3 ms·

Apple allows to implement new VPN protocols as a sandboxed plugin that communicates with the network manager; this was implemented in iOS 9 as part of the large

Apple allows to implement new VPN protocols as a sandboxed plugin that communicates with the network manager; this was implemented in iOS 9 as part of the larger ios8 effort of implementing sandboxed plugins like custom keyboards. A vpn app contains such a plugin, plus the required user interface to login/configure the service. The user downloads the app, configures it providing credentials (or gets auto configured through a MDM) and then the vpn network appears in Settings, among the other VPNs created with a builtin protocol like IPSec. The vpn plugin is obviously sandboxed with the minimum possible privileges. This is a WWDC video explaining it: https://developer.apple.com/videos/play/wwdc2015/717/ https://developer.apple.com/videos/play/wwdc2015/717/ This is a blog post with a tutorial: http://www.hideme.io/blog/en/ios-9-vpn-api-network-extension-udp/ http://www.hideme.io/blog/en/ios-9-vpn-api-network-extension... This is the entry point for the official documentation for all kind of network plugins, of which VPN is one: https://developer.apple.com/documentation/networkextension https://developer.apple.com/documentation/networkextension

4ad 9y ago
Thank you very much for this explanation. It would be great if macOS worked the same. Personally, I try to use IPsec VPNs as much as possible, and then I use the built-in networking on my laptop, but quite often my clients require of me to use their Cisco AnyConnect VPN, which basically requires installing kernel modules. Edit: actually after reading your link, it appears Network Extension is supported by macOS as well? That would be great news, if vendors would also update their apps to use it.
- johncolanduoni 9y ago
  OpenVPN can do both routed and bridged connections on macOS without kernel modules (using a tun/tap device, as it does on other Unixish platforms). This requires administrative privileges though, which is what Apple's API is designed to avoid.
  - 4ad 9y ago
    > OpenVPN can do both routed and bridged connections on macOS without kernel modules (using a tun/tap device, as it does on other Unixish platforms). But macOS doesn't have a tun/tap device. It needs kernel drivers to create one. In either case, my main gripe is with Cisco AnyConnect, not OpenVPN. Cisco AnyConnect is very popular, I haven'd had any client use OpenVPN, though many do use IPsec.

4ad 9y ago

Thank you very much for this explanation. It would be great if macOS worked the same. Personally, I try to use IPsec VPNs as much as possible, and then I use the built-in networking on my laptop, but quite often my clients require of me to use their Cisco AnyConnect VPN, which basically requires installing kernel modules. Edit: actually after reading your link, it appears Network Extension is supported by macOS as well? That would be great news, if vendors would also update their apps to use it.

johncolanduoni 9y ago
OpenVPN can do both routed and bridged connections on macOS without kernel modules (using a tun/tap device, as it does on other Unixish platforms). This requires administrative privileges though, which is what Apple's API is designed to avoid.
- 4ad 9y ago
  > OpenVPN can do both routed and bridged connections on macOS without kernel modules (using a tun/tap device, as it does on other Unixish platforms). But macOS doesn't have a tun/tap device. It needs kernel drivers to create one. In either case, my main gripe is with Cisco AnyConnect, not OpenVPN. Cisco AnyConnect is very popular, I haven'd had any client use OpenVPN, though many do use IPsec.