If anyone else know how to do monitor/block network connection on per APP base in IOS, I would love to hear about it.
I've been seeking a Little Snitch type connection monitor/firewall for iOS for some time. I believe Apple purposely makes this difficult/impossible on iPhones due to the constant metrics/analytics sent to Apple servers.
Look at what they have done with turning off bluetooth and wifi from the Control Center.. It's really eye-opening to see how often Apple products ping home.
I believe Apple purposely makes this difficult/impossible on iPhones due to the constant metrics/analytics sent to Apple servers.
I don't think that follows. Allowing applications to intercept and mess with other application's network traffic would be an obvious security issue; that's far more likely to be the reason than some kind of vague "we want to track your data" thing.
It's certainly possible that Apple could construct an appropriate API for allowing users to configure apps in such a fashion that they could monitor network traffic, much the same way as similar APIs exist for accessing e.g. photos. But since it's a niche application at best, I'm hardly surprised they haven't done so.
Such an API already exists: the NetworkExtension APIs, specifically NEPacketTunnelProvider and NEAppProxyProvider. They're meant for VPNs, but it should be possible to use the same APIs to monitor traffic and send it on, rather than tunneling it through a VPN. (There is also NEFilterProvider, but that API is designed to run the filter in a tight sandbox that doesn't allow it any outbound communication, so that it can filter packets but not exfiltrate them.)
…though if you're concerned about privacy, perhaps you should be using a real VPN anyway, in which case you could handle traffic monitoring and filtering on the server side.
Edit: I guess the server-side approach wouldn't allow identifying on which app is making the connection. The NetworkExtension APIs, however, should allow that: you get a flow of NEPackets, each of which has a 'metadata' property containing a 'sourceAppUniqueIdentifier' and 'sourceAppSigningIdentifier'. I don't have personal experience using these APIs though.
Allowing applications to intercept and mess with other application's network traffic
Look at your cellular data usage in "system services" .. Apple is already intercepting and sending home a lot of your information without your ability to stop it.
I block all that via firewall, authoritative DNS and gateway on home network. It works very well. Trying to accomplish this via an app on an un-rooted iPhone would be a headache, IMO, and ultimately is subject to defeat by Apple if they so choose. As seems to be the computing paradigm du jour, Apple more or less has "remote control" over these devices, whether through automatic updates, their control over an AppStore or some other mechanism.
When someone buys an iPhone, there is an expectation that an ongoing relationship with the company is created. It is assumed every purchaser wants to use Apple's time servers, Apple's messaging service, Apple's cloud storage, Apple's software review process, etc. and there is no opt-out. Consequently the purchaser is expected to establish a means to identify themselves to the company (AppleID) in the future. Fingerprints may be collected, facial recognition, etc. Apple has the means to know its hardware customers, very well. It does not really feel like we own the hardware. More like a lease or rental. Feels like we are being used as a source of further revenue generation. A massive user base tethered to the company that it can use as a bargaining chip to make deals with other companies.
Here is a different approach. Imagine you have two mobile devices. 1. An iPhone. 2. A portable computer running an open source OS that can act as firewall, authoritative DNS server and/or gateway. Apple has no control over #2. #1 can only access the internet through #2. #2 belongs solely to the user and it is controlled by the user, not any company.
Perhaps one day we will see Apple controlling the user's routing table and any network settings entered by the user will be subservient to Apple's.
As you say, they are already controlling the routing table on the user's device for voice calls. Does the user opt-in to that or is it automatically turned on?
> Look at what they have done with turning off bluetooth and wifi from the Control Center.. It's really eye-opening to see how often Apple products ping home.
Are you trying to imply that iOS devices ‘ping home’ when you disconnect from WiFi or Bluetooth? Or are you just complaining about the previous behavior (updated in 11.2 to be more obvious) that disconnected WiFi I stead of disabling it?
Look at what they have done with turning off bluetooth and wifi from the Control Center.. It's really eye-opening to see how often Apple products ping home.