Need help on MDM Profile for Transparent Proxy

We have an application which is written in Swift, which activates Transparent Proxy network extension. We want to use MDM deployment for this network system extension.

Our Transparent Proxy module is a system extension, which is exposing an app proxy provider interface (We are using NETransparentProxyProvider class and in extension’s Info.plist we use com.apple.networkextension.app-proxy key.) We don’t have any remote server setup to forward the traffic, instead we open a connection with a certain localhost:port (127.0.0.1:3128) to redirect the traffic which is received in our transparent proxy. We have another module that listens to the particular localhost:port to process the traffic further.

As per https://developer.apple.com/documentation/devicemanagement/vpn/transparentproxy documentation, we noticed that we can use the VPN payload with app-proxy as Provider Type for Transparent Proxy.

By referring this document, we created the profile.

If we provide "127.0.0.1" as RemoteAddress field, we were able to install the profile and also while installing our product, the Transparent Proxy gets mapped with the one which is installed via profile. However after that the network is broken and hence unable to browse anything.

We are suspecting the remote server(RemoteAddress) filed is causing this. What value should be provided in the RemoteAddress field?

Configuration profiles need you to populate the RemoteAddress field, even if your provider doesn’t access a remote server. In that case I usually recommend that folks put 127.0.0.1 in that field. It’s weird that this is causing problems for you. It’s possible that’s because you’re talking to your own back end via 127.0.0.1 [1]. To rule out that possibility, put another value in there, like my-proxy.example.com. Does that fix things?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] The system doesn’t care much about the value in the RemoteAddress field, it just cares that it’s there. However, there is one exception to that rule. In a packet tunnel provider, the system sets up NECP so that connections to that address don’t cause a VPN loop. I’ve not tested whether that’s also the case for transparent proxies. However, this possibility is the driving force behind my suggestion.

Accepted Answer

Finally we could resolve the MDM profile - network broken issue with MDM profile having VPN payload by setting IncludeAllNetworks to 0. <key>IncludeAllNetworks</key> <integer>0</integer>

Need help on MDM Profile for Transparent Proxy
 
 
Q