# iOS 26 will have network level traffic filtering for all apps **URL:** https://discuss.privacyguides.net/t/ios-26-will-have-network-level-traffic-filtering-for-all-apps/29903 **Category:** General **Tags:** video **Created:** 2025-08-09T13:16:29Z **Posts:** 26 ## Post 1 by @anonfox — 2025-08-09T13:16:29Z > **[Filter and tunnel network traffic with NetworkExtension - WWDC25 - Videos -...](https://developer.apple.com/videos/play/wwdc2025/234/)** > > Learn about the APIs in the NetworkExtension framework that give your app the power and flexibility to extend the system's core... > Starting in iOS 26, you can create a new type of filter, a URL Filter, which makes content filtering decisions based on the full URL. > > URLs can reveal sensitive information like unique identifiers, or browsing history. Network Extension is designed to allow you to build a content filter that makes accurate filtering decisions based on the full URL. But the URL contents are not revealed to the app, and all database queries to the backend servers are anonymized to protect privacy. The entire chain of backend servers, both Apple’s and your servers, will have no access to any of the content and identity information. URL Filtering is performed with your URL data set, containing URLs you want to block. You provide an on-device prefilter and an off-device database server for URL lookups. Sounds like a better way to filter traffic than using a custom DNS, because it doesn’t give access to your traffic and it supports filtering entire URLs, not just the domains. --- ## Post 2 by @fria — 2025-08-09T14:28:51Z Very excited to see what app devs do with this --- ## Post 3 by @anon57862721 — 2025-08-09T14:32:13Z IVPN better be listening, this is the gateway to bring Portmaster to iOS. --- ## Post 4 by @obscuracarl — 2025-08-17T20:17:32Z See my comment here: > [@Obscura VPN](https://discuss.privacyguides.net/t/obscura-vpn/26408/44): > > Unfortunately the only thing you can do right now is to allow or deny URLs, not selectively route them through a VPN vs. not. See Apple docs [here](https://developer.apple.com/documentation/networkextension/neurlfilter/verdict). I hope they expand on the functionality! --- ## Post 5 by @iluvprivacy — 2025-08-17T21:09:28Z I agree! I’m surprised this wasn’t even discussed more widely. Does Android have an equivalent? Has any iOS developer made any announcements related to this? --- ## Post 6 by @obscuracarl — 2025-08-18T16:53:06Z So as I mentioned, the only thing you can do with `NEURLFilterManager` right now is to allow or deny URLs, not selectively route them through a VPN vs. not. See Apple docs [here](https://developer.apple.com/documentation/networkextension/neurlfilter/verdict). There is an existing APIs that allow per-URL split-tunneling: [`NETransparentProxyManager`](https://developer.apple.com/documentation/networkextension/netransparentproxymanager), but that is macOS only and very rarely used so I’m sure there are a lot of bugs. Another limitation on the technical side is that any per-URL split-tunneling requires that the application uses Apple’s Networking APIs to make connections, so that the system knows which URL is being requested. Any app that use the old BSD sockets interface or does its own DNS resolution (which is what I think most browsers aside from Safari does) will appear to `NETransparentProxyManager` without the URL information, so it can’t make the correct decision. My current thinking is that per-URL split-tunneling is best done at the browser level. Per-App split-tunneling is more feasible, but on iOS, it currently requires that the user’s device be a “managed device” (Apple docs [link](https://developer.apple.com/documentation/technotes/tn3134-network-extension-provider-deployment#Deploying-a-packet-tunnel-provider)). We may look into this some more, but we don’t feel comfortable placing our users’ devices under our management. We really hope that Apple loosens the restrictions on per-app split-tunneling for iOS so that users can self-configure without being a “managed device”, since it seems to be fully implemented already, just with this arbitrary restriction. --- ## Post 7 by @Encounter5729 — 2025-08-18T17:39:10Z That seems very nice. On Android DuckDuckGo anti-tracker needs VPN permission which basically make it useless. I do wonder though, will they allow blocking apple domains? --- ## Post 8 by @jonah — 2025-08-18T17:48:35Z > [@obscuracarl](#): > > Per-App split-tunneling is more feasible, but on iOS, it currently requires that the user’s device be a “managed device” (Apple docs [link](https://developer.apple.com/documentation/technotes/tn3134-network-extension-provider-deployment#Deploying-a-packet-tunnel-provider)). We may look into this some more, but we don’t feel comfortable placing our users’ devices under our management. My understanding is that it also only works with apps which were installed (and managed) by the MDM, so it’s a no-go for regular App Store apps anyways. --- ## Post 9 by @anonfox — 2025-08-19T00:17:27Z AdGuard VPN does have selective URL split tunneling on iOS. It’s not open source though, so no idea how it works --- ## Post 10 by @obscuracarl — 2025-08-19T00:43:44Z Oh interesting… I wonder if they use some kind of SNI sniffing… --- ## Post 11 by @jonah — 2025-08-19T01:16:05Z Maybe they just resolve the IP address of the domains you enter and exclude those routes. --- ## Post 12 by @obscuracarl — 2025-08-19T20:10:14Z Right but it may be flaky if the App is doing its own custom domain resolution logic/server or use DoH. Possibly good enough for most apps though, so it’s interesting! --- ## Post 13 by @Bill_Cipher — 2025-12-28T21:42:09Z Hope Adguard and NextDNS are listening ! --- ## Post 14 by @anon57862721 — 2025-12-28T21:44:49Z Funny you ask. This is new from Techlore on the matter: > **[System-Wide DNS Filtering on iOS is Finally Here (AdGuard Interview)](https://www.youtube.com/watch?v=E4tJSHimd9c)** > > Apple recently released a new API that changes everything about ad blocking on iOS. In this video, Henry talks to AdGuard team members to understand how this... And welcome to the forum! --- ## Post 15 by @iluvprivacy — 2026-01-03T08:43:36Z Is there a reason why iOS doesn’t allow split tunneling to be easily implemented? --- ## Post 16 by @kissu — 2026-01-03T09:05:22Z Don’t want to be mean but the usual answer with Apple is > because they decided so they don’t always care about what people want/standards/making things like everybody else. --- ## Post 17 by @iluvprivacy — 2026-01-03T09:27:30Z I’m confused. This thread is from 2025, but Adguard apparently offers this for the last few years. The problem is that Adguard uses a VPN slot, so I can’t do system-level DNS filtering if I want to use ProtonVPN. --- ## Post 18 by @obscuracarl — 2026-01-08T22:02:20Z > [@iluvprivacy](#): > > Is there a reason why iOS doesn’t allow split tunneling to be easily implemented? If I were to guess, it’s because Apple’s a bit over-protective and doesn’t want VPNs breaking apps selectively, but who knows their internal logic :sweat_smile: > [@iluvprivacy](#): > > The problem is that Adguard uses a VPN slot, so I can’t do system-level DNS filtering if I want to use ProtonVPN. Yeah this is quite annoying with iOS, on macOS you can layer VPN. For example, I use Tailscale with Obscura on macOS. However, if you install a DNS _profile_ on iOS or macOS (e.g. NextDNS), you _can_ use it with a VPN as long as the VPN support it (in Obscura it’s the “Use installed custom DNS profile” option) --- ## Post 19 by @redoomed1 — 2026-01-09T16:20:22Z 6 posts were merged into an existing topic: [Obscura VPN](/t/obscura-vpn/26408/116) --- ## Post 26 by @iluvprivacy — 2026-02-04T11:09:43Z Any more news or updates on this topic?