Supported architecture and organization requirement for an on-device iOS domain blocker

I am planning an iOS security and content-blocking app for unmanaged consumer iPhones.

The app would not provide a traditional VPN service. It would not offer:

  • Remote VPN servers
  • Geographic location switching
  • Access to a private corporate network
  • IP-address masking as a service
  • Anonymous browsing

Instead, the app would allow the user to:

  • View destination domains contacted by the device
  • Classify destinations such as trackers, advertising, analytics, or potentially malicious domains
  • Manually block selected domains
  • Keep connection history and filtering decisions on the device

I understand that NEFilterDataProvider and NEFilterControlProvider are the APIs intended for network content filtering. However, according to TN3134, these providers are not generally deployable for an unmanaged adult consumer iPhone.

I also understand that TN3120 says NEPacketTunnelProvider should not be used as a general-purpose local content filter.

This appears to leave a gap for an unmanaged consumer security app whose core feature is user-controlled, system-wide domain blocking.

I am considering whether NETunnelProviderManager with an NEPacketTunnelProvider could support the feature, but I do not want to use the packet-tunnel API outside its supported purpose.

My questions are:

  1. Is there currently a supported Network Extension architecture for system-wide, user-controlled domain blocking on an unmanaged adult consumer iPhone?
  2. Can an app with this purpose use NEPacketTunnelProvider, or would that necessarily be considered the unsupported general-purpose filtering use described in TN3120?
  3. If such an architecture is supported, could an app with this purpose be treated as an approved security or content-blocking provider under Guideline 5.4 rather than as an app offering a traditional VPN service?
  4. App Review Guideline 5.4 states that apps offering VPN services must be submitted by developers enrolled as organizations. It also states that parental-control, content-blocking, and security apps from approved providers may use NEVPNManager.

For an app that does not provide a remote VPN service but uses Apple’s VPN configuration infrastructure only for local security and user-controlled blocking, must the developer still enroll as an organization, or may an individual Apple Developer Program member submit it?

Supported architecture and organization requirement for an on-device iOS domain blocker
 
 
Q