I’m building a Personal VPN app (non-MDM) that uses a NEPacketTunnelProvider extension for content filtering and blocking.
When configuring the VPN locally using NETunnelProviderManager.saveToPreferences, the call fails with:
Error Domain=NEConfigurationErrorDomain Code=10 "permission denied" Error Domain=NEVPNErrorDomain Code=5 "permission denied"
The system does prompt for VPN permission (“Would Like to Add VPN Configurations”), but the error still occurs after the user allows it.
Setup: • Main App ID – com.promisecouple.app • Extension ID – com.promisecouple.app.PromiseVPN • Capabilities – App Group + Personal VPN + Network Extensions • Main app entitlements: com.apple.developer.networking.vpn.api = allow-vpn com.apple.developer.networking.networkextension = packet-tunnel-provider • Extension entitlements: same + shared App Group
Problem: • If I remove the networkextension entitlement, the app runs locally without the Code 5 error. • But App Store Connect then rejects the build with:
Missing Entitlement: The bundle 'Promise.app' is missing entitlement 'com.apple.developer.networking.networkextension'.
Question:
What is the correct entitlement configuration for a Personal VPN app using NEPacketTunnelProvider (non-MDM)?
Is com.apple.developer.networking.networkextension required on the main app or only on the extension?
Why does including it cause saveToPreferences → Code 5/10 “permission denied” on device?
Environment: Xcode 26.1 (17B55), iOS 17.3+ on physical device (non-MDM) Both provisioning profiles and certificates are valid.
I’m building a Personal VPN app … that uses a NEPacketTunnelProvider
You’re mixing up your terminology here. Personal VPN is the term we use for VPN configurations created by third-party apps that use the built-in IKEv2 and IPsec VPN transports. If you’re creating a custom VPN transport using NEPacketTunnelProvider, that’s not Personal VPN
What is the correct entitlement configuration for … using NEPacketTunnelProvider … ?
In both the app and the appex, set com.apple.developer.networking.networkextension to an array containing packet-tunnel-provider.
Or use Xcode’s Signing & Capabilities editor with the Network Extension capability.
Don’t add the Personal VPN capability, because you’re not using the Personal VPN feature.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"