DoT / DoH using NEPacketTunnelProvider

Hi,

I'd like to implement DoT and/or DoH in my app. I know that NEDNSProxyProvider exists, but it's only available on supervised devices. Also, I am aware that Apple is releasing official DoT and DoH support in iOS 14, but I'd like the app to be compatible with older iOS versions too.

That's why I've looked for other ways of implementing this feature, and I've found that other apps like the 1.1.1.1 Cloudflare app, the DNSCloak app or the NextDNS app all install a VPN configuration, to intercept the DNS requests and apply the necessary encryption protocols.

As far as I know, those apps seem to be implemented using the NEPacketTunnelProvider, which is obviously not meant for DNS proxying. However, that's the only solution I can see right now for my problem, so I would like some pointers on how to implement this feature through the Packet Tunnel Provider.

I've managed to change the DNS settings of the tunnel to make all DNS queries go to an arbitrary server if I don't initialise the ipv4Settings of the tunnel. However, with that disposition I can't intercept the DNS queries.

When initialising ipv4Settings, DNS queries no longer go to the DNS server I want (they go to the system one instead), but that's the only way I can get any packet when calling packetFlow.readPackets.

I'm guessing I have to fiddle with the routes to set up a split tunnel but I haven't managed to get it to work. I've read most of the Apple forums discussions about NEPacketTunnelProvider, but I haven't found a solution.

I've also tried to have a look at DNSCloak source code, but between the fact that it seems to be a wrapper to another iOS app and that it is coded using Apache Cordova framework, which I don't know about, I'm a bit at a loss.

Does anyone has any tips or any advice on how to implement this?
Thanks in advance!
Using NEDNSSettings with NEPacketTunnelProvider provides your tunnel a mechanism to match specific domains that you want to resolve on your own using a custom DNS server. However, the idea here is to match a small list of these domains for your tunnel (Quinn has an excellent explanation on matching domains here). If you find yourself in a place where you have a large list of match domains in your NEDNSSettings and you are still debugging how to include more DNS queries in your tunnel then you are in need of something like NEDNSProxyProvider.

As mentioned, NEDNSProxyProvider on iOS does require MDM, but provides the capability to setup a system resolver that you could control the remote side of the proxy to perform your own DoH/DoT capabilities in iOS 13 today.

Looking forward to iOS 14, you can create a Network Extension app that uses NEDNSSettingsManager to create a system-wide DNS configuration that uses built-in encrypted DNS. To see more on this, check out Enable encrypted DNS from this year's WWDC.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com
DoT / DoH using NEPacketTunnelProvider
 
 
Q