URL Filter Network Extension

Hello team,

I am trying to find out a way to block urls in the chrome browser if it is found in local blocked list cache. I found URL Filter Network very much suitable for my requirement. But I see at multiple places that this solution is only for Enterprise level or MDM or supervised device. So can I run this for normal user ? as my targeting audience would be bank users. One more thing how can I test this in development environment if we need supervised devices and do we need special entitlement ?

When trying to run sample project in the simulator then getting below error

Answered by DTS Engineer in 876048022
URL Filter Network … is only for Enterprise level or MDM or supervised device.

That’s not right. You are mixing up URL filters with content filters. URL filters have strong privacy fundamentals and thus have no deployment limitations. In contrast, content filters have significant deployment limitations.

See TN3134 Network Extension provider deployment for all the details.

When trying to run sample project in the simulator

The simulator uses the macOS networking stack, so you can’t test low-level networking facilities there. You’ll need to test this on a real device.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

URL Filter Network … is only for Enterprise level or MDM or supervised device.

That’s not right. You are mixing up URL filters with content filters. URL filters have strong privacy fundamentals and thus have no deployment limitations. In contrast, content filters have significant deployment limitations.

See TN3134 Network Extension provider deployment for all the details.

When trying to run sample project in the simulator

The simulator uses the macOS networking stack, so you can’t test low-level networking facilities there. You’ll need to test this on a real device.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

That is great, can we show any kind of custom error or alert when user tries to open blocked URL in case of URL Filter network ?

can we show any kind of custom error or alert when user tries to open blocked URL in case of URL Filter network ?

In the URL filter architecture your code isn’t the one making the actual decisions. Rather, your code sets up the filter’s state and the system applies that filter. So your code doesn’t run on the per-URL path and thus can’t do anything on that path.

WWDC 2025 Session 234 Filter and tunnel network traffic with NetworkExtension talks more about this and I encourage you to watch it.

So, your question is actually “Can we configure the filter to show a custom error?” And AFAICT the answer to that is “No.” However, I think it’d be reasonable for you to file an enhancement request for such a configuration option.

If you do file an ER, post your bug number, just for the record.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

One more thing, when using NEFilterManager we can set organization name like following way

manager.loadFromPreferences { error in
    if let error = error {
        print("Failed to load filter preferences: \(error)")
        return
    }
    // Configure the filter if needed
    manager.localizedDescription = "Expleo Content Filter"
    let config = NEFilterProviderConfiguration()
    config.organization = "PTSB Protect USSSSSS"
    manager.providerConfiguration = config

how we can achieve same in case of NEURLFilterManager

how we can achieve same in case of NEURLFilterManager

This is just a special case of my previous answer:

  • There are no configuration options like this with URL filter.
  • If you’d like to see us add something for this, you should file an enhancement request explaining your requirements.

Oh, one further point here. With URL filter it’s possible for third-party apps to opt in to filtering via the NEURLFilter type. What they do in the .deny case is up to them. You could imagine an extension to that API that returns the reason for the denial — so they could add that to their own custom UI — but that does present some privacy concerns.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

That's interesting, can you please help with small code snippet or steps that I need to do, to achieve this. Because as per documentation, we use this NEURLFilter for filtering network traffic for the apps which are using networking frameworks other than WebKit or Foundation’s URLSession

URL Filter Network Extension
 
 
Q