Okay, thanks for clarifying. So if see that I can initialize a set of firewall filter rules using source/destination IPs + ports and Protocol like TCP or UDP directly in the filter data provider on MacOS. However, it looks like to dynamically update the rules after my firewall is running, I have to use func handleRulesChanged() but it's not supported on MacOS. Why is that? Does this mean that I won't be able to dynamically add/delete rules after I start my content filter application on MacOS?

I have the same question as @zygoat. Is there an MDM or non-MDM solution to programmatically remove the system extension? It looks like I need to delete the application and rebuild if I add new NEFilterRules to a content filter in my Network Extension.