Relution Signet Customer Hub

App to VPN Mapping

When setting up a cross-device VPN, all device data is routed through the private network. Sometimes, a company may want to set up a VPN only for their enterprise applications. Apple allows VPN connections to be set up for iPhones, iPads and MacBooks on an app-by-app basis. Here, administrators can control exactly what data flows through the VPN. The policy configuration of an app-to-VPN mapping helps organizations keep app-level traffic apart, allowing for the separation of personal and corporate data.

Prerequisite

An app-to-VPN mapping can be set up directly through Relution. On iOS and iPadOS, this only works for apps that are installed and managed by the MDM on the devices. On macOS, Relution includes the mapping with the signing identifier and designated requirement of the app directly in the VPN profile (see the section “macOS specifics” in App to VPN Mapping →). In addition, administrators can also configure VPN connections to automatically establish VPN connections for specific domains when a corresponding app requests a network connection.

In iOS policies, the configuration is also available for devices with user enrollment.

Relution supports the following connection types for establishing a per-app VPN connection on iOS and macOS devices:

  • IPSec
  • JuniperSSL
  • SonicWALL
  • AnyConnect Legacy
  • AnyConnect
  • IKEv2
  • Custom SSL

Configuring app to VPN mapping for iOS and macOS devices

  1. Per-app VPN requires two configurations in the same policy:

    • VPN
    • App to VPN Mapping

  2. Within the VPN configuration, the option Per App and Account VPN has to be enabled and, depending on the VPN type, all required fields have to be filled in. The option is only available for the connection types listed above. For other types, it is disabled and the VPN configuration shows a note listing the supported types; for the IKEv2 Always On type, the option is not offered.

  3. Within the App to VPN Mapping configuration, apps are assigned to a VPN configuration of the same policy. The configuration can be added once per policy, and each app can only be assigned to one VPN configuration. Via Add, the VPN configuration (Configuration) is selected first, followed by the Source of the app: Relution App Store app, Apple App Store App, iOS System or built-in app, App Compliance or Manually add app. The app itself is selected in the last step.

  4. Once Per App and Account VPN is enabled, the VPN configuration shows the Per account VPN section. There, Automatically connect to the VPN, if an associated app requests a network connection defines that the connection is established automatically when needed. In addition, Associated domains, Excluded domains, Safari domains and SMB domains can be specified. Under Select configurations, account configurations of the same policy are selected whose traffic uses the VPN: Email, Exchange, Calendar (CalDAV), Contact (CardDAV), Google Account and Calendar subscription.

The list of mappings shows in the columns Enabled and Per App VPN enabled whether the assigned VPN configuration is active and whether Per App and Account VPN is switched on there. The mapping only takes effect if both apply.