2

I am using NETunnelProviderManager in "routing by destination IP" and am able to get IP traffic from various apps on the device.

The challenge I am having is that I need to determine which application each packet has come from so I can filter and block traffic as needed, so I can prevent a rogue app being created to access an internal location. It is not feasible for me to use NETunnelProviderManager's "per-app" mode since I am not using MDM.

It seems that if I had access to the system's TCB table (or access to the TCB table for each process) I could do this, but it looks like iOS does not publish this information and I haven't found any private APIs either to get this information on a non-jailbroken device.

Any ideas?

  • I am going to assume you read this? developer.apple.com/reference/networkextension – norcal johnny Oct 4 '16 at 5:52
  • Yes, I have gone through the spec and documentation in detail. I did not see anything about determining source app of IP traffic when MDM is not used. There was an API for getting the source App's App ID when using App Proxy, but that is MDM-only. If I have missed something please point it out. – Locksleyu Oct 4 '16 at 22:18
1

It says specifically on the NETunnelProvidermanager specs, "The only way to configure "per app" VPN is with MDM..." so in terms of the mainstream way of meeting all the Apple specifications, and at least in the context of Apple Stack Exchange, it seems this would not be possible. I hope someone else, or I, can find a nice workaround for you though if it doesn't work.

One tip though: it does discuss directly below the VPN settings, in the spec guide, how to configure on-demand VPN, and if your requirement is not that that the VPN is "always on," you may be able to meet your specific goal just by creating the necessary certificates.

You may prefer to to make the .mobilconfig files by hand once you see the options and syntax available, but you might be able to generate only exactly the certificates you need, for example the VPN, using Apple Configurator without having to completely take control of the device.

  • I don't think your suggestion for configuring on-demand VPN will work since I need to have the VPN on all the time, and also need to to support several apps running simultaneously (one foreground app while one runs in the background, etc.). I need a full production solution, and methods that only work in testing are not helpful, unfortunately. For example, the mode to test the ver-app VPN without an actual MDM server using a special config file doesn't help find a production solution. – Locksleyu Oct 6 '16 at 14:14
  • I updated the answer, but it is nothing to change great news for you yet. You might please update the question as well, the things you commented here were not clear in the question: requires always-on vpn, this is for production not testing, etc. – forgotstackxpassword Oct 6 '16 at 16:33
  • What I meant is that simply for my use cases I need the VPN on all the time, and I need a solution I can roll out to customers (via the app store), so anything that is test-only will not work. I need something that works in production environments. – Locksleyu Oct 10 '16 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .