Relution Signet Customer Hub

Always-On VPN

This policy defines which VPN app stays permanently active on the device.

The Always-On VPN policy determines which already installed VPN app should stay permanently active on an Android Enterprise device. Unlike the StrongSwan configurations →, which equip a specific VPN app with its own profile, this policy only selects which app acts as the always-on VPN – the app itself must be installed separately via Manage apps →, since it is not deployed automatically by this policy.

Settings

  • Select Always-On VPN app (required, Select button) – the app that should remain permanently active as the VPN connection.
  • Deny networking when VPN is not connected (lockdown mode) – permits network traffic exclusively through the VPN connection. As long as the VPN is not connected, no network access is available. Even while the VPN is connected, any traffic outside the tunnel remains blocked unless the respective app is exempted as a lockdown exemption →.

Split Tunneling

The Always-On VPN policy only determines which VPN app stays permanently active. Which traffic is routed through the tunnel is determined by the configuration of the VPN app or the VPN gateway. If it does not restrict the tunnel to specific apps or destination networks, Android routes all traffic through the VPN.

Split tunneling is therefore also possible in combination with Always-On VPN, provided the VPN app supports it:

  • App configuration of the VPN app – If the vendor offers a managed configuration, it is available in Manage apps → via the Configuration action. Whether and how apps or networks can be defined for the tunnel there depends on the respective VPN client.
  • StrongSwan – In the StrongSwan VPN Profile →, the Applications section offers the choice between Only these Apps will use the VPN and These Apps will not use the VPN (default). If the list remains empty with These Apps will not use the VPN, all apps use the VPN. In the Split tunneling section, traffic can additionally be split by destination network: Only route traffic to specific subnets via VPN, everything else is routed as if there was no VPN or Traffic to these subnets will not be routed via VPN. Optionally, Block IPv4 traffic not destined for the VPN and Block IPv6 traffic not destined for the VPN block the remaining traffic of the respective protocol version.
  • VPN gateway – Alternatively, the gateway pushes only the internal networks as routes to the device instead of tunneling all traffic.

Lockdown Mode and Exemptions

With lockdown mode enabled, Android blocks any traffic that does not pass through the VPN. Apps excluded from the tunnel via split tunneling have no network connection in this case. The same applies to traffic to destination networks for which the VPN does not provide a route. Split tunneling based solely on destination networks is therefore not usable with lockdown mode enabled. This also applies to splitting by subnets in the Split tunneling section of the StrongSwan VPN Profile.

Individual apps can be exempted from lockdown. To do so, the VPN always on lockdown exemption option is set in Manage apps → via the Advanced action:

  • Unspecified / Enforce – the app is subject to lockdown mode.
  • Exemption – the app may communicate even without an active VPN connection. This setting is supported as of Android 10.

The option is not available for APK apps from the Relution App Store. For these apps, Advanced only contains the option User app uninstallation mode.

An exempted app continues to use the VPN as long as the VPN app includes it in the tunnel. For an app to communicate outside the tunnel while lockdown mode is enabled, it must therefore be marked as Exemption and also be excluded from the tunnel in the VPN app.

Support

  • Managed devices (Device Owner)
  • COPE work profile (Personal Profile Enabled)
  • Work profile (Profile Owner/BYOD)