5 ms·

What exactly is a "VPN app" for iOS? How does it work? I was under the impression that iOS natively supports VPNs through IPsec (and perhaps a few other technol

by 4ad 9y ago

What exactly is a "VPN app" for iOS? How does it work? I was under the impression that iOS natively supports VPNs through IPsec (and perhaps a few other technologies), and that it doesn't have tap/tun devices, nor it allows installing kernel drivers to create tap/tun devices so you could not use e.g. OpenVPN. So what do these VPN apps actually do? Are they just a front-end for some service, but the phone still uses IPsec? If that is the case I assume you can configure IPsec manually? Can someone explain? A link to some technical document would be amazing. Thank you!

aphextron 9y ago
Most are essentially just a UIWebview with preconfigured https proxy
- 4ad 9y ago
  That sounds... awful, the name "VPN" doesn't really apply.
  - Terretta 9y ago
    Which is why that’s not the case. iOS supports real VPN: https://support.apple.com/en-us/HT201533 https://support.apple.com/en-us/HT201533 The legit apps are mostly VPN policy/configuration managers. You give them permission to hook into the built in consumer and business level VPN capabilities built into iOS without giving them ability to MITM all the traffic on the device. Mostly the apps give you tools to select the edge / country you want to connect to, whether you want DNS ad blocking, and a way to use App Store subscriptions to pay for VPN. They can also give you easy on/off 3D Touch or widgets, or show you dashboards of usage. You can use an app to create a VPN profile then remove the app, it’s not needed. You can also load VPN profiles other ways, without an app.
    - 4ad 9y ago
      Thanks for the explanation, and the link!
giovannibajo1 9y ago
Apple allows to implement new VPN protocols as a sandboxed plugin that communicates with the network manager; this was implemented in iOS 9 as part of the larger ios8 effort of implementing sandboxed plugins like custom keyboards. A vpn app contains such a plugin, plus the required user interface to login/configure the service. The user downloads the app, configures it providing credentials (or gets auto configured through a MDM) and then the vpn network appears in Settings, among the other VPNs created with a builtin protocol like IPSec. The vpn plugin is obviously sandboxed with the minimum possible privileges. This is a WWDC video explaining it: https://developer.apple.com/videos/play/wwdc2015/717/ https://developer.apple.com/videos/play/wwdc2015/717/ This is a blog post with a tutorial: http://www.hideme.io/blog/en/ios-9-vpn-api-network-extension-udp/ http://www.hideme.io/blog/en/ios-9-vpn-api-network-extension... This is the entry point for the official documentation for all kind of network plugins, of which VPN is one: https://developer.apple.com/documentation/networkextension https://developer.apple.com/documentation/networkextension
- 4ad 9y ago
  Thank you very much for this explanation. It would be great if macOS worked the same. Personally, I try to use IPsec VPNs as much as possible, and then I use the built-in networking on my laptop, but quite often my clients require of me to use their Cisco AnyConnect VPN, which basically requires installing kernel modules. Edit: actually after reading your link, it appears Network Extension is supported by macOS as well? That would be great news, if vendors would also update their apps to use it.
  - johncolanduoni 9y ago
    OpenVPN can do both routed and bridged connections on macOS without kernel modules (using a tun/tap device, as it does on other Unixish platforms). This requires administrative privileges though, which is what Apple's API is designed to avoid.
    - 4ad 9y ago
      > OpenVPN can do both routed and bridged connections on macOS without kernel modules (using a tun/tap device, as it does on other Unixish platforms). But macOS doesn't have a tun/tap device. It needs kernel drivers to create one. In either case, my main gripe is with Cisco AnyConnect, not OpenVPN. Cisco AnyConnect is very popular, I haven'd had any client use OpenVPN, though many do use IPsec.
deleted 9y ago
[deleted]

by 4ad 9y ago

aphextron 9y ago

Most are essentially just a UIWebview with preconfigured https proxy

4ad 9y ago
That sounds... awful, the name "VPN" doesn't really apply.
- Terretta 9y ago
  Which is why that’s not the case. iOS supports real VPN: https://support.apple.com/en-us/HT201533 https://support.apple.com/en-us/HT201533 The legit apps are mostly VPN policy/configuration managers. You give them permission to hook into the built in consumer and business level VPN capabilities built into iOS without giving them ability to MITM all the traffic on the device. Mostly the apps give you tools to select the edge / country you want to connect to, whether you want DNS ad blocking, and a way to use App Store subscriptions to pay for VPN. They can also give you easy on/off 3D Touch or widgets, or show you dashboards of usage. You can use an app to create a VPN profile then remove the app, it’s not needed. You can also load VPN profiles other ways, without an app.
  - 4ad 9y ago
    Thanks for the explanation, and the link!

giovannibajo1 9y ago

Apple allows to implement new VPN protocols as a sandboxed plugin that communicates with the network manager; this was implemented in iOS 9 as part of the larger ios8 effort of implementing sandboxed plugins like custom keyboards. A vpn app contains such a plugin, plus the required user interface to login/configure the service. The user downloads the app, configures it providing credentials (or gets auto configured through a MDM) and then the vpn network appears in Settings, among the other VPNs created with a builtin protocol like IPSec. The vpn plugin is obviously sandboxed with the minimum possible privileges. This is a WWDC video explaining it: https://developer.apple.com/videos/play/wwdc2015/717/ https://developer.apple.com/videos/play/wwdc2015/717/ This is a blog post with a tutorial: http://www.hideme.io/blog/en/ios-9-vpn-api-network-extension-udp/ http://www.hideme.io/blog/en/ios-9-vpn-api-network-extension... This is the entry point for the official documentation for all kind of network plugins, of which VPN is one: https://developer.apple.com/documentation/networkextension https://developer.apple.com/documentation/networkextension

4ad 9y ago
Thank you very much for this explanation. It would be great if macOS worked the same. Personally, I try to use IPsec VPNs as much as possible, and then I use the built-in networking on my laptop, but quite often my clients require of me to use their Cisco AnyConnect VPN, which basically requires installing kernel modules. Edit: actually after reading your link, it appears Network Extension is supported by macOS as well? That would be great news, if vendors would also update their apps to use it.
- johncolanduoni 9y ago
  OpenVPN can do both routed and bridged connections on macOS without kernel modules (using a tun/tap device, as it does on other Unixish platforms). This requires administrative privileges though, which is what Apple's API is designed to avoid.
  - 4ad 9y ago
    > OpenVPN can do both routed and bridged connections on macOS without kernel modules (using a tun/tap device, as it does on other Unixish platforms). But macOS doesn't have a tun/tap device. It needs kernel drivers to create one. In either case, my main gripe is with Cisco AnyConnect, not OpenVPN. Cisco AnyConnect is very popular, I haven'd had any client use OpenVPN, though many do use IPsec.

deleted 9y ago

[deleted]