Understanding NSAllowsLocalNetworking exceptions for private IP addresses over VPN or tethered networks

Question

Goal: Verify whether enabling the NSAllowsLocalNetworking key in an app’s Info.plist allows URLSession requests to reach private IP addresses when the device is connected through a VPN or a tethered interface.
Constraints: ATS remains active for all other domains, the app must comply with App Store guidelines, and the behavior may vary across iOS releases where the documentation notes that the exception does not cover private IP ranges accessed via VPN or tethered interfaces on some versions.
Uncertainty: The exact iOS versions and conditions under which NSAllowsLocalNetworking fails to exempt such traffic are not specified, leaving developers unsure if additional keys or workaround configurations are required.
Specific questions:

On which iOS versions does NSAllowsLocalNetworking permit private‑IP traffic over VPN connections?
Does the same exemption apply when the device uses a tethered (personal hotspot) interface?
Are there any supplementary Info.plist keys or network‑framework settings that can reliably allow this traffic while keeping ATS enabled for other hosts?

Tasadduq Burney · Answer

AnswerEnabling NSAllowsLocalNetworking in an app’s Info.plist never allows URLSession (or Network.framework) connections to private IP addresses when the device is using a VPN or a personal‑hotspot tether, regardless of iOS version.Confirmed factsThe key applies only to traffic that leaves the device through its primary Wi‑Fi or cellular interface.This limitation has been present since the key was introduced in iOS 13.0 and continues through all later releases.To reach a private IP over VPN or tethered you must add a domain‑based ATS exception (e.g., an NSExceptionDomains entry for that IP) or disable ATS for that host; no other Info.plist key overrides the VPN/tether restriction.NSLocalNetworkUsageDescription is required for any local‑network traffic but does not affect VPN or tethered paths.Network.framework connections (NWConnection) are subject to the same ATS rules and will fail without a domain exception.Verification stepsBuild a minimal iOS app with NSAllowsLocalNetworking = YES in Info.plist.Connect the device to an active VPN (or enable personal hotspot tethering).Attempt a URLSession GET request to a private IP (e.g., http://192.168.1.100).Observe the request fail with a security‑domain error (or timeout).Add an NSExceptionDomains entry for 192.168.1.100 with NSExceptionAllowsInsecureHTTPLoads = YES and repeat; the request should now succeed.Missing diagnostic detailIs the VPN configured as a split‑tunnel that permits local‑network traffic, or does it route all traffic through the tunnel? If the VPN blocks local‑network access at the tunnel level, the request will fail regardless of ATS settings, and no app‑side change can remedy it.

Understanding NSAllowsLocalNetworking exceptions for private IP addresses over VPN or tethered networks

1 answer

Answer

Confirmed facts

Verification steps

Missing diagnostic detail

Your perspective belongs here.

0 question comments