We Put Colitu's VPN Verification to the Test. Here’s What Changed.

Description and use

Colitu updated its VPN verification to fix tunnel drop, network transition, and DNS issues, improving connection reliability.

Problem

A VPN handshake may succeed while the tunnel cannot carry traffic, potentially causing the application to report a working connection incorrectly.

Outcome

The updated Colitu VPN client now reliably verifies tunnel connectivity, recovers quickly from network transitions, and maintains DNS consistency, reducing false positives in connection checks.

Workflow

• 1. Build controlled environment where VPN server accepts handshake but drops tunnel traffic while verification endpoints stay reachable via normal internet.
• 2. Run automated tests and real‑device tests on Windows and Linux.
• 3. Identify issues: split‑tunneling affecting verification, delayed recovery on network change, DNS inconsistency.
• 4. Implement fixes: dedicated tunnel‑bound verification path, immediate reconnection on address/gateway change, tunnel‑bound DNS resolution.
• 5. Release updated binaries and document changes in Colitu Lab research.

Evidence

We built a controlled environment where a VPN server accepts the handshake but silently drops traffic inside the tunnel, while verification endpoints remain accessible through the normal internet connection.

Source

We corrected this behavior. Connection checks now use a dedicated, tunnel‑bound verification path that cannot be redirected by ordinary routing rules.

Source

Colitu now detects address and gateway changes, invalidates previous verification, and begins reconnecting within seconds.

Source

We standardized tunnel adapter handling so DNS resolution follows the VPN tunnel across the tested Windows transports.

Source