<!--
{
  "documentType" : "article",
  "framework" : "NetworkExtension",
  "identifier" : "/documentation/NetworkExtension/packet-tunnel-provider",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "Packet tunnel provider"
}
-->

# Packet tunnel provider

Implement a VPN client for a packet-oriented, custom VPN protocol.

## Discussion

A virtual private network (VPN) is a form of network tunnel where a VPN client uses the public Internet to create a connection to a VPN server and then passes private network traffic over that connection. If you want to build a VPN client that implements a packet-oriented, custom VPN protocol, create a packet tunnel provider app extension.

When the system starts a VPN configuration that uses your packet tunnel provider, it performs the following steps:

- Launches your app extension.
- Instantiates your packet tunnel provider subclass within that app extension.
- Starts forwarding packets to your provider.

Your provider should open a tunnel to a VPN server and send those packets over that tunnel. Similarly, if your provider receives packets from the tunnel, it should pass them back to the system.

Packet tunnel providers can run in destination IP mode or source-application mode. The latter is one form of per-app VPN (the other form is an [App proxy provider](/documentation/NetworkExtension/app-proxy-provider)).

For detailed information about packet tunnel provider deployment options, see <doc://com.apple.documentation/documentation/Technotes/tn3134-network-extension-provider-deployment>.

> Note:
> When a VPN configuration is active, connections use the VPN instead of iCloud Private Relay. Network Extension providers also don’t use iCloud Private Relay.

## Topics

### Essentials

  <doc://com.apple.documentation/documentation/BundleResources/Entitlements/com.apple.developer.networking.networkextension>

### Packet tunnel provider

[`NEPacketTunnelProvider`](/documentation/NetworkExtension/NEPacketTunnelProvider)

The principal class for a packet tunnel provider app extension.

[`NETunnelProvider`](/documentation/NetworkExtension/NETunnelProvider)

An abstract base class shared by NEPacketTunnelProvider and NEAppProxyProvider.

[`NEProvider`](/documentation/NetworkExtension/NEProvider)

An abstract base class for all NetworkExtension providers.

[`NEPacketTunnelNetworkSettings`](/documentation/NetworkExtension/NEPacketTunnelNetworkSettings)

The configuration for a packet tunnel provider’s virtual interface.

[`NETunnelNetworkSettings`](/documentation/NetworkExtension/NETunnelNetworkSettings)

The configuration for a tunnel provider’s virtual interface.

[`NEEthernetTunnelProvider`](/documentation/NetworkExtension/NEEthernetTunnelProvider)

A type that implements the client side of a custom link-layer packet tunneling protocol.

[`NEEthernetTunnelNetworkSettings`](/documentation/NetworkExtension/NEEthernetTunnelNetworkSettings)

The network settings for an ethernet-based VPN tunnel.

### Packet handling

[`NEPacketTunnelFlow`](/documentation/NetworkExtension/NEPacketTunnelFlow)

An object you use to read and write packets to and from the tunnel’s virtual interface.

[`NEPacket`](/documentation/NetworkExtension/NEPacket)

A network packet and its associated properties.

[In-Provider Networking](/documentation/NetworkExtension/in-provider-networking)

Network APIs for use by all types of NetworkExtension providers and by hotspot helpers.

### VPN configuration

[`NETunnelProviderManager`](/documentation/NetworkExtension/NETunnelProviderManager)

An object to create and manage the tunnel provider’s VPN configuration.

[`NEVPNManager`](/documentation/NetworkExtension/NEVPNManager)

An object to create and manage a Personal VPN configuration.

[`NETunnelProviderProtocol`](/documentation/NetworkExtension/NETunnelProviderProtocol)

Configuration parameters for a VPN tunnel.

[`NEAppRule`](/documentation/NetworkExtension/NEAppRule)

The identity of an app whose traffic is to be routed through the tunnel.

[VPN On Demand Rules](/documentation/NetworkExtension/vpn-on-demand-rules)

Set up VPN On Demand.

### VPN control

[`NETunnelProviderSession`](/documentation/NetworkExtension/NETunnelProviderSession)

An object to start and stop a tunnel connection and get its status.

[`NEVPNConnection`](/documentation/NetworkExtension/NEVPNConnection)

An object to start and stop a Personal VPN connection and get its status.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)