iOS 26 will have network level traffic filtering for all apps

General
1

Starting in iOS 26, you can create a new type of filter, a URL Filter, which makes content filtering decisions based on the full URL.

URLs can reveal sensitive information like unique identifiers, or browsing history. Network Extension is designed to allow you to build a content filter that makes accurate filtering decisions based on the full URL. But the URL contents are not revealed to the app, and all database queries to the backend servers are anonymized to protect privacy. The entire chain of backend servers, both Apple’s and your servers, will have no access to any of the content and identity information. URL Filtering is performed with your URL data set, containing URLs you want to block. You provide an on-device prefilter and an off-device database server for URL lookups.

Sounds like a better way to filter traffic than using a custom DNS, because it doesn’t give access to your traffic and it supports filtering entire URLs, not just the domains.

8 Likes
Lockdown app is no longer trustworthy?
Obscura VPN
2

Very excited to see what app devs do with this

5 Likes
3

IVPN better be listening, this is the gateway to bring Portmaster to iOS.

6 Likes
4

See my comment here:

3 Likes
5

I agree! I’m surprised this wasn’t even discussed more widely. Does Android have an equivalent? Has any iOS developer made any announcements related to this?

1 Like
6

So as I mentioned, the only thing you can do with NEURLFilterManager right now is to allow or deny URLs, not selectively route them through a VPN vs. not. See Apple docs here.

There is an existing APIs that allow per-URL split-tunneling: NETransparentProxyManager, but that is macOS only and very rarely used so I’m sure there are a lot of bugs.

Another limitation on the technical side is that any per-URL split-tunneling requires that the application uses Apple’s Networking APIs to make connections, so that the system knows which URL is being requested. Any app that use the old BSD sockets interface or does its own DNS resolution (which is what I think most browsers aside from Safari does) will appear to NETransparentProxyManager without the URL information, so it can’t make the correct decision.

My current thinking is that per-URL split-tunneling is best done at the browser level.

Per-App split-tunneling is more feasible, but on iOS, it currently requires that the user’s device be a “managed device” (Apple docs link). We may look into this some more, but we don’t feel comfortable placing our users’ devices under our management.

We really hope that Apple loosens the restrictions on per-app split-tunneling for iOS so that users can self-configure without being a “managed device”, since it seems to be fully implemented already, just with this arbitrary restriction.

5 Likes
7

That seems very nice. On Android DuckDuckGo anti-tracker needs VPN permission which basically make it useless.

I do wonder though, will they allow blocking apple domains?

1 Like
8

My understanding is that it also only works with apps which were installed (and managed) by the MDM, so it’s a no-go for regular App Store apps anyways.

1 Like
9

AdGuard VPN does have selective URL split tunneling on iOS. It’s not open source though, so no idea how it works

2 Likes
10

Oh interesting… I wonder if they use some kind of SNI sniffing…

1 Like
11

Maybe they just resolve the IP address of the domains you enter and exclude those routes.

2 Likes
12

Right but it may be flaky if the App is doing its own custom domain resolution logic/server or use DoH.

Possibly good enough for most apps though, so it’s interesting!

1 Like
13

Hope Adguard and NextDNS are listening !

14

Funny you ask. This is new from Techlore on the matter:

And welcome to the forum!

3 Likes
15

Is there a reason why iOS doesn’t allow split tunneling to be easily implemented?

16

Don’t want to be mean but the usual answer with Apple is

because they decided so

they don’t always care about what people want/standards/making things like everybody else.

2 Likes
17

I’m confused. This thread is from 2025, but Adguard apparently offers this for the last few years. The problem is that Adguard uses a VPN slot, so I can’t do system-level DNS filtering if I want to use ProtonVPN.

18

If I were to guess, it’s because Apple’s a bit over-protective and doesn’t want VPNs breaking apps selectively, but who knows their internal logic :sweat_smile:

Yeah this is quite annoying with iOS, on macOS you can layer VPN. For example, I use Tailscale with Obscura on macOS.

However, if you install a DNS profile on iOS or macOS (e.g. NextDNS), you can use it with a VPN as long as the VPN support it (in Obscura it’s the “Use installed custom DNS profile” option)

1 Like
19

6 posts were merged into an existing topic: Obscura VPN