IOS 18.1 broke my VPN app

Question

Created 2d

Replies 3

Boosts 0

Participants 2

The update to IOS 18.1 broke my VPN app. It was still working with 18.0.1. First analysis indicates that packets are not received through packetflow. Postings like this also indicates that there has something changed about the routing: https://developer.apple.com/forums/thread/767315

So what is going on here?

I am using the following NEPacketTunnelNetworkSettings:

static private func buildSettings() -> NEPacketTunnelNetworkSettings {

        let settings = NEPacketTunnelNetworkSettings(tunnelRemoteAddress: "127.0.0.1")

        let ipv4Settings = NEIPv4Settings(addresses: ["10.42.0.1"], subnetMasks: ["255.255.0.0"])

        ipv4Settings.includedRoutes = [NEIPv4Route.default()]

        ipv4Settings.excludedRoutes = []

        settings.ipv4Settings = ipv4Settings

        settings.mtu = 1500

        let dnsSettings = NEDNSSettings(servers: ["10.42.0.1"])

        settings.dnsSettings = dnsSettings

        let ipv6Settings = NEIPv6Settings.init(addresses: ["fdb2:d970:8536:8dc6:0000:0000:0000:0001"], networkPrefixLengths: [64])

        ipv6Settings.includedRoutes = [NEIPv6Route.default()]

        settings.ipv6Settings = ipv6Settings

        return settings
    }

Any help would be greatly appreciated.

Answered by DTS Engineer in 815185022

Why is that a worry?

Because it’s commonly correlated with folks using a packet tunnel tunnel provider for something other than VPN.

In a provider that implements VPN there’s usually a reasonable value to put in this field. The provider opens its tunnel to the VPN server and gets the remote peer address from the tunnel’s connection to use as the tunnelRemoteAddress value.

I most commonly see 127.0.0.1 in two cases:

Hacks and tests
Things that aren’t VPN

It’s fine for the first case. The second case is my concern.

But I figured it out in the meanwhile.

Cool.

This by the way another setting that is totally unclear in the documentation.

My go-to explanation for this stuff is Routing your VPN network traffic. Did you read that already? If not, please do.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

23h

So this is a bit of a worry:

let settings = NEPacketTunnelNetworkSettings(tunnelRemoteAddress: "127.0.0.1")

Is your packet tunnel provider implementing a VPN? I usually see this sort of thing in apps that are trying to use the packet tunnel infrastructure to implement stuff that’s not a VPN [1].

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] Which often doesn’t end well, as my erstwhile colleague explains in TN3120 Expected use cases for Network Extension packet tunnel providers.

0

Answer 2

solaristhesun OP

22h

Why is that a worry? This property does not seem to have any noticable effect anyways. The tunnel can still connect to any address. I assume this is only for display purposes in the VPN settings. But who knows, the documentation does certainly not provide any insights.

What worries me is that you guys at Apple implement breaking changes like that without the slightest hint but that's another story.

But I figured it out in the meanwhile. For some reason, includeAllNetworks has to be set true starting from 18.1.0. This by the way another setting that is totally unclear in the documentation. Setting a default route usually means to redirect everything. So what is "include all networks" supposed to mean in that context?

0

Answer 3

DTS Engineer OP

Apple

21m

Recommended

Why is that a worry?

Because it’s commonly correlated with folks using a packet tunnel tunnel provider for something other than VPN.

In a provider that implements VPN there’s usually a reasonable value to put in this field. The provider opens its tunnel to the VPN server and gets the remote peer address from the tunnel’s connection to use as the tunnelRemoteAddress value.

I most commonly see 127.0.0.1 in two cases:

Hacks and tests
Things that aren’t VPN

It’s fine for the first case. The second case is my concern.

But I figured it out in the meanwhile.

Cool.

This by the way another setting that is totally unclear in the documentation.

My go-to explanation for this stuff is Routing your VPN network traffic. Did you read that already? If not, please do.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0