<!--
{
  "availability" : [
    "macOS: 10.15.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "NetworkExtension",
  "identifier" : "/documentation/NetworkExtension/NETransparentProxyNetworkSettings/includedNetworkRules",
  "metadataVersion" : "0.1.0",
  "role" : "Instance Property",
  "symbol" : {
    "kind" : "Instance Property",
    "modules" : [
      "Network Extension"
    ],
    "preciseIdentifier" : "c:objc(cs)NETransparentProxyNetworkSettings(py)includedNetworkRules"
  },
  "title" : "includedNetworkRules"
}
-->

# includedNetworkRules

An array of rules that collectively specify what traffic to route through the transparent proxy.

```
var includedNetworkRules: [NENetworkRule]? { get set }
```

## Discussion

The following restrictions apply to each rule in the array:

- If the port string of the endpoint is `0` or is the empty string, then the address of the endpoint must be a non-wildcard address, such as `0.0.0.0` or `::`.
- If the address is a wildcard address (such as `0.0.0.0` or `::)`, then the port string of the endpoint must be non-empty and must not be `0`.
- A port string of `53` is not allowed. Use Destination Domain-based rules to match DNS traffic.
- The [`matchLocalNetwork`](/documentation/NetworkExtension/NENetworkRule/matchLocalNetwork) property must be `nil`.
- The [`matchDirection`](/documentation/NetworkExtension/NENetworkRule/matchDirection) property must be [`NETrafficDirection.outbound`](/documentation/NetworkExtension/NETrafficDirection/outbound).

---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)