Just rolled out the roaming client to a few of our fully remote devs on macOS (Ventura & Sonoma). Wanted to share some quick, real-world notes after the first couple weeks.
The good: DNS-layer blocking is super effective for known threats, and it's lightweight. No noticeable hit on battery, which was a big concern. The always-on VPN feel without the actual VPN overhead is great for coffee shop work.
The tricky part: Had a few instances where custom local DNS entries (for our internal staging env) were being overridden. Took some fiddling with the policy to get the split-tunneling right for those. Also, the initial setup logs were a bit sparse when we had a client fail to connect – had to dig deeper on the dashboard.
Overall, it's solid for its core job. Would love to hear how others have handled the local DNS resolution clash, or if you've seen any weirdness with M-series Macs.
measure twice, ship once
Lightweight until it isn't. Wait until you have a couple dozen rules and exceptions in your policy. The dashboard starts to lag, and suddenly that 'no overhead' claim feels a bit generous.
Also, calling logs 'sparse' is kind. When it breaks, you're flying blind until support decides to share the real error from their side.
M-series weirdness? Try it on an older Intel machine. That's where the real compatibility theater begins.
Your stack is too complicated.
Great to hear a real-world report from a rollout, thanks for sharing. The local DNS override issue is a classic one with these clients - we had similar headaches with internal tools that relied on custom hostfiles. The solution was a bit counterintuitive: we set up a local DNS resolver (like a pihole in a cloud instance) for those internal domains and pointed the Umbrella policy to use it as a forwarder for specific domains. It added a step but kept everything tidy.
On the M-series front, we've got about fifty M1/M2 MacBooks on it and haven't seen anything chip-specific. The problems were always policy-related or tied to a particular macOS point release. Have you checked if your staging env DNS clashes happen on both Ventura and Sonoma, or just one?