday I also had issues with stalling downloads via https. I can also confirm your RDP Issues.

[Hawkedon]

Seems there are quite a bit of change for network filtering in Sequoia. For example, this initializer has been deprecated

LuLu/LuLu/Extension/FilterDataProvider.m

Line 82 in 69b51f8

networkRule = [[NENetworkRule alloc] initWithRemoteNetwork:nil remotePrefix:0 localNetwork:nil localPrefix:0 protocol:NENetworkRuleProtocolAny direction:NETrafficDirectionOutbound];

and replaced with

https://developer.apple.com/documentation/networkextension/nenetworkrule/4360323-initwithremotenetworkendpoint

[wastez]

The problem seems to be related to the internal firewall of sequoia.

Just disable the internal firewall until apple will fix that.

[anarchy89]

I am getting drops for ssh (mac/linux), vnc(mac) and Remote Desktop for windows as well.

[sammcj]

Out of interest - if you temporarily disable macOS's inbound firewall - does it resolve the issue?

[jdwhite]

Out of interest - if you temporarily disable macOS's inbound firewall - does it resolve the issue?

Yes, it does. It very much does.

Name of this issue should be renamed to "Lulu breaks networking on macOS Sequoia" except it's not really Lulu. Point is it's not just Remote Desktop. I first noticed it with SSH. Then my Zoom calls were dropping several seconds of audio randomly while others sharing the same internet pipe were entirely unaffected.

[sammcj]

Ok, I’m not surprised. I have a theory that Apple hosed something in the packet filtering stack and it’s causing problems for a lot of applications.

I can reproduce the problems without any third party packet filter - as I can the workaround.

[got3nks]

It's an issue with the firewall in MacOS Sequoia.

https://discussions.apple.com/thread/255759412

[FideliusFalcon]

I have simular issues with MacOS Sequoia, but it's general DNS resolve issues mostly in Firefox.
It seems like the solution is either disabling LuLu (and other network filtering tools) or disabling the build in Firewall on MacOS.

[andrey-admin]

any fix available?

[FideliusFalcon]

@andrey-admin Disable LuLu or Host Firewall until Apple fixes this

[hellpf]

Just use ethernet instead of wifi + off firewall and it works just fine 🤷‍♂️ (for me)

[objective-see]

This has now been confirmed, to yes, be due to an Apple bug in macOS 15, that is widely impacting many 3rd-party security tools, that then in turn causes macOS networking to break.

This has been reported to Apple (and was so before macOS 15 was released), who have confirmed the issue and are hopefully working on a fix.

More info: "Apple’s new macOS Sequoia update is breaking some cybersecurity tools"

[jdwhite]

Just use ethernet instead of wifi + off firewall and it works just fine 🤷‍♂️

If I'm correcting parsing this as use (ethernet + enabled firewall) instead of (wifi + disabled firewall), then no -- it does not work just fine.

Obviously, I can only speak for me but the network interface I used on my M1 MPB did not matter. I tried WiFi, an external 10GB adapter (OWC), and even the virtual interfaces between my host and guest machines in UTM! SSH connections on any of these interfaces would fail miserably. FYI/FWIW.

[iplotin]

Yes, APPLE left everyone in 15.x without a firewall, even their own. Looks like apple is not on the side of security and this was done intentionally. Apple does not equal security.

[wdormann]

Just use ethernet instead of wifi + off firewall and it works just fine 🤷‍♂️ (for me)

Wired ethernet is no better than Wi-Fi for me. Even on wired, I get a Remote Desktop disconnect within minutes if LuLu and the macOS firewall are both enabled. I'm on 15.1 Public Beta 3, FWIW.

[bezzoh]

Agreed. It happens equally with wired connections as it does WiFi.
For me it occurs on 2x iMac M1's. One is wired, one is WiFi. It does not occur on my M3 MacBook Air.
"Just" turning off the firewall is not a fix. Thats like saying, "Just' leave your front door open because you've broke your key. "Just" - no.

[FideliusFalcon]

"Just" turning off the firewall is not a fix. Thats like saying, "Just' leave your front door open because you've broke your key. "Just" - no.

Incorrect. You dont know what a host based firewall is, and what risks it mitigate.

[bezzoh]

Well if you say so, I guess you could just ring all the various Cyber Insurance underwriters who insist that they're enforced to keep the premiums down then...

In an enterprise environment, these are on by policy for such reasons. See we wont be paying an additional £10k on the policy, just so that we can turn this off...

and yes, it protects the device from the other 4000 or so other devices in the estate which may or may not at some point potentially become compromised. In additional to all the home workers who take their laptops into the various public WiFi locations at coffee shops and such like... I see this feature as pretty important.

[FideliusFalcon]

If you work at an enterprise and have a device that is not rolled into a MDM, they don't care about endpoint security.

I'm pointing out that your analogy is wrong, not that every security policy is.

I will stop replying now because it's out of scope of the original thread

[bezzoh]

Fair one 😊

In other news, one of my staff currently using one of the affected iMacs advises me that it updated to 15.1 about an hour ago (I set that particular one to the public beta channel,) and he reckons it seems to have fixed the problem. All RDP connections via the Windows App have been rock solid since.

[wdormann]

I can confirm that RDP works again fine with LuLu once I installed the recently released Sequoia 15.1 public beta 4.

[M4rt1n12]

The problem seems to be related to the internal firewall of sequoia.

Just disable the internal firewall until apple will fix that.

Unfortunaly not in my case. Both Jump App and Microsoft App fail.
nmap port scan is OK. Other iMac with Ventura work.

I even don't have LuLu installed and don't know it. It doesn't work anyway, or it only works "sometimes".

[M4rt1n12]

With the beta it actually works again.