TN3134: Network Extension provider deployment

Overview

Network Extension providers extend the networking stack in various ways. You might implement a custom VPN protocol with a packet tunnel provider, or add a content filter provider as part of a parental control app. Network Extension supports many different provider types and each type has different deployment requirements. The tables below summarise these requirements for each provider type.

When reading these tables:

• The Mac Catalyst platform refers to a provider embedded in a Mac Catalyst app running on Mac. For more information, see Mac Catalyst.

• The iOS Apps on Mac platform refers to a provider embedded in an iOS app running on an Apple silicon Mac. For more information, see Running your iOS apps in macOS.

• On macOS most Network Extension provider types can be packaged as either an app extension or a system extension. App extensions run in a user context; if the user logs out, the provider is terminated. System extensions run in a global context, completely independent of the logged in user.

• When a provider’s per-app configuration is restricted to managed devices, the targeted apps must be installed using MDM.

• If a macOS row doesn’t mention the “App Store only” restriction, the provider supports both App Store distribution and direct distribution using Developer ID signing.

For more information about using the Network Extension framework as a whole, see Network Extension.

Deploying a packet tunnel provider

When building a packet tunnel provider, use the following table to plan your deployment:

For more information, see Packet tunnel provider.

Before you decide to implement a packet tunnel provider, read TN3120: Expected use cases for Network Extension packet tunnel providers.

Deploying an app proxy provider

When building an app proxy provider, use the following table to plan your deployment:

For more information, see App proxy provider.

Deploying a URL filter provider

When building a URL filter provider, use the following table to plan your deployment:

For more information, see URL filters.

Deploying a content filter provider

When building a content filter provider, use the following table to plan your deployment:

For more information, see Content filter providers.

In the Screen Time case, content filters are only supported on child devices. To enable a content filter:

1. Add the Family Controls capability to your app. See Adding capabilities to your app.

2. Run it on a device where the user has signed in as an under 18 child member of an iCloud family.

3. Request child authorization. On iOS 16 and later, call requestAuthorization(for:), passing in the .child option. On iOS 15, call requestAuthorization(completionHandler:), which always requests child authorization.

4. Authorize that as the child’s parent or guardian.

Before submitting your app to the App Store, you must request permission to use the Family Controls entitlement for distribution.

Deploying a DNS proxy provider

When building a DNS proxy provider, use the following table to plan your deployment:

For more information, see DNS proxy provider.

Deploying a transparent proxy provider

When building a transparent proxy provider, use the following table to plan your deployment:

For more information, see the discussion of transparent proxies within App proxy provider.

macOS 11.0 introduced significant improvements to the transparent proxy feature; for the details, see NETransparentProxyProvider.

Deploying a packet filter provider

When building a packet filter provider, use the following table to plan your deployment:

For more information, see Content filter providers.

Deploying an Ethernet tunnel provider

When building an Ethernet tunnel provider, use the following table to plan your deployment:

For more information, see NEEthernetTunnelProvider.

Deploying an app push provider

When building an app push provider, use the following table to plan your deployment:

For more information, see Local push connectivity.

Deploying a hotspot provider

When building a hotspot provider, use the following table to plan your deployment:

For more information about hotspot providers, see Hotspot helper.

Before starting development, request permission to use the com.apple.developer.networking.HotspotHelper entitlement. See Hotspot helper for the details.

Revision History

• 2025-08-19 Added sections for URL filter and hotspot providers. Added visionOS entries to the appropriate tables. Clarified the role of MDM in per-app configurations. Made other minor editorial changes.

• 2023-11-28 Clarified the Family Controls behaviour for content filter providers on iOS.

• 2023-10-03 Updated for tvOS 17.

• 2022-09-06 First published.

See Also

Latest

• TN3205: Low-latency communication with RDMA over Thunderbolt
• TN3206: Updating Apple Pay certificates
• TN3179: Understanding local network privacy
• TN3190: USB audio device design considerations
• TN3194: Handling account deletions and revoking tokens for Sign in with Apple
• TN3193: Managing the on-device foundation model’s context window
• TN3115: Bluetooth State Restoration app relaunch rules
• TN3192: Migrating your iPad app from the deprecated UIRequiresFullScreen key
• TN3151: Choosing the right networking API
• TN3111: iOS Wi-Fi API overview
• TN3191: IMAP extensions supported by Mail for iOS, iPadOS, and visionOS
• TN3189: Managing Mail background traffic load
• TN3187: Migrating to the UIKit scene-based life cycle
• TN3188: Troubleshooting In-App Purchases availability in the App Store
• TN3186: Troubleshooting In-App Purchases availability in the sandbox