Architecture
Architecture Diagram
Here's a brief diagram showing the MintFlow Network Extension architecture and how user-installed apps leverage it to improve privacy and unlock limited content.
Important Concepts
UTUN Interface
When the Network Extension runs on iOS, Apple allocates a UTUN interface that can be configured to route packets by IP address using LPM (longest prefix match) to the UTUN interface. These packets are then received by the Network Extension's process for handling.
By default, MintFlow will configure to route all App's traffic to UTUN interface, to enable user to do advanced routing and filtering.
MintFlow settings include an 'Exclude LAN Networks' toggle that excludes the following well-known LAN network ranges from entering the UTUN interface:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
Important: If your L3VPN provides access to remote networks using the same LAN ranges listed above, you must not enable this option. Otherwise, you won't be able to reach the networks that your L3VPN provides.
VPPRS (MintFlow 2.0.0)
VPPRS is MintFlow's Rust vectorized packet-processing core, inspired by fd.io VPP. It replaces the legacy VPP runtime in active Apple products. It selects routes, processes packets, implements WireGuard/AmneziaWG paths, and connects streams and datagrams to the shared proxy and HTTP runtime.
DNS Server
When users enable app routing in MintFlow, it starts an internal DNS server that handles domain queries initiated by iOS or user-installed apps.
App routing rules that match domain sets determine DNS policy. DNS results provide destination route hints to VPPRS for L3VPN, L4Proxy, Direct, Drop, or Reject outputs. Optional static host records and tailnet-derived IPv4 records use MintFlow DNS; they do not replace traffic routing rules.
HTTP Engine
HTTP Engine can inspect matching TCP traffic, record HTTP/HTTPS sessions, and apply URL or jq/JavaScript body rewrites. HTTPS decryption requires a trusted local CA. The app can export stopped sessions for agent analysis and import a portable MFHRB body rule and script.
L3VPNs&L4Proxies
WireGuard and AmneziaWG integrate with VPPRS. Experimental Tailscale uses an embedded provider for tailnet identity and transport while VPPRS remains the route selector.
Rust implements the L4 proxies and connects to VPPRS through typed in-process stream/datagram bridges. Older VPP articles remain implementation history rather than a description of the 2.0.0 runtime.