Determining source app of IP traffic in NETunnelProviderManager I am using NETunnelProviderManager in "routing by destination IP" and am able to get IP traffic from various apps on the device.

The challenge I am having is that I need to determine which application each packet has come from so I can filter and block traffic as needed, so I can prevent a rogue app being created to access an internal location. It is not feasible for me to use NETunnelProviderManager's "per-app" mode since I am not using MDM.

It seems that if I had access to the system's TCB table (or access to the TCB table for each process) I could do this, but it looks like iOS does not publish this information and I haven't found any private APIs either to get this information on a non-jailbroken device.

Any ideas?
It says specifically on the NETunnelProvidermanager specs, "The only way to configure "per app" VPN is with MDM..." so in terms of the mainstream way of meeting all the Apple specifications, and at least in the context of Apple Stack Exchange, it seems this would not be possible.  I hope someone else, or I, can find a nice workaround for you though if it doesn't work.

One tip though:  it does discuss directly below the VPN settings, in the spec guide, how to configure on-demand VPN, and if your requirement is not that that the VPN is "always on," you may be able to meet your specific goal just by creating the necessary certificates.

You may prefer to to make the .mobilconfig files by hand once you see the options and syntax available, but you might be able to generate only exactly the certificates you need, for example the VPN, using Apple Configurator without having to completely take control of the device.