davlxd / nepackettunnelvpndemo

iOS VPN client implementation demo based on iOS9 NetworkExtension NETunnelProvider APIs

Apple released a new version of Network Extension since iOS9, which allows us to implement our own VPN protocol. This repo provides a simple demo using Network Extension with Swift 3.

Server side demo is here.

This demo and server side demo are extremely simplified and only for demonstration purposes, a lot of stuff are hard coded. Further design and elaboration are required if you want apply this demo to your app.

Inspired by ShadowVPN-iOS.

Prerequisites to build

2. Then you need an iPhone. Network Extension App cannot run in iOS Simulators, you need a real iPhone to debug.

3. Login Apple developer portal, register 2 new App IDs, one for App target and another for NetworkExtension tunnel target. And make sure App Groups and Network Extensions are checked in App Services section.

4. Register an App Group in developer portal as well

5. Then, again in App IDs section of developer portal, edit the 2 App IDs you created at 3rd step, configure App Groups to the app group you created at 4th step.

6. Also in developer portal, generate 2 iOS App Development provision profiles for the 2 App IDs created before, ~~~make sure Network Extension entitlement is selected on 'Do you need additional entitlements?' page~~~ (2017-12-27 Update: This is probably not needed as well). Then download them and save them to disk.

7. Open this xcodeproj with XCode, select NEPacketTunnelVPNDemo target, in General > Identity section, change Bundle Identifier to App ID you created. Then import profiles you generated in General > Signing (Debug) section and General > Signing (Release) section.

8. Do the same thing for NEPacketTunnelVPNDemoTunnel target.

9. Find a Linux machine, build and run simple-vpn-demo, fill its IP address to ViewController.swift.

Run

1. After build & run simple-vpn-demo, your terminal should be like this.

2. After build & run NEPacketTunnelVPNDemo on your iPhone, Xcode log window should look like this, iPhone screen should look like this.

3. The Connect at the center of iPhone screen is a BUTTON, after you click it, your iPhone screen should look like this, and Xcode log window should look like this. simple-vpn-demo terminal window should look like this, which means VPN server is now receiving traffic.

4. Your IP address displaying on http://whatismyipaddress.com/ on your iPhone should be different before and after click the Connect button. thus Q.E.D.

nepackettunnelvpndemo's Issues

{NSLocalizedDescription=permission denied}

Go!
2018-05-11 17:37:48.404733+0100 NEPacketTunnelVPNDemo[4165:908595] [] -[NEConfigurationManager loadC:1673 Failed to load configurations: Error Domain=NEConfigurationErrorDomain Code=10 "permission denied" UserInfo={NSLocalizedDescription=permission denied}
2018-05-11 17:37:48.404952+0100 NEPacketTunnelVPNDemo[4165:908509] [] -[NETunnelProviderManager load:148 Failed to load the configuration: Error Domain=NEConfigurationErrorDomain Code=10 "permission denied" UserInfo={NSLocalizedDescription=permission denied}
Error Domain=NEVPNErrorDomain Code=5 "permission denied" UserInfo={NSLocalizedDescription=permission denied}
Error Domain=NEVPNErrorDomain Code=1 "(null)"

Not connect to vpn server

When I click on the button to establish a connection, I log in and the connection is not established. There is no problem on the server side.

xcode side

server side

When i clicked on the button send the same log.
Go!
VPN Status changed:
Connecting...
VPN Status changed:
Disconnected...

The same when I tried the server off.
What is the problem ?

How to parse IP into let = ServerAddress

Hello, I have made a UIPickerView and I want to return the selected output into ServerAddress I was hoping maybe you knew how to? : )

Encryption.

Hi, this is by far my favourite protocol. I am currently using Shadowsocks in my app OneProxy which I on the App Store, however before that I was using this protocol.

However, it has no encryption, thus I resorted to shadow socks.

I am wondering if you could make a update to this project and server and add encryption.

I see in the files that you have actually mentioned encryption and that you didn't have the time to do it.

If you still don't have the time maybe you could point me in the correct direction.

How to debug extension?

I read answer in this issue and did everything as written here and here, but my breakpoints are still don't work (NSLog and os_log don't work either).

This is what I see in the console after self.providerManager?.connection.startVPNTunnel()
Last disconnect error for MyAppConfig changed from "The VPN session failed because an internal error occurred." to "none"
Last disconnect error for MyAppConfig changed from "none" to "The VPN session failed because an internal error occurred."

I tried to monitor the event of changes in the VPN status (NSNotification.Name.NEVPNStatusDidChange) and this is what I saw:
VPN Status changed:
Connecting...
VPN Status changed:
Disconnected...

I can't even figure out if a method
func startTunnel(options: [String : NSObject]?, completionHandler: @escaping (Error?) -> Void) works in my class PacketTunnelProvider or not.

One more detail, I do not see my network extension in the list of available extensions (for example, in Instruments).

What else can i try to do for debugging, and how i can understand does my extension work or not?

Can't Jump into Extension

I have config vpn ok ，When run in iPhone ,the "VPN" flags is show, No Log or No Net Flow can be work in the NEPackettunnelExtension Class even if i set print function in it 。How is it works?

Integration

Hi, how would I integrate the packettunnel into https://github.com/sheng/ladder-ios
I want to be able to Tunnel the Shadowsocks through UDP and TCP

ios12显示 update required，不能连接vpn server，不知如何解决

非常感谢作者，自己copy你的项目后，ios跑起来显示update required

环境

Swift版本：
Apple Swift version 4.2 (swiftlang-1000.11.37.1 clang-1000.11.45.1)
Target: x86_64-apple-darwin17.7.0

Xcode版本：
Version 10.0 (10A255)

iOS系统版本：12.0 (iPhone 6s)

vpn显示

console日志

vpn服务端

VPN doesn't connect

Hi there the VPN doesn't connect it just shows the following.

Hello lxdcn

Hi lxdcn thank you for this great example code, I want to ask for some advice, is it possible to use this code but, with a certificate authentication. If so, could you advice me on how to achieve that?. Thank you in advance

setReadHandler never called

I am able to read packets from tunToUDP after my session starts. However, udpToTun gets called once to initialize the setReadHandler but it never gets called again. Is their something that I have to add to make setReadHandler get called?

能不能加你，我好多问题 想要问你

你好，我遇到好多问题，ssl vpn ，服务器用openvpn搭建的，用这个可以看到连接成功，但实际上网走的还是wifi，没有连接成功

VPN flag do not show

My app shows connected, but did not show the VPN logo, please help me

how to get amount of data which was uploaded and downloaded??

iOS client stuck in "Connecting"

Hi,

I've been trying to establish a connection from an iOS device to the sample server you put out. The server is set on a linux environment, and based on the ip addr show command, tun0 notes the ip address as 10.8.0.1, so I've put that as the server address. Is that the address to use, or is it something else?

I've confirmed via debugger that startTunnel is getting called, and the whole process goes through. I haven't changed any of the other parameters for NETunnelProviderProtocol.

I've also run netstat to confirm port 54345's standing, and it does show up in the list of outputted ports so I'm assuming it's open.

One thing when I run the linux server is that there are writing actions to UDP and tun being performed before I even attempt a connection from the iOS client.

I'm still very new to setting up a vpn server-client connection so I'm not sure what I could've missed in this setup. Please help.

vpn调试

你好 ，连接不需要 用户名跟密码吗

Resolve Hostname to IP

Is their any way to add Hostname to ip lookup entry using NEPacketTunnelProvider?

IPv6 traffic support?

Hey there, can you shed some light on how to modify ipv6Settings on the tunnel to support ipv6 traffic through it? Currently, my IPv6 traffic seems to bypass the tunnel. thank you!

DNS only?

Hello mate, it's been 4 years since we last talked about this project I think.

Anyways, I was wondering if it is possible to make this project DNS only. In other words, only change the DNS settings in order to be able to use custom DNS with cellular data

Username+Password

How can i add username and password field to make secure connection

Failed to save configuration: Error Domain=NEVPNErrorDomain Code=5 "IPC failed"

When I try to run the app, I get the following error:

Failed to save configuration: Error Domain=NEVPNErrorDomain Code=5 "IPC failed" UserInfo={NSLocalizedDescription=IPC failed}
Error Domain=NEVPNErrorDomain Code=5 "IPC failed" UserInfo={NSLocalizedDescription=IPC failed}
Go!
Error Domain=NEVPNErrorDomain Code=1 "(null)"

Do I have to request entitlements from apple?

VPN Connect but Internet is not working

I have successfully connect VPN but my internet is not working?

Thanks for providing this demo

这应该是为数不多的不用NEKit的还在被维护的NEPacketTunnel demo了，非常感谢！

New route

I am doing routing for customer vpn on ios.
With the information as follows:
server: 209.95.51.185
port: 1900
mtu: 1500
dns: 8.8.8.8
client ip: 10.6.0.10

I'm using openvpn, I see the vpn log is:
/bin/bin/config 10.6.0.10 10.6.0.9 mtu 1500 netmask 255.255.255.255 up
/ sbin / route add -net 10.6.0.1 10.6.0.9 255.255.255.255

And I make the following route:
NEPacketTunnelNetworkSettings * tunnelNetworkSettings = [[NEPacketTunnelNetworkSettings alloc] initWithTunnelRemoteAddress: self.protocolConfiguration.serverAddress];
    
    tunnelNetworkSettings.IPv4Settings = [[NEIPv4Settings alloc] initWithAddresses: @ [config [@ "ipclient"]]
                                                                       subnetMasks: @ [@ "255.255.255.0"]];
    
    
    tunnelNetworkSettings.MTU = [NSNumber numberWithInt: [config [@ "mtu"] intValue]];
    
    NEDNSSettings * dnsSetting = [[NEDNSSettings alloc] initWithServers: @ [@ "8.8.8.8", @ "8.8.4.8"]];
    tunnelNetworkSettings.DNSSettings = dnsSetting;
    
    NSMutableArray * includedRoutes = [[NSMutableArray alloc] init];
    NEIPv4Route * route;
    
    route = [NEIPv4Route defaultRoute];
    [includedRoutes addObject: route];
    
    route = [[NEIPv4Route alloc] initWithDestinationAddress: @ "10.6.0.1" subnetMask: @ "255.255.255.255"];
    [includedRoutes addObject: route];
    
    
    route = [[NEIPv4Route alloc] initWithDestinationAddress: config [@ "ipsub"] subnetMask: @ "255.255.255.252"];
    [includedRoutes addObject: route];
    
    tunnelNetworkSettings.IPv4Settings.includedRoutes = includedRoutes;
But it did not work, you see I was wrong where. Thanks you

More than one server?

Hello, I was wondering how I would add more than one server? IE have a 2nd button for server 2

Only DNS

Can i use this code only for DNS?
I need use other DNS only.

After Connection Ip address still same as before connection

I just follow all the instruction described in the details and successfully profile is created and connection is established but vpn tag on the top of status bar is not shown and not even the ip is updated.

NEPacketTunnelProvider is not intercepting packets having local destination.

After enabling the NEPacketTunnelProvider, If I access a URL based on local IP address on Safari. PacketFlow.readPackets does not read that packet. And on Safari I got the response without any error.
Do I need to set any extra configuration to enable local traffic intercepting?
Please let me know of you need any other info.

Connects but IP the same

As per title, It now connects but the IP does not change, when I open Speedtest app it tries to display ISP, it displays my ISP then searches again, it does this in a loop

Can't find "selected on 'Do you need additional entitlements?' page".

Hi,

When i create provision profiles, i can't find this page that ask me 'Do you need additional entitlements?' page?

How i fix it?

thank you.

Select Ip

Hello,

I have 3 IPs to choose from (all servers run on same port and same config)

I was wondering how I could create a list and choose from random, then pass the ip to let serverAddress =

Again at random from 3 options.