<!--
{
  "documentType" : "article",
  "framework" : "NetworkExtension",
  "identifier" : "/documentation/NetworkExtension/app-proxy-provider",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "App proxy provider"
}
-->

# App proxy provider

Implement a VPN client for a flow-oriented, custom VPN protocol.

## Discussion

A virtual private network (VPN) is a form of network tunnel where a VPN client uses the public internet to create a connection to a VPN server and then passes private network traffic over that connection.  If you want to build a VPN client that implements a flow-oriented, custom VPN protocol—one that works with the data passing through a transmission control protocol (TCP) connection rather than the packets used to transport that data—create an app proxy provider app extension.

When the system starts a VPN configuration that uses your app proxy provider, it performs the following steps:

- Launches your app extension.
- Instantiates your proxy provider subclass within that app extension.
- Starts forwarding flows to your provider.

Each flow represents either a TCP connection or a conversation over user datagram protocol (UDP). Your provider should to open a tunnel to a VPN server and forward each flow over that tunnel. Similarly, if your provider receives flow data from the tunnel, it should pass that back to the system through the appropriate flow.

App proxy providers are one form of per-app VPN, the other being a [Packet tunnel provider](/documentation/NetworkExtension/packet-tunnel-provider) in source application mode.

For detailed information about app proxy provider deployment options, see <doc://com.apple.documentation/documentation/Technotes/tn3134-network-extension-provider-deployment>.

> Note:
> When a VPN configuration is active, connections use the VPN instead of iCloud Private Relay. Network Extension providers also don’t use iCloud Private Relay.

## Topics

### Essentials

  <doc://com.apple.documentation/documentation/BundleResources/Entitlements/com.apple.developer.networking.networkextension>

### App proxy provider

[`NEAppProxyProvider`](/documentation/NetworkExtension/NEAppProxyProvider)

The principal class for an app proxy provider app extension.

[`NETunnelProvider`](/documentation/NetworkExtension/NETunnelProvider)

An abstract base class shared by NEPacketTunnelProvider and NEAppProxyProvider.

[`NEProvider`](/documentation/NetworkExtension/NEProvider)

An abstract base class for all NetworkExtension providers.

[`NETunnelNetworkSettings`](/documentation/NetworkExtension/NETunnelNetworkSettings)

The configuration for a tunnel provider’s virtual interface.

### Flow handling

[`NEAppProxyTCPFlow`](/documentation/NetworkExtension/NEAppProxyTCPFlow)

An object for reading and writing data to and from a TCP connection being proxied by the provider.

[`NEAppProxyUDPFlow`](/documentation/NetworkExtension/NEAppProxyUDPFlow)

An object for reading and writing data to and from a UDP conversation being proxied by the provider.

[`NEAppProxyFlow`](/documentation/NetworkExtension/NEAppProxyFlow)

An abstract base class shared by NEAppProxyTCPFlow and NEAppProxyUDPFlow.

[`NEFlowMetaData`](/documentation/NetworkExtension/NEFlowMetaData)

Additional information about data flowing through a per-app VPN provider.

[In-Provider Networking](/documentation/NetworkExtension/in-provider-networking)

Network APIs for use by all types of NetworkExtension providers and by hotspot helpers.

[Handling Flow Copying](/documentation/NetworkExtension/handling-flow-copying)

Exchange data streams by using proxy-provider classes.

### VPN configuration

[`NEAppProxyProviderManager`](/documentation/NetworkExtension/NEAppProxyProviderManager)

An object to create and manage the app proxy provider’s VPN configuration.

[`NETunnelProviderManager`](/documentation/NetworkExtension/NETunnelProviderManager)

An object to create and manage the tunnel provider’s VPN configuration.

[`NEVPNManager`](/documentation/NetworkExtension/NEVPNManager)

An object to create and manage a Personal VPN configuration.

[`NETunnelProviderProtocol`](/documentation/NetworkExtension/NETunnelProviderProtocol)

Configuration parameters for a VPN tunnel.

[`NEAppRule`](/documentation/NetworkExtension/NEAppRule)

The identity of an app whose traffic is to be routed through the tunnel.

[VPN On Demand Rules](/documentation/NetworkExtension/vpn-on-demand-rules)

Set up VPN On Demand.

### VPN control

[`NETunnelProviderSession`](/documentation/NetworkExtension/NETunnelProviderSession)

An object to start and stop a tunnel connection and get its status.

[`NEVPNConnection`](/documentation/NetworkExtension/NEVPNConnection)

An object to start and stop a Personal VPN connection and get its status.

### Transparent proxy configuration

[`NETransparentProxyManager`](/documentation/NetworkExtension/NETransparentProxyManager)

An object that configures and controls transparent proxies.

[`NETransparentProxyProvider`](/documentation/NetworkExtension/NETransparentProxyProvider)

An object that implements the client side of a custom transparent network proxy solution.

[`NETransparentProxyNetworkSettings`](/documentation/NetworkExtension/NETransparentProxyNetworkSettings)

A specification of what traffic to route through a transparent proxy.

[`NENetworkRule`](/documentation/NetworkExtension/NENetworkRule)

A rule to match attributes of network traffic.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)