Search results for

includeAllNetworks

150 results found

Post

Replies

Boosts

Views

Activity

Reply to Configure IKEv2 VPN with always-on
Currently, AlwaysON VPN is only supported on supervised iOS devices. It is configuration profile based only, and is limited to the built-in IKEv2 provider. There is no app-based customization support. It sounds like you want to have your own app with your own custom SSL provider, but with the alwaysOn-VPN-like behavior (forcing all traffic onto tunnel to avoid traffic leakage). On iOS 14, check out the new key, includeAllNetworks, in the NEVPNProtocol.h file. If VPN is enabled and this includeAllNetworks is set, VPN will make sure all traffic must be tunneled. If tunnel is not up yet, all traffic will be dropped. If tunnel is enabled manually, this key will continuously keep the tunnel up. If tunnel is onDemand, then tunnel will be brought up by onDemand. https://developer.apple.com/documentation/networkextension/nevpnprotocol/3131931-includeallnetworks
Topic: App & System Services SubTopic: Networking Tags:
Jun ’20
Reply to Network system extension failing to load
Hi Matt,I able to fix the IPC issues. Now i could see it is saving the configuation correctly. But next my expectation was to get the callback on App proxy provider(i.e. AppProxyProvider) but not getting the callback. Looks like it is not able to get into the network system extension. Network preference, extension status showing as Connecting...) Any thought please? ( {n localizedDescription = MyExtension n enabled = YESn protocolConfiguration = {n serverAddress = <23-char-str>n disconnectOnSleep = NOn includeAllNetworks = NOn excludeLocalNetworks = NOn providerBundleIdentifier = com.sample.extensionn }n onDemandEnabled = NOn} )Extension info.plist:<?xml version=1.0 encoding=UTF-8?> <!DOCTYPE plist PUBLIC -//Apple//DTD PLIST 1.0//EN http://www.apple.com/DTDs/PropertyList-1.0.dtd> <plist version=1.0> <dict> <key>CFBundleDevelopmentRegion</key> <string>$(DEVELOPMENT_LANGUAGE)</string> <key>CFBundleDisplayName</key> <string>FPNetwor
Topic: App & System Services SubTopic: Networking Tags:
Jun ’20
Unable to start packettunnel on Mac OS
Hi - We have had a packettunnel working well on iOS for a long time and now looking into one for Mac OS. However, we haven't been able to get it to work.Summary of what we see:The app can successfully install the VPN profile:nesessionmanager 11:06:26.027252-0700 NESMVPNSession[Primary Tunnel:XyzCatalyst:E2A089D5-A18B-4543-94F5-827E4DB3357D :(null)]: handling configuration changed: { name = XyzlizeCatalyst identifier = E2A089D5-A18B-4543-94F5-827E4DB3357D applicationName = XyzCatalyst application = com.xyz.mac.vpn grade = 1 VPN = { enabled = YES onDemandEnabled = NO disconnectOnDemandEnabled = NO protocol = { type = plugin identifier = 0A3DA48C-EE69-479C-A2CD-994028B01CC0 serverAddress = 127.0.0.1 identityDataImported = NO disconnectOnSleep = NO disconnectOnIdle = NO disconnectOnIdleTimeout = 0 disconnectOnWake = NO disconnectOnWakeTimeout = 0 disconnectOnUserSwitch = NO disconnectOnLogout = NO includeAllNetworks = NO excludeLocalNetworks = NO pluginType = com.xyz.mac.vpn authenticationMethod = 0 reas
Topic: App & System Services SubTopic: Networking Tags:
7
0
2.8k
May ’20
NETransparentProxyManager blocks all inbound flows
Hi,I want a transparent proxy that captures all outgoing tcps so I used NETransparentProxyManager to start an AppProxyProvider with the following rule:networkSettings.includedNetworkRules = NENetworkRule( remoteNetwork: nil, remotePrefix: NSNotFound, localNetwork: nil, localPrefix: NSNotFound, protocol: .TCP, direction: NETrafficDirection.outbound )Everything works as expected except that, after the AppProxyProvider has been started:Any try of starting a tcp listener listening on 0.0.0.0 fails with error Protocol wrong type for socket. This can be easily reproduced by runningpython3 -m http.server, which fails with the error:OSError: [Errno 41] Protocol wrong type for socketTcp listeners that were already boud to 0.0.0.0 won't see incoming connections from local network.Is it a bug or were I doing something wrong?Also, I notice that the transparent proxy cannot capture tcp connections to localhost. I suppose it is by design but is there any way to achieve that? (setting includeAllNetworks to true and
Topic: App & System Services SubTopic: Drivers Tags:
0
0
498
May ’20
AppProxyProvider started by NETransparentProxyManager blinds all tcp servers
Hi,I want a transparent proxy that captures all outgoing tcps so I used NETransparentProxyManager to start an AppProxyProvider with the following rule:networkSettings.includedNetworkRules = NENetworkRule( remoteNetwork: nil, remotePrefix: NSNotFound, localNetwork: nil, localPrefix: NSNotFound, protocol: .TCP, direction: NETrafficDirection.outbound )Everything works as expected except that, after the AppProxyProvider has been started:Any try of starting a tcp listener listening on 0.0.0.0 fails with error Protocol wrong type for socket. This can be easily reproduced by runningpython3 -m http.server, which fails with the error:OSError: [Errno 41] Protocol wrong type for socketTcp listeners that were already boud to 0.0.0.0 won't see incoming connections from local network.Is it a bug or were I doing something wrong?Also, I notice that the transparent proxy cannot capture tcp connections to localhost. I suppose it is by design but is there any way to achieve that? (setting includeAllNetworks to true and
Topic: App & System Services SubTopic: Networking Tags:
0
0
336
May ’20
Reply to Packet Tunnel Provider - local networks
Interesting. I suspect something is capturing the local traffic for a specified interface before it is sent to the default route. Also if the includeAllNetworks or excludeLocalNetworks flags are set this could impact the situation as well. To figure out more on what is happening I would recommend opening a TSI so I can take a closer look at your entire configuration. If you do open a TSI, please attach a sample project that reproduces the your scenario.Matt EatonDTS Engineering, CoreOSmeaton3 at apple.com
Topic: App & System Services SubTopic: Networking Tags:
May ’20
Packet Tunnel Provider - local networks
I've implemented a VPN apps (for iOS and for macOS) with Packet Tunnel Provider.The includedRoutes contains all the IPv4 default routes:newSettings.ipv4Settings?.includedRoutes = [NEIPv4Route.default()]My question is regarding local networks:If I'm not using split tunnel (not including/excluding any other route), what happens to traffic to the local network? By local network I mean the network the device is connected to without the client.I expected that all traffic should go to the tunnel, but I see that I'm able to access resources on my local network even when the tunnel is up.In addition to that, I checked the new flag - includeAllNetworksr which is relevant only to macOS:If this flag is set, I can't access the local network when the VPN is up.So the question is how to configure if the user is able or unable to access resources on his local tunnel.Maybe using the above flag is the answer? And if it is the answer, then what about iOS?Edit: When includeAllNetworks is set, sometimes I don't have tra
Topic: App & System Services SubTopic: Networking Tags:
5
0
2.4k
May ’20
Reply to Simple transparent app proxy Network Extensions on macOS
That may not apply to your issue, but make sure that you don't have includeAllNetworks set to true (which would sound logical in the first place but causes all sorts of weird failures) in the NETunnelProviderProtocol instance you pass to the NETransparentProxyManager while configuring the proxy in the main app.Doing so causes a networking loop back into the transparent proxy that gets NECP deny messages, which really do not explain the base issue at all. Reported as FB7468866.
Topic: App & System Services SubTopic: Drivers Tags:
Apr ’20
Reply to NetworkExtension-based NKE replacement in Catalina
I've tried the transparent proxy approach although I have the same issue as reported here https://forums.developer.apple.com/thread/121823 with the save failing with error 'Missing protocol or protocol has invalid type'. I've used a NETunnelProviderProtocol as you've instructed in the replies but the error stays the same, scarce docs don't help much.Below is the result of dumping the protocol object that caused the error to the logs: type = plugin identifier = 7AB53020-1331-47DD-B39A-B3A3B90762E7 serverAddress = localhost identityDataImported = NO disconnectOnSleep = NO disconnectOnIdle = NO disconnectOnIdleTimeout = 0 disconnectOnWake = NO disconnectOnWakeTimeout = 0 disconnectOnUserSwitch = NO disconnectOnLogout = NO includeAllNetworks = YES excludeLocalNetworks = NO authenticationMethod = 0 reassertTimeout = 0 providerBundleIdentifier = [redacted]
Topic: App & System Services SubTopic: Networking Tags:
Sep ’19
Reply to Some traffic bypassing VPN
Hello !We did check with built in IPSEC profiles also. No any customizations whatever.Behaviour was similar, that Facebook Messenger was able to send out packets using IP address of underlying Wifi interface (and 4G). Even created .mobileconfig profile, which included ` OverridePrimary=1`.Still same behaviour on 12.3.1.Will try your suggestion with `includeAllNetworks` on iOS 13 beta. Btw. do you have deeper documentation on behaviour than onhttps://developer.apple.com/documentation/networkextension/nevpnprotocol/3143658-excludelocalnetworks?language=objcbest regards,taavi
Topic: App & System Services SubTopic: Networking Tags:
Sep ’19
Reply to Some traffic bypassing VPN
I can’t speak to the behaviour of specific third-party clients, but I will say that it’s perfectly feasible for clients to force traffic to run over a specific interface.As to what you can do about this, my recommendation is that you look at the includeAllNetworks and excludeLocalNetworks properties we added to NEVPNProtocol in iOS 13 beta. Share and Enjoy — Quinn “The Eskimo!” Apple Developer Relations, Developer Technical Support, Core OS/Hardware let myEmail = eskimo + 1 + @apple.com
Topic: App & System Services SubTopic: Networking Tags:
Sep ’19
Reply to Version/OS compatibility of Catalina Network Extension features
Unless we said otherwise, everything in that talk is for macOS 10.15 only. Specifically, the includeAllNetworks and excludeLocalNetworks options are currently only available on the Mac. Or are they only going to work on [10.15] and later?… corporate customers upgrade slowly, and they're our market.Understood, but backporting NE features to previous OS releases is not practical. This is especially true for these new NE providers, as they depend on a key feature (system extensions) that is new in 10.15.The talk referred to Driver Extensions as user-independent, and providing something available at the system level, but not Network Extensions. Is that the case?Prior to macOS 10.15, VPN providers were per-user for three reasons:Commonality with iOS.VPNs often require user credentials.They are based on app extensions because there was no alternative.With the advent of system extensions that last point is no longer the case, so there’s an architectural framework for system-wide VPN. However, 10.15 does not
Topic: App & System Services SubTopic: Networking Tags:
Jun ’19
Version/OS compatibility of Catalina Network Extension features
We moved our macOS NKE-based VPN over to Network Extensions a while back. Although Network Extensions offered us less control over the system traffic it also let us have a single code base for the core functionality on iOS & macOS, as well as offering the possibilty of MDM.The talk on Network Extensions for Modern macOS offered us some of the control back. The includeAllNetworks and excludeLocalNetworks flags are great to see. But, the title of the talk said 'for Modern macOS', so:- Are they only on macOS, or are the Network Extension parts of that talk also applicable to iOS?- Will those Network Extension flags function if the user is running macOS Mojave?- iOS 12?Or are they only going to work on Cataline/iOS13 and later?Users do tend to upgrade their macOS & iOS versions, but corporate customers upgrade slowly, and they're our market.One abillity of NKEs that we lost with Network Extensions was the ability to do an 'Always On' VPN which made sure that all traffic from the system was tunnel
Topic: App & System Services SubTopic: Networking Tags:
4
0
1.7k
Jun ’19
Reply to Do System Extensions mean that KEXT will be deprecated?
We moved our macOS NKE-based VPN over to Network Extensions a while back. Although Network Extensions offered us less control over the system traffic it also let us have a single code base for the core functionality on iOS & macOS, as well as offering the possibilty of MDM.The talk on Network Extensions for Modern macOS offered us some of the control back. The includeAllNetworks and excludeLocalNetworks flags are great to see. But- Are they only on macOS, or are the Network Extension parts of that talk also applicable to iOS?- Will those Network Extension flags function if the user is running macOS Mojave? - iOS 12? Or are they only going to work on Cataline/iOS13 and later?Users do tend to upgrade their macOS & iOS versions, but corporate customers upgrade slowly, and they're our market.One abillity of NKEs that we lost with Network Extensions was the ability to do an 'Always On' VPN which made sure that all traffic from the system was tunneled. Because we could make the NKE load at boot tim
Topic: App & System Services SubTopic: Core OS Tags:
Jun ’19