I'm working on an app that implements a custom VPN with NEPacketTunnelProvider. The app is used to connect to industrial facilities, so security is an important issue.
During an audit it was mentioned that while connected to the VPN, a user could create a static route (in the Terminal) and deviate traffic for a specific IP (inside the VPN's target network) to another interface outside the VPN.
I need a way to solve this issue. I can think of:
Checking the routing tables before starting the VPN for a route that has one of my known IPs. If I find one alert the user.
Forcing the all the traffic through the VPN. By default I was seeing this behavior, but apparently manually created routes take precedence.
In macOS versions previous to Big Sur there was an option to set the network service order, but now apparently it doesn't apply to VPN interfaces. I was thinking on somehow forcing the VPN to be on top of all other interfaces.
I have done some research about how to do the first solution, but it would need to call sysctl() and inet_ntop() but they need to be executed as root, and I guess they are not App Store friendly.
I don't know how to implement the other two solutions by code, specially in a way compatible with iOS/iPadOS and macOS, and be App Store friendly.
I will appreciate any help, comments and suggestions on how to solve this issue.
Thanks.
1
0
988