> Source: [sk181399](https://support.checkpoint.com/results/sk/sk181399)

# sk181399 - How to control routing priority in Capsule Connect for iOS

| Property | Value |
|----------|-------|
| Solution ID | sk181399 |
| Date Created | 2023-08-20 |
| Last Modified | 2023-09-07 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |
| OS | iOS |
| Platform | Mobile Devices |

## Solution

### Overview

An attacker with the use of a specially crafted Wi-Fi network, to which the Capsule Connect for iOS app connects, can cause traffic from a targeted source IP address to go outside the VPN tunnel instead of going through the VPN tunnel.

This attack exploits the iOS default route exclusions.

By default, both these IP addresses are excluded from the VPN tunnel (if they are defined as part of the encryption domain on the VPN Gateway or in the case of a route-all-traffic configuration):

* The local network, to which the device is connected to.
* The IP address for the VPN Gateway, to which the Capsule Connect for iOS app is connected to.

This is done by the iOS to allow connectivity within the local network and to the VPN Gateway.

### Prevention

To prevent this type of attack, you can configure the applicable "key-value" pairs in the applicable VPN profile:

|------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Key                    | Description and Values                                                                                                                                                                                                                                                          |
| `enforceRoutes`        | Controls whether VPN routes take precedence over local OS routes: * `yes` = VPN routes take precedence over local OS routes * `no` = Local OS routes take precedence over VPN routes (this is the default)                                                                      |
| `includeLocalNetworks` | Controls whether to include local networks in the VPN tunnel: * `yes` = Include local networks in the VPN tunnel (requires "`enforceRoutes = yes`") * `no` = Exclude local networks from the VPN tunnel (this is the default)                                                   |
| `includeGwRoute`       | Controls whether to include the VPN Gateway route in the VPN tunnel (requires "`enforceRoutes = yes`"): * `yes` = Include the VPN Gateway route in the VPN tunnel (this is the default when "`enforceRoutes = yes`") * `no` = Exclude the VPN Gateway route from the VPN tunnel |

<br />

### Configuration

You can configure these "key-value" pairs in one of these ways:

* Directly in iOS on supporting MDMs.

* Through a custom "key-value" pairs set in the VPN profile that you can configure in one of these ways:

  * In MDM deployments, you can configure these "key-value" pairs in the custom data of a "**custom ssl** " VPN profile. See: [sk170298 - Capsule Connect - MDM configuration, including Per-App VPN and Zero-touch configuration](https://support.checkpoint.com/results/sk/sk170298).

  * For deployments using a QR code for the Capsule Connect app, you can configure these "key-value" pairs with the Check Point "CPQRGen" tool. See: [sk102796 - Creating a QR Code using CPQRGen for Mobile applications](https://support.checkpoint.com/results/sk/sk102796).

<br />

### Related Solution

[sk181416 - How to control routing priority in Capsule VPN for Android](https://support.checkpoint.com/results/sk/sk181416)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content