<!--
{
  "documentType" : "article",
  "framework" : "Technotes",
  "identifier" : "/documentation/Technotes/tn3134-network-extension-provider-deployment",
  "metadataVersion" : "0.1.0",
  "role" : "article",
  "title" : "TN3134: Network Extension provider deployment"
}
-->

# TN3134: Network Extension provider deployment

Explore the platforms, packaging, OS versions, and device configurations for Network Extension provider deployment.

## Overview

Network Extension providers extend the networking stack in various ways.  You might implement a custom VPN protocol with a packet tunnel provider, or add a content filter provider as part of a parental control app.  Network Extension supports many different provider types and each type has different deployment requirements.  The tables below summarise these requirements for each provider type.

When reading these tables:

- The Mac Catalyst platform refers to a provider embedded in a Mac Catalyst app running on Mac.  For more information, see <doc://com.apple.documentation/documentation/UIKit/mac-catalyst>.
- The iOS Apps on Mac platform refers to a provider embedded in an iOS app running on an Apple silicon Mac.  For more information, see <doc://com.apple.documentation/documentation/Apple-Silicon/running-your-ios-apps-in-macos>.
- On macOS most Network Extension provider types can be packaged as either an app extension or a system extension.  App extensions run in a user context; if the user logs out, the provider is terminated.  System extensions run in a global context, completely independent of the logged in user.
- When a provider’s per-app configuration is restricted to managed devices, the targeted apps must be installed using MDM.
- If a macOS row doesn’t mention the “App Store only” restriction, the provider supports both App Store distribution and direct distribution using Developer ID signing.

For more information about using the Network Extension framework as a whole, see <doc://com.apple.documentation/documentation/NetworkExtension>.

## Deploying a packet tunnel provider

When building a packet tunnel provider, use the following table to plan your deployment:

|Platform       |Packaged as     |Minimum OS|Restrictions                        |
|---------------|----------------|----------|------------------------------------|
|iOS            |app extension   |9.0       |per-app mode requires managed device|
|visionOS       |app extension   |1.0       |per-app mode not supported          |
|               |app extension   |1.1       |per-app mode requires managed device|
|tvOS           |app extension   |17.0      |per-app mode not supported          |
|macOS          |app extension   |10.11     |App Store only                      |
|               |system extension|10.15     |                                    |
|Mac Catalyst   |app extension   |10.15     |App Store only                      |
|iOS Apps on Mac|app extension   |11.0      |App Store only                      |

For more information, see <doc://com.apple.documentation/documentation/NetworkExtension/packet-tunnel-provider>.

Before you decide to implement a packet tunnel provider, read [TN3120: Expected use cases for Network Extension packet tunnel providers](/documentation/Technotes/tn3120-expected-use-cases-for-network-extension-packet-tunnel-providers).

## Deploying an app proxy provider

When building an app proxy provider, use the following table to plan your deployment:

|Platform       |Packaged as     |Minimum OS|Restrictions        |
|---------------|----------------|----------|--------------------|
|iOS            |app extension   |9.0       |managed devices only|
|visionOS       |app extension   |1.1       |managed devices only|
|macOS          |app extension   |10.11     |App Store only      |
|               |system extension|10.15     |                    |
|Mac Catalyst   |app extension   |10.15     |App Store only      |
|iOS Apps on Mac|app extension   |11.0      |App Store only      |

For more information, see <doc://com.apple.documentation/documentation/NetworkExtension/app-proxy-provider>.

## Deploying a URL filter provider

When building a URL filter provider, use the following table to plan your deployment:

|Platform|Packaged as  |Minimum OS|
|--------|-------------|----------|
|iOS     |app extension|26.0      |
|macOS   |app extension|26.0      |

For more information, see <doc://com.apple.documentation/documentation/NetworkExtension/url-filters>.

## Deploying a content filter provider

When building a content filter provider, use the following table to plan your deployment:

|Platform|Packaged as     |Minimum OS|Restrictions               |
|--------|----------------|----------|---------------------------|
|iOS     |app extension   |9.0       |supervised devices only    |
|        |app extension   |15.0      |apps using Screen Time APIs|
|        |app extension   |16.0      |per-app on managed devices |
|visionOS|app extension   |1.1       |per-app on managed devices |
|        |app extension   |2.0       |supervised devices         |
|macOS   |system extension|10.15     |                           |

For more information, see <doc://com.apple.documentation/documentation/NetworkExtension/content-filter-providers>.

In the Screen Time case, content filters are only supported on child devices.  To enable a content filter:

1. Add the Family Controls capability to your app.  See <doc://com.apple.documentation/documentation/Xcode/adding-capabilities-to-your-app>.
2. Run it on a device where the user has signed in as an under 18 child member of an iCloud family.
3. Request child authorization. On iOS 16 and later, call <doc://com.apple.documentation/documentation/FamilyControls/AuthorizationCenter/requestAuthorization(for:)>, passing in the `.child` option. On iOS 15, call <doc://com.apple.documentation/documentation/FamilyControls/AuthorizationCenter/requestAuthorization(completionHandler:)>, which always requests child authorization.
4. Authorize that as the child’s parent or guardian.

Before submitting your app to the App Store, you must request permission to use the <doc://com.apple.documentation/documentation/BundleResources/Entitlements/com.apple.developer.family-controls> entitlement for distribution.

## Deploying a DNS proxy provider

When building a DNS proxy provider, use the following table to plan your deployment:

|Platform|Packaged as     |Minimum OS|Restrictions              |
|--------|----------------|----------|--------------------------|
|iOS     |app extension   |11.0      |supervised devices only   |
|        |app extension   |16.0      |per-app on managed devices|
|visionOS|app extension   |1.1       |per-app on managed devices|
|        |app extension   |2.0       |supervised devices        |
|macOS   |system extension|10.15     |                          |

For more information, see <doc://com.apple.documentation/documentation/NetworkExtension/dns-proxy-provider>.

## Deploying a transparent proxy provider

When building a transparent proxy provider, use the following table to plan your deployment:

|Platform|Packaged as     |Minimum OS|Restrictions  |
|--------|----------------|----------|--------------|
|macOS   |app extension   |10.15     |App Store only|
|        |system extension|10.15     |              |

For more information, see the discussion of transparent proxies within <doc://com.apple.documentation/documentation/NetworkExtension/app-proxy-provider>.

macOS 11.0 introduced significant improvements to the transparent proxy feature; for the details, see <doc://com.apple.documentation/documentation/NetworkExtension/NETransparentProxyProvider>.

## Deploying a packet filter provider

When building a packet filter provider, use the following table to plan your deployment:

|Platform|Packaged as     |Minimum OS|
|--------|----------------|----------|
|macOS   |system extension|10.15     |

For more information, see <doc://com.apple.documentation/documentation/NetworkExtension/content-filter-providers>.

## Deploying an Ethernet tunnel provider

When building an Ethernet tunnel provider, use the following table to plan your deployment:

|Platform|Packaged as     |Minimum OS|Restrictions  |
|--------|----------------|----------|--------------|
|macOS   |app extension   |13.0      |App Store only|
|        |system extension|13.0      |              |

For more information, see <doc://com.apple.documentation/documentation/NetworkExtension/NEEthernetTunnelProvider>.

## Deploying an app push provider

When building an app push provider, use the following table to plan your deployment:

|Platform|Packaged as  |Minimum OS|
|--------|-------------|----------|
|iOS     |app extension|14.0      |
|visionOS|app extension|1.0       |

For more information, see <doc://com.apple.documentation/documentation/NetworkExtension/local-push-connectivity>.

## Deploying a hotspot provider

When building a hotspot provider, use the following table to plan your deployment:

|Platform|Packaged as  |Minimum OS|
|--------|-------------|----------|
|iOS     |app extension|26.0      |
|visionOS|app extension|26.0      |

For more information about hotspot providers, see <doc://com.apple.documentation/documentation/NetworkExtension/hotspot-helper>.

Before starting development, request permission to use the `com.apple.developer.networking.HotspotHelper` entitlement.  See <doc://com.apple.documentation/documentation/NetworkExtension/hotspot-helper> for the details.

## Revision History

- **2025-08-19** Added sections for URL filter and hotspot providers.  Added visionOS entries to the appropriate tables.  Clarified the role of MDM in per-app configurations.  Made other minor editorial changes.
- **2023-11-28** Clarified the Family Controls behaviour for content filter providers on iOS.
- **2023-10-03** Updated for tvOS 17.
- **2022-09-06** First published.

---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)