title: Network extension framework versus kernel extension
body: <p>I am looking to implement firewall/network filtering functionalities for macOS.</p>
  
  <p>I am looking at the most secure way to do this, i.e. trying to make sure no network traffic is missed, and that my filtering cannot easily be by-passed.</p>
  
  <p>After searching around, I can see that Apple has deprecated Network Kernel Extension. They recommend now to use the <a href="https://developer.apple.com/documentation/networkextension" rel="nofollow noreferrer">Network Extension</a> framework.</p>
  
  <p>However, I can see that firewalls for mac, for example <a href="https://objective-see.com/products/lulu.html" rel="nofollow noreferrer">Lulu</a> and <a href="https://www.obdev.at/products/littlesnitch/index.html" rel="nofollow noreferrer">Little Snitch</a> have moved to using Kernel Extension, and not the Network Extension framework.</p>
  
  <p>Is there a good reason to do so? Do Kernel Extension allow a deeper, more secure filtering? </p>