---
title: Network Extension
framework: Network Extension
role: collection
role_heading: Framework
platforms: [iOS 8.0+, iPadOS 8.0+, Mac Catalyst 13.1+, macOS 10.10+, tvOS 17.0+, visionOS 1.0+, watchOS 7.0+]
path: networkextension
---

# Network Extension

Customize and extend core networking features.

## Overview

Overview With the NetworkExtension framework, you can customize and extend the system’s core networking features. Specifically, you can: Change the system’s Wi-Fi configuration Integrate your app with the hotspot network subsystem (Hotspot Helper) Create and manage VPN configurations, using the built-in VPN protocols (Personal VPN) or a custom VPN protocol Create and manage network relay configurations Implement an on-device content filter Create and manage system-wide DNS configurations, using the built-in DNS protocols or a custom on-device DNS proxy The NetworkExtension framework is available in macOS, iOS, tvOS, and visionOS, but not all features are available on all platforms and some features have specific restrictions (for example, some features only work on supervised iOS devices). The documentation for each feature describes these restrictions. Options for implementing VPN The NetworkExtension framework has extensive support for virtual private networks (VPN).  A VPN is a form of network tunnel, where a VPN client uses the public Internet to create a connection to a VPN server and then passes private network traffic over that connection. VPNs have many different uses.  For example, an enterprise might set up a VPN to give remote employees access to enterprise network resources that are not available on the public Internet.  Or a consumer wanting to access the Internet from an untrusted network, such as the free Wi-Fi at an airport, might set up VPN to secure their traffic. The supported operating systems include a number of different VPN APIs, distinguished by the protocols they support: Use Personal VPN to create and manage a VPN configuration that uses one of the built-in VPN protocols (IPsec or IKEv2). Create a Packet tunnel provider to implement a VPN client for a packet-oriented, custom VPN protocol. Create an App proxy provider to implement a VPN client for a flow-oriented, custom VPN protocol. About Always-on VPN iOS supports Always-on VPN to ensure all IP traffic is tunneled back to the organization. See the iOS Deployment Reference for information about how to configure Always-on VPN.

## Topics

### Wi-Fi management

- [Wi-Fi configuration](networkextension/wi-fi-configuration.md)
- [Configuring a Wi-Fi accessory to join a network](networkextension/configuring-a-wi-fi-accessory-to-join-a-network.md)
- [Hotspot helper](networkextension/hotspot-helper.md)

### Virtual private networks

- [Routing your VPN network traffic](networkextension/routing-your-vpn-network-traffic.md)
- [Personal VPN](networkextension/personal-vpn.md)
- [Packet tunnel provider](networkextension/packet-tunnel-provider.md)
- [App proxy provider](networkextension/app-proxy-provider.md)

### Network relays

- [Relays](networkextension/relays.md)

### Content filters

- [Content filter providers](networkextension/content-filter-providers.md)
- [Filtering Network Traffic](networkextension/filtering-network-traffic.md)

### URL filters

- [URL filters](networkextension/url-filters.md)

### DNS configurations

- [DNS settings](networkextension/dns-settings.md)
- [DNS proxy provider](networkextension/dns-proxy-provider.md)

### Local networking

- [Local push connectivity](networkextension/local-push-connectivity.md)

### App extensions

- [NEAppExtensionConfiguration](networkextension/neappextensionconfiguration.md)

### Protocols

- [NEAppProxyUDPFlowHandling](networkextension/neappproxyudpflowhandling.md)

### Structures

- [NETunnelProviderError](networkextension/netunnelprovidererror-swift.struct.md)
- [NEVPNError](networkextension/nevpnerror-swift.struct.md)

### Variables

- [NERelayClientErrorDomain](networkextension/nerelayclienterrordomain.md)

### Enumerations

- [NERelayManagerClientError](networkextension/nerelaymanagerclienterror.md)