I'll answer my own question. Profile needs system scope defined like this. It's at the same level with PayloadContent key. <key>PayloadScope</key> <string>System</string>

Having exactly same issue - cannot install com.apple.webcontent-filter from .mobileconfig file (system throws an error "Profile installation failed." "The ‘VPN Service’ payload could not be installed. The VPN service could not be created." The config is essentially identical to the OP. In the console I get this CPProfileManager.installProfile returning error -319 (The ‘VPN Service’ payload could not be installed. The VPN service could not be created.) CPProfileManager.installProfile for user 'zandrey' returning = -319 (INSTALL FAILED)

Still spotty though, in case of a route pointing at VPN interface doesn't ever return anything. I'd expect it to work like route -n get IP So gateway output points at your next hop.

Nice! Same thing on Big Sur - "preparing" has it, "ready" and after no more. It also works in path_changed_handler block - kind of makes sense, I can stash it away there. In my case this is a UDP connection, so this can be done without actually sending any packets. Thank you, Quinn!

Ok, FB9000160.

Matt, We are concerned with potential interoperability issues when there are multiple NEDNSProxyProvider from different vendors running on the same macOS system. From the way it's described I'd conclude that potentially they cannot co-exist. Is that so? Regarding NETransparentProxyProvider - thank you for clarifying, this is good to know! Regards, Andrey