Insight for why iOS banking apps won't authenticate through vpn

[brinohm]

I'm very new to the Algo VPN, but I read a really great article about it and wanted to try it for myself. I set up space on AWS EC2 and deployed Algo to the server using the recipe here in the repo and everything seemed to go perfectly. I set it up on an iphone running iOS 14 with WireGuard and most everything works exactly as expected. The traffic is routing from the Algo server. I can access websites, email, most everything. However, when I try and use a banking app, the authentication fails and says some variation of "the login service isn't available". This happens on different apps (banking, credit card, etc). I've not seen this behavior when I use a commercial VPN service and I'm wondering if I didn't configure something correctly or I need to make some adjustment. I appreciate any advice or insight. Thanks!

[davidemyers]

You will certainly encounter sites that block access from cloud provider networks, but in my experience fewer sites block access from AWS and I don't personally have issues with my banking or credit card apps when using Amazon Lightsail.

Did you deploy Algo with DNS adblocking? Perhaps that's getting in the way. You can easily test this by changing the DNS setting in the WireGuard app. Make a note of the current value for DNS and change it to 8.8.8.8. Your DNS requests won't be encrypted upon leaving your AlgoVPN with this change, but you can quickly determine if Algo's DNS adblocking is causing your problems.

[brinohm]

No worries and thank you for all your help! I'm glad you took the time to help me work through the challenge! Everything is working for me. Much appreciated!

[brinohm]

I think I spoke too soon. So, here's what I'm seeing. If I comment out the blacklist_file for the "[ip_blacklist]" then the problem goes away, but if I only comment out the blacklist_file under the "[blacklist]" section, then I still have the issue. I think it might take a short period of time to show up though (cache of some sort in the app maybe?) because when I did the update the first time (commenting out just the one line and not both) it seemed to work, but then a little later the original issue came back. I'm seeing it in other places as well, like HBO Max couldn't find the server, or an app giving an error message like "A server with the specified hostname could not be found" for example. If I comment out the blacklist_file line under the ip_blacklist section though (that and only that, or that line plus the one under "[blacklist]", doesn't matter as long as the ip_blacklist blacklist_file is commented out), the problem goes away and consistently works.

I don't want to just go commenting stuff out which seems essential, particularly when I don't know what I'm doing. Any thoughts as to what could be happening? I'm seeing this issue on both an ipad and an iphone.

[davidemyers]

In issue #14286 people reported problems with using Cloudflare for DNS. See that issue for how to change to Google or Quad9 and see if that helps.

[brinohm]

Thanks @davidemyers that thread was extremely helpful as well. I made similar adjustments to the DNS being used and that seems to have solved the issue. I updated the .toml file, restarted the service and waited a bit just for sanity sake, deactivated and reactivated the VPN on the client devices (ipad and iphone) and everything seems to be working perfectly. No issue with banking apps, no issue with streaming services, etc. I also reverted the changes to the blacklist_file that we originally talked about and retested again and confirmed that it looks like that wasn't the underlying issue, so that was good too. Thank you again for all your help, it's greatly appreciated!

[davidemyers]

Since that issue had recently been quiet I assumed that Cloudflare had fixed their issues (I use Quad9). I'm sorry I sent you down the wrong path initially.