SideStore usually requires a WireGuard tunnel or StosVPN, so traffic generated during app install/refresh process can be hijacked and processed by SideStore itself.

This tool provides an alternative to the aforementioned tools, and can allow SideStore to work across all iOS devices on your local network, without setting up WireGuard or StosVPN individually.

How it works

When installing or refreshing apps, SideStore opens ports on local iOS device mimicing a computer running developer software. Then it instructs iOS to connect to a computer at 10.7.0.1.

This tool creates a TUN device expecting packets to 10.7.0.1, swap the source/destination field of each packet, and send them so that they are forwarded back to the iOS device sending the request. This will get iOS talking with SideStore's fake computer, and allow apps to be installed/refreshed.

This is the same approach as used by StosVPN: https://github.com/SideStore/StosVPN/blob/main/TunnelProv/PacketTunnelProvider.swift

How to use

You need to run this tool on a Linux computer that is in the same LAN. This tool will not work if there are stateful NAT layers between the iOS device and the computer, since when sending the packets back, this tool is effectively initiating connections back to the iOS device, which will be blocked by stateful NAT.

You will also need to enable IP forwarding on that Linux machine.

Install cargo on your Linux machine, clone this repo, and run:

cargo build --release
sudo target/release/sidestore-vpn

A new TUN device will be created, and start handling traffic to 10.7.0.1.

If you're not running this tool on your router, you need to create a static route in your router with the following configuration.

• Route: 10.7.0.1/32
• Netmask (if asked): 255.255.255.255
• Gateway: IP address of the computer running this tool.

If your router doesn't allow you to create a /32 route, you can expand the route a bit, as long as it doesn't conflict with your other devices:

• Route: 10.7.0.0/24
• Netmask (if asked): 255.255.255.0
• Gateway: IP address of the computer running this tool.

Once configured, your iOS devices should be able to install/refresh apps without WireGuard or StosVPN.

Docker

A Docker image is available at ghcr.io/xddxdd/sidestore-vpn:

docker run --rm --cap-add=NET_ADMIN --network=host --device /dev/net/tun:/dev/net/tun ghcr.io/xddxdd/sidestore-vpn

Docker compose

services:
  sidestore-vpn:
    image: ghcr.io/xddxdd/sidestore-vpn
      cap_add:
        - NET_ADMIN
      network_mode: host
        devices:
          - /dev/net/tun:/dev/net/tun

The container requires the /dev/net/tun device, as well as network_mode: host to create the interface. The NET_ADMIN permission allows the container to perform network-related tasks that require elevated permissions.

An alternative to both would be to use privileged in the docker run command or privileged: true in the docker compose. Because the binary is the only thing in the image the bare minimum is used.

Examples with Tailscale

docker run --rm --cap-add=NET_ADMIN -v /dev/net/tun:/dev/net/tun ghcr.io/xddxdd/sidestore-vpn:tailscale

docker run --rm --cap-add=NET_ADMIN -v /dev/net/tun:/dev/net/tun -v ./state:/var/lib/tailscale \
  -e TS_AUTHKEY=tskey-xxxxxxx \
  -e TS_HOSTNAME=sidestore-vpn \
  ghcr.io/xddxdd/sidestore-vpn:tailscale

echo "TS_AUTHKEY=tskey-xxxxxxx" > .env
docker compose -f docker-compose-tailscale.yml up

systemd-service

To start the service when the system boots you can add the following systemd service:

[Unit]
Description=Sidestore app signing
After=network.target

[Service]
Type=simple
ExecStart=/home/YOUR_USERNAME_HERE/sidestore-vpn/target/release/sidestore-vpn
User=root
Restart=on-failure

[Install]
WantedBy=multi-user.target

Ensure the ExecStart path is correct. To enable it:

1. Write the above configuration to sudo /etc/systemd/system/sidestore.service
2. Run sudo systemctl daemon-reload to load the service
3. Run sudo systemctl enable sidestore to enable the service
4. Run sudo systemctl start sidestore to start the service
5. Run sudo systemctl status sidestore to check if the service is running

Do the same thing with Nftables

If you're familiar with Nftables and are comformable with editing firewall rules directly, you can use the following rules to do the exact same thing as this program:

table ip sidestore {
  chain NAT_PREROUTING {
    type nat hook prerouting priority -350; policy accept;
    ip daddr 10.7.0.1 ip daddr set ip saddr ip saddr set 10.7.0.1 notrack
  }
}

Thanks to @KusakabeShi for providing this working rule.

Credit

Thanks to SideStore for creating an app to easily install apps on iOS devices.

Thanks to StosVPN for the approach in networking.

License

Public domain.