It's just a normal VPN software, nothing to do with MDM; and I do not know the software or destination IP: lots of softwares allow setting the proxy in app, but I do not know which one the user is using. My question is why network extension runtime is different from the normal world. Thanks.

Thanks. I added the NEPacketTunnelNetworkSettings in my post. I allow other app to connect my port in localhost in order to force the app's traffic to the server. ( if the app allows to set the proxy )