Can't update VPN app when includeAllNetworks is set to true

Question

Created Jun ’25

Replies 4

Boosts 1

Participants 3

If the includeAllNetworks flag to true, we cannot update our app via Xcode, TestFlight or the AppStore. In the AppStore and TestFlight cases, it seems that the packet tunnel process is stopped before the new app is downloaded - once the packet tunnel process is stopped, it can’t be started again via Settings/VPN profiles, nor can it be started via the app.

Answered by DTS Engineer in 846705022

we have submitted feedback … FB16482585

Good. That’s the correct path forward here.

For context, problems like this crop up from time-to-time on iOS. Coordinating the work required to tear down the VPN, install the new API, and then bring it back up is tricky. If this fails, there’s really not much you can do about it at a code level. This is all managed by the system.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

Joneth OP

Jun ’25

I forgot to mention that we have submitted feedback through Feedback Assistant with the id FB16482585.

0

Answer 2

Joneth OP

Jun ’25

I should also point out that this talk from the latest WWDC mentions includeAllNetworks, and it seems strange that the behaviour we're seeing is intended.

0

Answer 3

DTS Engineer OP

Apple

Jun ’25

Recommended

we have submitted feedback … FB16482585

Good. That’s the correct path forward here.

For context, problems like this crop up from time-to-time on iOS. Coordinating the work required to tear down the VPN, install the new API, and then bring it back up is tricky. If this fails, there’s really not much you can do about it at a code level. This is all managed by the system.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 4

Danbana OP

1w

This is such a critical issue for anyone who may even consider this flag.

The only thing we can do are kludges.

We can't even detect if the user has auto-updates enabled or when the update is occurring.

The best I can think of is to send a notification (which will probably get ignored or not seen), before the update goes live, that when received in the NSE checks if the kill switch is enabled (which is implemented with includeAllNetworks), and if so tell the user to disable the kill switch and update the app. Other options being to inform the user of this terrible bug in iOS when they enable the kill switch. Or if the user open the app when a new version is available but haven't auto-updated yet.

It's a lot to ask to have a feature in your app that can completely mess up a users phone (they have no internet connectivity, and not only need to restart the phone, but delete the profile buried in the settings first, to ever be able to use their phone)

Seems ridiculous to put all the production value into the WWDC video with this flag and not even test if you can update without practically bricking the phone

0