Also to add to what you mentioned about NEVPNStatus, I am catching the notifications for this in the container app, and NEVPNStatusConnecting comes in, but NEVPNStatusConnected never does.

Hi Matt, I can log packets coming out of the read handler and going into the write handler, where I write packets to the NEPacketFlow. I also have a wireshark on the server that shows the packets coming in and the ones coming out. I know that there is something working because of what is going through and coming back. I guess my main question is what exactly what makes the NWUDPSession.isViable == true, which I am also guessing will make the VPN show as Connected in the settings and display the little VPN notification at the top of the screen. All I can get from the API, and handle in the observer, is that the NWUDPSessionState becomes ready, but isViable always == false. What event(s) or trigger(s) has to happen to make NWUDPSession.isViable become true? The extent of the documentation is that isViable, readonly, is: The viability of a UDP session represents whether or not data can be transferred. And the NWUDPSessionState ready is: The session is ready for reading and writing data.