Hi HN,

I just got MintFlow NetStack 1.1.0 approved by Apple, which introduces app-level routing capabilities. I thought this would be a good time to share the project and some of the technical background behind its development.

Over the past two years, I’ve built two iOS VPN apps based on Tailscale. I appreciate their excellent documentation and high-quality code. However, I wanted more flexibility on the client side—particularly around local routing and split tunneling. While Tailscale now offers an App Connector feature, my use case required everything to run locally, without needing a central coordinator to distribute DNS routes.

Since I’ve been working with fd.io VPP for a while and really like its architecture, I decided to try building a WireGuard-based VPN app on top of it. VPP has a WireGuard plugin modeled after FreeBSD’s implementation (though not actively maintained). My first challenge was porting the VPP core to Darwin (the underlying OS for iOS/macOS). Thanks to recent FreeBSD support via epoll-shim, it turned out to be complex but feasible—and I eventually got VPP running on macOS.

From there, I bridged Apple’s utun interface with VPP’s host stack, handling BSD socket I/O and eventually getting a working app. Version 1.0.0 shipped with basic split tunneling based on CIDR prefixes, but that felt too limited.

So last month, I added an internal stub DNS resolver using hickory-dns (Rust-based), and enabled VPP's host stack to reconstruct TCP/UDP connections from the Apple tunnel interface and forward them via local interfaces (Wi-Fi/Cellular). This unlocks much more granular routing—like selectively sending specific traffic through WireGuard, keeping others local, or blocking routes entirely using VPP’s blackhole.

I'm happy to discuss the technical details. Never thought I’d still be writing C in 2025 for an iOS app core—though Rust is now part of the stack too. I initially tried using c-ares for DNS but opted for Rust to move faster and learn something new.

It’s been a lot of fun building this. Right now, MintFlow is a paid app with a one-time purchase. I plan to keep expanding it—VPP’s active development means I can add features like MITM-based HTTPS capture and more advanced routing in future releases.

Here are the links:

App Store: https://apps.apple.com/us/app/mintflow-netstack/id6742394218

Website: https://mintflow.643216.xyz

Thanks!

Submissions by mintflow

Show HN: MintFlow NetStack – A new WireGuard iOS client built upon fd.io VPP

Show HN: MintFlow NetStack – A new WireGuard iOS client built upon fd.io VPP