Weird LAN networking connectivity issue

[kasin]

The 100.X could be the clue. That 100.X range is a private VPN. Possibly the return UDP packets are being sent out a different route than the input UDP packets. Why this is only happening to FG and not other applications isn't clear. lsof shows FG is binding to the wildcard and not binding to a specific IP address.

UDP 192.168.2.226 -> 192.168.2.2 with netcat works
UDP 192.168.2.2 -> 192.168.2.226 with netcat works
UDP 192.168.2.226 <-> 192.168.2.2 with FG doesn't work, possibly because it is trying to send it down the 100.X route.

The system route table doesn't reflect this, so I am not sure why it is trying to route those packets down that interface, but it does fit the observed data. Possibly it is related to the .et crash. I'll try it without the VPN running while on the same VLAN to confirm.

That .net crash is also interesting and I'll try updating the .net libraries, as per the suggestion.

I'll also try sending larger amounts of data via UDP to check for UDP flood protection.

[TVDinner]

When you hit the "Load Campaign" button the address FGU is binding to is in the box on the lower right, along with the external address. If the bound address is anything other than 192.168.2.x, things probably won't work. Binding to the 100.71.x.x address should not work.

Once you fix the binding address problem, I'd still get rid of the loop in the 192.168.2 network. I presume FG licensed a network library that handles the connections over UDP, and who knows exactly how that works.

[TVDinner]

I'm not sure the "other applications" are trying to establish a connection over UDP. I think netcat just blasts packets out and you count them on the other end. You really want something that sends packets, and then listens for the other end to send the packets back.

[kasin]

After a long absence I am posting as I believe I found the issue.

Mac OS sequoia introduced a new permission called local network access. Applications using certain API's trigger an OS prompt to give the application permission to access resources on the same subnet. However, it seems somewhat buggy. In particular it can mistake which is the correct application and trigger the prompt for the wrong application. For me, I had "humankind" pop up when fantasy grounds launched which was a critical clue.

This was so difficult to troubleshoot as packet captures showed everything was fine, because it was an issue at a layer of abstraction above the level of the packet capture. All of my manual testing was from the terminal which is automatucally granted this perission, so it always works. This drove me nuts for month!

Steps to troubleshoot:
1. On the Mac check system settings -> privacy and security. Fantay grounds should be listed. If it is listed, turn on local network access. If it is alredy turned on, try turning the permission off and on again. For me it is not listed as it has either not asked for the permission correctly, or Mac OS has it confused with another piece of software such as other unity based software.

Workarounds:
1. Connect from a different network. If you are network savvy, create a different subnet.
For me, I have a guest WIFI network which is on a different subnet (192.168.3.0/24 vs the server which was on 192.168.1.0/24) and that was sufficient.

2. Alternatively, launch fantasy grounds from the terminal. Launch the terminal and launch FG with: /Applications/SmiteWorks/Fantasy\ Grounds/FantasyGrounds.app/Contents/MacOS/Fantasy\ Grounds
I can't check this because I did the below step, but it should work as applications launched from the terminal inherit the terminal's permissions.

3. Resetting the entire privacy and seceutiy subsystem.
WARNING: I haven't tried to do this myself, but the docs reference doing so. It will delete your otehr privacy and security settings.
Alternatively, if you don’t want to delete your app for some reason, reset the entire privacy subsystem using Settings > General > Transfer or Reset > Reset > Reset Location & Privacy.
https://developer.apple.com/document...etwork-privacy

4. Reinstall OS. I ended up doing this. It was pretty painless on my M1 pro laptop and I barely noticed any difference after reinstalling. This seems to have permanently fixed the problem.

5. I did try looking into how Mac OS stores this permissiom, but there is limited documentation on it and no API access, whie the raw databases are protected (system integrity protected) so I just gave up and reinstalled.

[TVDinner]

Thank you for making the solution that worked for you available to the search engines and the various humans who try to help out. I'm sure someone else will find this helpful in the future.

[jkusters]

Amazing work. Assuming this is the actual issue, Smiteworks will need to add the appropriate entitlement to the app and send out updates.

4. Reinstall OS. I ended up doing this. It was pretty painless on my M1 pro laptop and I barely noticed any difference after reinstalling. This seems to have permanently fixed the problem.

How did you do this? Non-destructively from the macOS Recovery boot up option? Or did you wipe the machine and reinstall from there? I'm hoping the former.

[Morenu]

Mac is one of the easiest reinstalls I have done... been a few years, but plenty of YT videos on it

[jkusters]

Believe me, I’m very familiar with reinstalling macOS in many ways, some pretty benign, some very destructive. I tried the most benign way, and unfortunately it didn’t work for me. I’m not up for a full wipe and restore at this time, so I’m investigating alternative VTTs until the actual issue is addressed.

[kasin]

Amazing work. Assuming this is the actual issue, Smiteworks will need to add the appropriate entitlement to the app and send out updates.

How did you do this? Non-destructively from the macOS Recovery boot up option? Or did you wipe the machine and reinstall from there? I'm hoping the former.

I suspect they do as fantasy grounds works fine on a different Mac.

Non-destructively from the recovery boot up option.
https://www.lifewire.com/restart-a-m...y-mode-5184142

[shellbackrob]

That worked out perfectly...just needed to set the correct accessibility and things were good to go! Thank you for the post/guidance - very helpful!