Skip to main content

Network Extension

Santa includes an optional network system extension that can monitor and control network traffic. It provides two capabilities: a content filter for monitoring network flows and a DNS proxy for intercepting DNS queries.

info

The network extension requires a Workshop subscription and will not activate without one.

Installation​

Enabling the feature​

Workshop customers must enable the network extension on a tag. Navigate to the tag's sync settings and enable the Network Extension setting. The network extension will only be installed on hosts that are members of a tag with this setting enabled.

Automatic installation​

The network extension is lazily installed by default. Activating a network extension tears down all existing network connections, which can disrupt users. To minimize impact, Santa will automatically install or upgrade the network extension when:

  • The system reboots
  • The system wakes from sleep (e.g. when the laptop lid opens)

The network extension profiles must be installed for automatic installation to succeed silently. If the profiles are not installed and a user is logged in, macOS will display its standard prompt asking the user to approve the extension.

Manual installation​

If you need to install the network extension immediately, you can trigger it manually:

sudo santactl install --network-extension
caution

This will tear down existing network connections and can interrupt active network operations. Use with care.

Verification​

You can check the status of the network extension using santactl status. The output includes a Network Extension section:

santactl status
>>> Network Extension
  Enabled                   | Yes
  Loaded                    | Yes
  • Enabled means the appropriate Workshop settings have been configured to allow the network extension to run on the system.
  • Loaded means the network extension has been installed and activated via the network extension provider configuration.

You can also run santactl version to view version information:

santactl version
santad               | 2026.3 (build 187, commit 47a21b0d)
santactl             | 2026.3 (build 187, commit 47a21b0d)
SantaGUI             | 2026.3 (build 187, commit 47a21b0d)
santanetd (BETA)     | 2026.3 (build 187, commit 2149a1ce)

If a newer version of the network extension is available, it will be noted in the output and installed on the next reboot or sleep/wake cycle.

Removal​

  1. In Workshop, turn off the Network Extension setting on every tag that has it. The extension then stops filtering and allows all traffic, but the extension and its content filter and DNS proxy configurations stay installed. While the setting is on, Santa tries to install the extension again on boot and wake, and users can see approval prompts.

  2. If your system extension profile lists com.northpolesec.santa.netd in NonRemovableSystemExtensions, remove it from that list. macOS rejects the deactivation in the next step until you do.

  3. To remove the content filter and DNS proxy configurations and deactivate the extension on a host, run:

    sudo /Applications/Santa.app/Contents/MacOS/Santa --unload-network-extension

  4. In your system extension profile, remove com.northpolesec.santa.netd from the allowed system extensions, and from NonRemovableFromUISystemExtensions if you listed it there. Keep com.northpolesec.santa.daemon, which Santa needs to run.

The Web Content Filter and DNS Proxy payloads only pre-approve the extension. You can remove them after step 1.