I made a much simpler project, but have been unable to get it to produce the error, even after running for upwards of 36 hours. I'm seeing if I can reproduce this in my more complex app. There is always the possibility that changes to the DockKit code in later iPhone OS versions have fixed the problem. If I can't my original (complicated) app to error out in a few more days of testing, I'll have to conclude that's what happened. I'll follow up again in a few more days.

Assume the target devices are managed and the app is installed by MDM. My question of is an app proxy the right tool is really: Will an app proxy let me split the traffic in the way I envision? I have zero experience in this area. Can you suggest an easier way of getting this done. As always, thanks for your attention. Could you perhaps give a simple explanation of what a minimal configuration file would be, and how, simply for testing in dev, I can install it? I’ve looked at the reference document and it is a bit… daunting. I know what MDM is, I have a vague idea about configurations, and absolutely no experience here.

Actually, the document you referred to isn’t so daunting. It’s the PDF about configurations which is overwhelming. That said, there is no place that I know of that documents how to set up the dictionary with NETestpAppMapping nor where it should go (the main app’s info file I assume). If there’s any documentation, or one can spell out exactly how you’re supposed to use an NEAppProxyProviderManager in dev to get going, that’d be great. I tried to create one but the console printed an error message that “must be MDM blah blah.” Presumably that’s because my attempt at providing the app mapping was flawed. I hope. This stuff is all so hard when there’s basically no good documents telling you how to start (without MDM) to even test. thanks again, you’re a life saver.

There is a DHCP server on the local LAN to assign addresses to devices. The criteria is simple: if my iPad is trying to talk to anything on say 192.168, it should use ethernet. Otherwise, it should use cellular. If an app proxy is the wrong tool for this, then can you suggest any other way to accomplish this? I could, just maybe, rewrite the low level libsrt library to use sockets provided from Network, where I can force traffic over cellular. The problem would be that my HTTP rest requests, which use URLSession, would have no way of being forced over cellular. Is there any library/framework that exists on top of Network that lets me make REST calls? If so, possibly doing all of this completely in app, i.e. forcing certain connections onto cellular while letting others do whatever the OS thinks is best, could be done. The other thing that could work is if the OS had some way of knowing: “yeah, this device is on a LAN. But I know the LAN won’t send traffic out to the general WAN, so any connections that aren’t local can’t try to go the LAN.” But I don’t believe it works that way… tell me if I’m wrong there.

I said "I could, just maybe, rewrite the low level libsrt library to use sockets provided from Network, where I can force traffic over cellular." Actually, no, I can't. I thought Network could give me the equivalent of a socket, which I could fold back into libsrt, but it doesn't work that way. So at the application level, I cannot do this. The only choice appears to be something outside the app which forces the traffic onto a route through cellular. If that's not an app proxy, what could it be?

We have total control of our local network. It's convenient to plug in 10 to 20 ipads and let them just obtain addresses via DHCP, but if for example we needed to give pre-assign the iPad static IP addresses, we can do that. If we need to put all these devices on some isolated subnetwork with no DHCP server we can do that. (I have no idea what the 192.168/x16 vs 24 distinction is or means but I'm sure we can do that too.) It's our local network. In short, we can do any freakin' thing required on the local network that helps us crack this problem. With that in mind, if you don't mind answering two questions you've raised now: Do you know of any off the shelf VPNs that can be configured in the way you describe? Going back the other direction: I can potentially rewrite libsrt (which is C/C++) to use sockets that only use cellular. I didn't think however that was possible on iOS (and Network was the only place I could do that). If you could point me to sample C/C++ code or the specific APIs from C/C++ that let me open sockets that will only use cellular, I can take a stab at it. My HTTP REST needs are quite modest, and I could probably roll something simple on top of Network to do those very few calls that absolutely have to be over cellular. Given all the above, if no VPNs exist with the required capabilities, if the socket rewrite doesn't pan out, will the App proxy, which can detect if a route is local or not, and simply uses a Network connection of the required type to just relay traffic to/from the original location work?