The ‘NEVPNProtocol.includeAllNetworks’ is not working on iOS 16+

Question

juraj_ivpn OP

Created Aug ’23

Replies 1

Boosts 0

Participants 2

https://developer.apple.com/documentation/networkextension/nevpnprotocol/3131931-includeallnetworks

The ‘includeAllNetworks’ property was introduced in iOS 14 to allow VPN configuration on iOS to force all network traffic through the VPN tunnel, to prevent any leaks outside the tunnel.

Older version of this document said: 

"A Boolean value that indicates whether the system sends all network traffic over the tunnel."

Current documentation says:

"A Boolean value that indicates whether the system sends most network traffic over the tunnel."

There are a few issues with this change:

The change in functionality was introduced without any notice or change in developer documentation. The documentation was updated almost a year after the change in functionality. The property should have been deprecated in iOS 16, and the new property should have been introduced. I would suggest a more accurate name - ‘includeMostNetworks’ instead of ‘includeAllNetworks’.
After reading the updated documentation, it is not clear what the ‘includeAllNetworks’ actually does, as when it is disabled, the VPN also sends most network traffic over the tunnel.
In iOS 16 and above, there is no way to configure a VPN tunnel without iOS bypassing the tunnel and leaking traffic to Apple servers.

Boost

Answer 1

Systems Engineer OP

Apple

Aug ’23

I would suggest a more accurate name - ‘includeMostNetworks’ instead of ‘includeAllNetworks’.

For any change in documentation, API names, or API behavior I would open an Enhancement Request here.

Regarding:

After reading the updated documentation, it is not clear what the ‘includeAllNetworks’ actually does, as when it is disabled, the VPN also sends most network traffic over the tunnel.

The way I have always thought of this property is that it allows your tunnel to define a sweeping set of destination addresses without having to manually define all of these routes in your packet tunnel configuration.

0