I am planning an iOS security and content-blocking app for unmanaged consumer iPhones.
The app would not provide a traditional VPN service. It would not offer:
- Remote VPN servers
- Geographic location switching
- Access to a private corporate network
- IP-address masking as a service
- Anonymous browsing
Instead, the app would allow the user to:
- View destination domains contacted by the device
- Classify destinations such as trackers, advertising, analytics, or potentially malicious domains
- Manually block selected domains
- Keep connection history and filtering decisions on the device
I understand that NEFilterDataProvider and NEFilterControlProvider are the APIs intended for network content filtering. However, according to TN3134, these providers are not generally deployable for an unmanaged adult consumer iPhone.
I also understand that TN3120 says NEPacketTunnelProvider should not be used as a general-purpose local content filter.
This appears to leave a gap for an unmanaged consumer security app whose core feature is user-controlled, system-wide domain blocking.
I am considering whether NETunnelProviderManager with an NEPacketTunnelProvider could support the feature, but I do not want to use the packet-tunnel API outside its supported purpose.
My questions are:
- Is there currently a supported Network Extension architecture for system-wide, user-controlled domain blocking on an unmanaged adult consumer iPhone?
- Can an app with this purpose use
NEPacketTunnelProvider,or would that necessarily be considered the unsupported general-purpose filtering use described in TN3120? - If such an architecture is supported, could an app with this purpose be treated as an approved security or content-blocking provider under Guideline 5.4 rather than as an app offering a traditional VPN service?
- App Review Guideline 5.4 states that apps offering VPN services must be submitted by developers enrolled as organizations. It also states that parental-control, content-blocking, and security apps from approved providers may use NEVPNManager.
For an app that does not provide a remote VPN service but uses Apple’s VPN configuration infrastructure only for local security and user-controlled blocking, must the developer still enroll as an organization, or may an individual Apple Developer Program member submit it?
There are two parts to your question:
- What’s supported?
- What’s allowed on the App Store?
I work for DTS and thus can only answer the first part. I have two suggestions for your App Store policy questions:
- You can ask them on App Store Distribution & Marketing > App Review.
- But you’re probably better off asking App Review directly. See their contact information on this page, and specifically the 30-minute video appointment thing.
In contrast, support questions are DTS’s métier, so I’m happy to talk about that…
From the DTS perspective, TN3120 is all about intent. If you plan to use a packet tunnel provider for something other than VPN then DTS won’t help you with that.
One of DTS’s key goals is to help developers create products that will work now and in the future. We don’t support ‘off label’ use of packet tunnel providers because, in our experience, such solutions are brittle. You might be able to get something working at your desk, but then in it fails in specific environments or, worse yet, starts failing with some future OS release.
These days I generally point folks towards URL filters, but I realise that this isn’t appropriate for everyone.
So, if URL filters don’t work for your use case, and the deployment constraints described in TN3134 preclude your use of some other provider type, then there’s just no supported path for you.
Which isn’t to say that you can’t build and ship this product. App Review has the final say about what is or isn’t allowed on the App Store. Rather, it’s that DTS won’t help you build it. Or fix it when things go wrong O-:
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"