I am planning an iOS security and content-blocking app for unmanaged consumer iPhones.
The app would not provide a traditional VPN service. It would not offer:
- Remote VPN servers
- Geographic location switching
- Access to a private corporate network
- IP-address masking as a service
- Anonymous browsing
Instead, the app would allow the user to:
- View destination domains contacted by the device
- Classify destinations such as trackers, advertising, analytics, or potentially malicious domains
- Manually block selected domains
- Keep connection history and filtering decisions on the device
I understand that NEFilterDataProvider and NEFilterControlProvider are the APIs intended for network content filtering. However, according to TN3134, these providers are not generally deployable for an unmanaged adult consumer iPhone.
I also understand that TN3120 says NEPacketTunnelProvider should not be used as a general-purpose local content filter.
This appears to leave a gap for an unmanaged consumer security app whose core feature is user-controlled, system-wide domain blocking.
I am considering whether NETunnelProviderManager with an NEPacketTunnelProvider could support the feature, but I do not want to use the packet-tunnel API outside its supported purpose.
My questions are:
- Is there currently a supported Network Extension architecture for system-wide, user-controlled domain blocking on an unmanaged adult consumer iPhone?
- Can an app with this purpose use
NEPacketTunnelProvider,or would that necessarily be considered the unsupported general-purpose filtering use described in TN3120? - If such an architecture is supported, could an app with this purpose be treated as an approved security or content-blocking provider under Guideline 5.4 rather than as an app offering a traditional VPN service?
- App Review Guideline 5.4 states that apps offering VPN services must be submitted by developers enrolled as organizations. It also states that parental-control, content-blocking, and security apps from approved providers may use NEVPNManager.
For an app that does not provide a remote VPN service but uses Apple’s VPN configuration infrastructure only for local security and user-controlled blocking, must the developer still enroll as an organization, or may an individual Apple Developer Program member submit it?