Relution Signet Customer Hub

App to VPN Mapping

When setting up a cross-device VPN, all device data is routed through the private network. Sometimes, a company may want to set up a VPN only for their enterprise applications. Apple allows VPN connections to be set up for iPhones, iPads and Macs on an app-by-app basis. Here, administrators can control exactly what data flows through the VPN. The policy configuration of an app-to-VPN mapping helps organizations keep app-level traffic apart, allowing for the separation of personal and corporate data.

Prerequisite

An app-to-VPN mapping can be set up directly through Relution. This only works for apps that are installed and managed by the MDM on the devices.

Relution supports the following connection types for establishing a per-app VPN connection on iOS and macOS devices:

  • IPSec
  • JuniperSSL
  • SonicWALL
  • AnyConnect Legacy
  • AnyConnect
  • IKEv2
  • Custom SSL

For other VPN types, the VPN configuration points to the supported types; for the IKEv2 Always On type, the option is not available.

Configuring app-to-VPN mapping for iOS and macOS devices

  1. Per-app VPN requires two configurations in the same policy:

    • VPN
    • App to VPN Mapping

  2. Within the VPN configuration, the option Per App and Account VPN has to be activated and depending on the VPN type, all necessary fields have to be filled in.

  3. Within the App to VPN Mapping configuration, apps are assigned to a VPN configuration of the same policy. The configuration can be added once per policy. Via Add, the VPN configuration (Configuration) is selected first, followed by the Source of the app: Relution App Store app, Apple App Store App, iOS System or built-in app, App Compliance or Manually add app.

  4. Once Per App and Account VPN is activated, the VPN configuration shows the Per account VPN section. There, Automatically connect to the VPN, if an associated app requests a network connection defines that the connection is established automatically when needed. In addition, Associated domains, Excluded domains, Safari domains and SMB domains can be specified. Under Select configurations, account configurations of the same policy can be assigned to the VPN; on macOS, these are email, CalDAV and CardDAV configurations.

The list of mappings shows in the columns Enabled and Per App VPN enabled whether the assigned VPN configuration is active and whether Per App and Account VPN is switched on there. The mapping only takes effect if both apply.

macOS specifics

In macOS policies, each assigned app additionally has the required fields Signing identifier and Designated requirement. When an app is added, Relution initially fills both fields with the bundle ID of the app; the values can be adjusted via Edit. The signing identifier is shown by codesign -dv /Applications/Safari.app in the Identifier line, the designated requirement by codesign -d --requirements - /Applications/Safari.app.