NetworkExtension on reboot

Question

Created Dec ’21

Replies 4

Boosts 0

Participants 2

Hello, I'm trying to understand a particular behaviour of NetworkExtension. When I reboot the device the VPN Profile is set onDemand(true) but it seems that prior to first unlock it does not attempt to connect.

Is there no way to make VPNs connect prior to first unlock?

If not is there any traffic allowed prior to unlock AKA traffic is allowed outside of the tunnel prior to first unlock?

Answered by DTS Engineer in 698135022

Is there no way to make VPNs connect prior to first unlock?

Presumably this means you’re working on iOS. If so, why does this matter? What’s generating traffic that needs to be protected by the VPN prior to first unlock?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Answer 1

DTS Engineer OP

Apple

Dec ’21

Accepted Answer

Is there no way to make VPNs connect prior to first unlock?

Presumably this means you’re working on iOS. If so, why does this matter? What’s generating traffic that needs to be protected by the VPN prior to first unlock?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Answer 2

DTS Engineer OP

Apple

Dec ’21

Why it matters, entirely depends if other apps can generate traffic prior to first unlock.

Because it’s critical that your VPN protect that traffic?

Can other apps generate traffic prior to first unlock?

Yes. This is pretty uncommon but there are scenarios where third-party code can run prior to first unlock and, if it runs, it can use the network. The canonical example of this is a third-party VoIP solution, where users expect to receive phone calls before first unlock.

And also judging from the first reply I assume there is no way for the VPN to be active prior to first unlock?

Yes, and no. You can do this with Always-on VPN, but that’s not available to third-party VPN products (r. 33804980)

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Answer 3

res0nance OP

Dec ’21

Because it’s critical that your VPN protect that traffic?

Yes it is critical that my app protects this traffic as well.

Yes, and no. You can do this with Always-on VPN, but that’s not available to third-party VPN products (r. 33804980)

What is 33804980? And can we request for an enhancement to allow third-party products to be able to do this prior to first unlock?

Answer 4

DTS Engineer OP

Apple

Dec ’21

What is 33804980?

It’s a Radar bug number for an enhancement request to support Always-on VPN for third-party NE VPN providers. You can’t access that bug, because Feedback Assistant only lets you see the status of bugs that you filed.

And can we request for an enhancement to allow third-party products to be able to do this prior to first unlock?

You can file your own enhancement request for this. If you ask is to be dup’d to to 33804980 then you’ll be able to get very limited status on that bug (basically you can see whether it’s open or closed).

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"