Why binding INADDR_ANY in Network Extension is not allowed other apps to connect it using localhost

Question

HenryL OP

Created May ’22

Replies 3

Boosts 0

Participants 2

Hi,

I have an extension using NEPacketTunnelProvider, I need bind both lan address and localhost so that other apps can connect it and transfer data.

I found that if I bind INADDR_LOOPBACK, other apps on the phone can connect it using the localhost(127.0.0.1)

If I bind INADDR_ANY, other apps on the phone can connect it using the lan address but not the localhost(127.0.0.1)

My question is why other app on the phone can not connect using localhost(127.0.0.1) when binding INADDR_ANY?

Thank you.

NEPacketTunnelNetworkSettings:

Exclude route: 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, 255.255.255.255/32, 239.255.255.250/32, fc00::/7, fe80::/10, ff02::c/128, ff05::c/128, ff08::c/128, ff0e::c/128
Include route: [NEIPv4Route defaultRoute]
NEProxySettings with HTTPEnabled and HTTPSEnabled to localhost (a http server)
NEProxySetting exception: 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, 255.255.255.255/32, localhost, *.local, captive.apple.com
NEProxySetting excludeSimpleHostnames: YES

Boost

Answer 1

Systems Engineer OP

Apple

May ’22

How are your NEPacketTunnelNetworkSettings configured and why do you need other apps on the device to connect to localhost?

0

Answer 2

Systems Engineer OP

Apple

May ’22

I allow other app to connect my port in localhost in order to force the app's traffic to the server.

Instead of doing this, why not just claim the destination IP of the route in question, or go full per-App VPN and then way you do not have to run a localhost listener in your app. See TN3120: Expected use cases for Network Extension packet tunnel providers.

0

Answer 3

Systems Engineer OP

Apple

May ’22

You essentially have a few options here. Go full tunnel VPN, to which you could claim all the routes on your system by hand, or go with the includeAllNetworks flag on NETunnelProviderProtocol. Or, you could go with Per-App VPN and claim traffic for specific apps. Having apps connect to a listener so that you can route their traffic through the VPN in not the way to go here.

0