MacOS – Company Mac OS laptop must connect to Cisco AnyConnect VPN in order to access to the Internet

I had the same problem on my Mac, and after fixing it I have figured out that it was caused by FortiClient (VPN client). Even when FortiClient was disconnected - it's DNS still appeared in the scutil.

The solution for me was:

scutil
> list ".*DNS"

This will show you a list of all DNS configs, that will look something like:

subKey [0] = State:/Network/Global/DNS <br>
subKey [1] = State:/Network/MulticastDNS<br>
subKey [2] = State:/Network/OpenVPN/DNS<br>
subKey [3] = State:/Network/OpenVPN/OldDNS<br>
subKey [4] = State:/Network/PrivateDNS<br>
subKey [5] = State:/Network/Service/forticlientsslvpn/DNS <br>

To check each of them run: (until you find the problematic one)

> get key_name
> d.show

…and to fix it run:

> get key_name
> d.remove ServerAddresses
> set key_name

This is how it looked on my machine:

> get State:/Network/Service/forticlientsslvpn/DNS 
> d.show
<dictionary> {
  ServerAddresses : <array> {
    0 : 192.168.30.6
    1 : 192.168.30.15
  }
  SupplementalMatchDomains : <array> {
    0 :
  }
  SupplementalMatchOrders : <array> {
    0 : 100000
  }
}
> d.remove ServerAddresses
> d.show
<dictionary> {
  SupplementalMatchDomains : <array> {
    0 :
  }
  SupplementalMatchOrders : <array> {
    0 : 100000
  }
}
> set State:/Network/Service/forticlientsslvpn/DNS
> exit

Let's set aside any solution where you bring a second piece of networking gear to the problem. Let's also let the problem of stopping traffic after the VPN fails to this related, but different question.

I look at this problem as a user centric solution and not something that's easily accomplished by modifying the OS X behavior.

Set up two accounts on your Mac (neither need be admin accounts, but if either is, you won't need a third account to change system settings).

1. A shell account that exists to run nothing and only establish the VPN connection.
2. A main account that will run the programs you wish to ensure only get access to the network once it has been properly secured with a VPN.

So, with fast user switching enabled, you can log out of the main account. This ensures that no programs or processes from that user will continue running in the background. Most OS X apps are well behaved, and suspend network access when they don't have an active window on-screen, but you'd have to monitor and test this forever to be sure nothing is happening - logging out is simpler to maintain.

Now, you could also replace "account" above with OS and run a virtualization system like Fusion (or Parallels or any other) and only start the guest OS once the host OS has secured everything on a VPN. Depending on the VM software you choose, you also may have control over the network and can turn on and off access even when the guest OS (or OSes) are running. This is basically simulating the extra hardware I initially said I wouldn't consider.

I hope this shows one way you could be more secure while traveling and using a network that you don't trust while minimizing the risk that this will always entail. If someone else owns the network - they own DNS, can log packets, can try man-in-the-middle (MITM) attacks as well as inspect all of your packets deeply to try to determine what is flowing inside the VPN tunnel.