Our network extension needs to make some decisions about blocking or proceeding with the connection based on the final IP address.

We see the same behaviour with the Sophos Mac Endpoint product which uses the NETransparentProxyProvider subclass for its network extension and the CISC AnyConnect client which uses the NEFilterDataProvider. When both are enabled and active, Safari will fail to connect to web.whatsapp.com and other sites that use websockets. Google Chrome does not have a similar problem with the same configuration.

Is there any tool or API that we can use to determine what order the NETransparentProxyProvider system extensions will be called with handleNewFlow?

This has been raised as Feedback #FB11627900