Thanks, meaton. The code may clarify the problem better 😀 Pseudo Code NetworkExtension [[NEPacketTunnelNetworkSettings alloc] initWithTunnelRemoteAddress:@"Remove_IP"]; tunnel.DNSSettings = [[NEDNSSettings alloc] initWithServers:@"DNS_IP"]; tunnel.DNSSettings.matchDomains = @["example.com"] tunnel.IPv4Settings.includedRoutes = @[[[NEIPv4Route alloc] initWithDestinationAddress:@"DNS_IP" subnetMask:@"255.255.255.255"], [[NEIPv4Route alloc] initWithDestinationAddress:@"Intranet_IP" subnetMask:@"255.255.255.255"],] // in the NetworkExtension all *.example.com will be resolved to Intranet_IP Client App NSURL *url =[NSURL URLWithString:@"http://www.example.com/"] NSURLSession *session = [NSURLSession sharedSession]; NSURLSessionDataTask *dataTask = [session dataTaskWithURL:url completionHandler:^(NSData * _Nullable data, NSURLResponse * _Nullable response, NSError * _Nullable error) {/* ... */}]; [dataTask resume]; Trace Let's say that www.example.com = Real_IP Run the NetworkExtension Run the Client App The Client App lookup www.example.com toDNS_IP and the Intranet_IP return from the NetworkExtension But another DNS query also sent out from Client APP and return the Real_IP from the DHCP DNS Finally the Client App using the Real_IP to initialize the TCP connection