How to get DNS query only in Network Extension

Question

Created Feb ’21

Replies 1

Boosts 0

Participants 2

I'm working on developing a VPN app which will direct all the DNS query into my tunnel, and then redirect it to my proxy server. Here is my key codes.

// Assume dnsServers array contains 114.114.114.114 and system default DNS server
NSArray *dnsServers = [self getDNSServerAddresses];
NEDNSSettings *dnsSettings = [[NEDNSSettings alloc] initWithServers:dnsServers];

// Wildcard match domains
dnsSettings.matchDomains = @[@""];
NSMutableArray *ipv4IncludeRoutes = @[].mutableCopy;

// Add DNS addresses to included routes
for (NSString *dnsServerAddr in dnsServers) {
NEIPv4Route *dnsRoute = [[NEIPv4Route alloc] initWithDestinationAddress:dnsServerAddr subnetMask:SUBNET_MASK];
[ipv4IncludeRoutes addObject:dnsRoute];
}
NEIPv4Settings *ipv4Settings = [[NEIPv4Settings alloc] initWithAddresses:@[REMOTE_ADDRESS1] subnetMasks:@[SUBNET_MASK]];

// Split tunnel
ipv4Settings.includedRoutes = ipv4IncludeRoutes;
NEPacketTunnelNetworkSettings *settings = [[NEPacketTunnelNetworkSettings alloc] initWithTunnelRemoteAddress:@[REMOTE_ADDRESS2]];
settings.IPv4Settings = ipv4Settings;
settings.DNSSettings = dnsSettings;
[self setTunnelNetworkSettings:settings completionHandler:completionHandler];

I've try to run this code on some devices, but what I found is some devices work as expected and others not.
Why it is not working on some devices?
How can I identify the DNS query packet?

Boost

Answer 1

Systems Engineer OP

Apple

Mar ’21

I'm working on developing a VPN app which will direct all the DNS query into my tunnel, and then redirect it to my proxy server.

NEDNSSettings and NEPacketTunnelProvider's are meant to be used to serve a small subset of DNS traffic that is important to your business or application needs. This would be a small list of DNS domains. This does not mean to try and take in all DNS traffic on a device.

If you want to encrypt device DNS traffic then look at using NEDNSOverHTTPSSettings or NEDNSOverTLSSettings.

If you want to send device wide DNS traffic to a proxy server then use a MDM and NEDNSProxyProvider.

If you want to make filtering decisions based on DNS traffic, then use a MDM and NEFilterDataProvider.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

0