I am developing a custom VPN client plugin for iPhone, working on iOS 11 devices. I am hoping to set up nested VPNs so that the traffic is double encrypted.
I am working with Per-App VPN, as well as both Always-On and On-Demand style systemwide VPN clients. As an example, what I would like to do is access a IPSec VPN Endpoint for Per-App connections, where the endpoint exists on a network only accessible through an SSL VPN endpoint that is connected through an Systemwide VPN.
Please refer the following diagram for further example of what I mean:
Note that the Systemwide VPN doesn't need to be SSL, as I understand Always-On VPN may be restricted to using the iOS built-in VPN client with IKEv2.
For the systemwide VPN, I have a strong preference for Always-On as it doesn't allow the user to disable it. In my testing however, it seems that when an Always-On VPN is loaded onto the iPhone, all of the other VPNs disappear from Settings and cannot be enabled. I have been able to configure a systemwide On-Demand VPN and a Per-App VPN to operate concurrently, but not yet with one passing through the other.
The part I am uncertain about, and so far haven't been able to replicate, has been marked with the dotted line. Can the Per-App VPN connect and route through the Systemwide VPN?