Per App VPN payload not working as expected

Question

Created Mar ’21

Replies 0

Boosts 0

Participants 1

I am trying to enable the per-app VPN for my iOS sample app. For testing purposes I used NETestAppMapping with VPNUUID in my sample app. I created a configuration profile with applayer.

Code Block <plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>IPv4</key>
			<dict>
				<key>OverridePrimary</key>
				<integer>0</integer>
			</dict>
			<key>PayloadDescription</key>
			<string>Configures VPN settings</string>
			<key>PayloadDisplayName</key>
			<string>VPN</string>
			<key>PayloadIdentifier</key>
			<string>com.apple.vpn.managed.applayer.82B23976-8A80-4BE8-BFFF-29DA3CC548E7</string>
			<key>PayloadType</key>
			<string>com.apple.vpn.managed.applayer</string>
			<key>PayloadUUID</key>
			<string>82B23976-8A80-4BE8-BFFF-29DA3CC548E7</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
			<key>Proxies</key>
			<dict>
				<key>HTTPEnable</key>
				<integer>0</integer>
				<key>HTTPSEnable</key>
				<integer>0</integer>
			</dict>
			<key>UserDefinedName</key>
			<string>TestPassZR</string>
			<key>VPN</key>
			<dict>
				<key>AuthName</key>
				<string>tsn</string>
				<key>AuthenticationMethod</key>
				<string>Password</string>
				<key>IncludeAllNetworks</key>
				<integer>0</integer>
				<key>ProviderBundleIdentifier</key>
				<string>com.tsn.wireguard</string>
				<key>RemoteAddress</key>
				<string>54.190.85.91:31194</string>
			</dict>
			<key>VPNSubType</key>
			<string>com.tsn.wireguard</string>
			<key>VPNType</key>
			<string>VPN</string>
			<key>VendorConfig</key>
			<dict>
				<key>OnDemandEnabled</key>
				<string>1</string>
			</dict>
			<key>VPNUUID</key>
			<string>3D7A07D8-97D0-4E5A-BB04-1EB82DD12A35</string>
			<key>OnDemandMatchAppEnabled</key>
			<false/>
			<key>ProviderType</key>
			<string> packet-tunnel</string>
		</dict>
	</array>
	<key>PayloadDisplayName</key>
	<string>SmartPassZR</string>
	<key>PayloadIdentifier</key>
	<string>iOSDev2s-MacBook-Air.C6786341-4095-474C-98EB-CD0F7B0BAD59</string>
	<key>PayloadRemovalDisallowed</key>
	<false/>
	<key>PayloadType</key>
	<string>Configuration</string>
	<key>PayloadUUID</key>
	<string>B2C3510E-7C65-4353-813D-76994C6398D4</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
</dict>
</plist>

I installed the above config profile and tried opening the app. All the network calls from the app are blocked when the profile is installed. Also, I wanted my wireguard VPN to enable when the sample app is opened.

In Device console, I'm getting these messages during each URL calls.

Code Block path: unsatisfied (Network Agent [domain: NetworkExtension, type: AppVPN, description: AppVPN: TestPassZR, uuid: 223A8371-2C9B-47F2-80A6-F4644C7A3026, flags: 1] is unsatisfied), interface: en0, ipv4, dns
default	09:08:32.711523+0530	SampleTest	[C1 Hostname#f9236824:443 waiting path (unsatisfied (Network Agent [domain: NetworkExtension, type: AppVPN, description: AppVPN: TestPassZR, uuid: 223A8371-2C9B-47F2-80A6-F4644C7A3026, flags: 1] is unsatisfied), interface: en0, ipv4, dns)] event: path:unsatisfied @0.000s, uuid: 73AEBA83-9444-464A-94CC-7B24A34E2493
default	09:08:32.711898+0530	SampleTest	[C1 Hostname#f9236824:443 failed path (unsatisfied (Network Agent [domain: NetworkExtension, type: AppVPN, description: AppVPN: TestPassZR, uuid: 223A8371-2C9B-47F2-80A6-F4644C7A3026, flags: 1] is unsatisfied), interface: en0, ipv4, dns)] event: null:null @0.000s
default	09:08:32.745687+0530	SampleTest	[C2 Hostname#785f1e61:443 waiting path (unsatisfied (Network Agent [domain: NetworkExtension, type: AppVPN, description: AppVPN: TestPassZR, uuid: 223A8371-2C9B-47F2-80A6-F4644C7A3026, flags: 1] is unsatisfied), interface: en0, ipv4, dns)] event: path:unsatisfied @0.000s, uuid: A0A406EE-1C0C-4DD3-9A48-4C442DD94400
default	09:08:32.745910+0530	SampleTest	[C2 Hostname#785f1e61:443 failed path (unsatisfied (Network Agent [domain: NetworkExtension, type: AppVPN, description: AppVPN: TestPassZR, uuid: 223A8371-2C9B-47F2-80A6-F4644C7A3026, flags: 1] is unsatisfied), interface: en0, ipv4, dns)] event: null:null @0.000s

Boost