How can (third-party) VPN applications tunnel all communication of all processes on sandboxed operating systems (such as OSX, etc)? Can they access the traffic of other apps and redirect them?

Why is this approach often preferred over using the built-in native VPN client that many systems come with? How do the approaches compare in terms of security?

  • A VPN just changes a device's routing table. That's an OS-wide thing, not affected by sandboxing. – forest Dec 18 '17 at 8:27
  • @forest, I see, that makes sense. But then, presumably, all apps are allowed to make such changes -- what guarantees that the VPN app has the final say? ie. isn't it possible that my another app alters the routing table too, for whatever reason, and so leaves some traffic unencrypted? – gen Dec 18 '17 at 9:22
  • Only root can change a system's routing table. This is why VPN applications need root/administrator privileges to set up, whereas a proxy just requires changing an application's configuration. – forest Dec 18 '17 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.