Yes, but if it only handles TCP and UDP, then why does .any cause it to break things? That should still only be TCP and UDP, shouldn't it?

You're saying I'm right, but you think I'm using the wrong words (which is likely true), so you're being more precise. That's how I read it, anyway.

Right, NEAppProxyProvider only supports TCP and UDP, so I was very surprised when the already-running ping was interrupted. However, if I turned it into two rules:         let host = NWHostEndpoint(hostname: "", port: "0")         let udpRule = NENetworkRule(destinationNetwork: host, prefix: 0, protocol: .UDP)         let tcpRule = NENetworkRule(destinationNetwork: host, prefix: 0, protocol: .TCP)         settings.includedNetworkRules = [udpRule, tcpRule] then the ping was unaffected. (Before I'd had one rule, with .any.) The ping failure, btw, was sendto: No route to host.

Ok, I got it working in its minimal fashion again (which is to say, at this point, handleNewProxy just logs each flow and then returns false). I had proto.includeAllNetworks = true and removed it. Yay. However... a ping I have running fails whenever I have it connected. I can continue to load websites in Safari, so I didn't breakall networking this time.

No, it occurred to me in my sleep that it's behaving as if I told it to install a packet proxy and not an App Proxy. So I no doubt did something fairly wrong; I just need to figure out what that is. (If you have any common suggestions, that'd be great, otherwise I'll need to double check the entitlements, the Info.plists, the proxy setups for networks, how I am activating it, and how I am starting it.)

But, essentially, it's not supposed to matter, right? As I just described it to someone, the App Proxy Provider turns the data transport from IP to itself (ok, it sounded better in my head before I said it). You could, I suppose, use it to implement some wildly-different transport scheme that did not involve any IP packets at all. I just wanted to make sure I did understand it properly. 😄

In some sense, this is a dumb question, since the AppProxyFlow is a bridge between endpoints, not an actual IP tunnel; however, this surprised me in the sense that if an app asks what the remote connection is, or asks for a specific address family, etc. But I’m guessing that the app proxy only works with the higher-level libraries, and not with the BSD layer? Or of course I’m completely wrong!

Both v4 and v6, of course! As I said, I can do it in ObjC pretty easily, I was just hopeful someone had already saved me a bit of work.