# iOS & iPadOS: capability boundaries

Destination routing, managed per-app controls and tunnel loss are different capabilities.

Updated: 2026-11-05
Canonical: https://shortant.ai/en/guides/platform-ios/

Adapted from Public Network Protection Guide 3.0.1. Read-only review first; no universal executable configuration is supplied.

## Do not overstate the guarantee

A personal-device routing tool may control destinations without isolating every request from an app. A single-node group and on-demand reconnection do not establish fail-closed behavior after the network extension exits.

Managed VPN and per-app capabilities depend on OS version and management model. Confirm the actual supported scope without installing a management profile or replacing another VPN merely because a guide mentions one.

## Protocols, resources and safe testing

Inspect DNS, IPv6, UDP failure behavior, excluded routes and resource precedence in both configuration and app preferences. Blocking UDP fallback does not rule out TCP relays or system delegates. Keep TLS validation.

Record Wi-Fi, cellular, switching, sleep/wake and resource refresh separately. Without an independent safe boundary, tunnel-loss tests remain untested. Do not disable production protection to demonstrate leakage.

## Sources and scope

- [Apple deployment documentation (verify applicability)](https://support.apple.com/guide/deployment/welcome/web)

Independent educational adaptation; vendor documents retain their owners’ rights. Check the installed version and applicability. Browser scores do not verify local isolation, account access or ban risk.