How to Set Up a True Always-On iOS VPN for Enterprise Lockdown
















To set up a completely locked-down iOS device for absolute privacy or enterprise use, you must bypass the standard App Store configurations. You need to use Apple’s native enterprise framework to enable Supervised Mode and deploy a true Always-On VPN payload.
Step 1: Place the iOS Device into Supervised Mode
Supervision unlocks low-level kernel restrictions that are unavailable on standard consumer iPhones. Note: This process requires a factory reset.
    1. Download Apple Configurator (available for free on the Mac App Store) or use an Enterprise MDM (like Jamf, Microsoft Intune, or Kandji).
    2. Back up any critical data on the iOS device, then erase it completely (Settings > General > Transfer or Reset iPhone > Erase All Content and Settings).
    3. Connect the iPhone to your Mac via a USB cable.
    4. Open Apple Configurator, select the device, click Prepare, and choose Manual Configuration.
    5. Select Supervise devices and check the box to allow the device to pair with other computers (or restrict it to just your Mac for maximum security).
    6. Follow the prompts to complete the setup assistant configuration profile.

Step 2: Configure the Always-On VPN Profile
Once supervised, you must build and deploy a custom configuration profile containing the AlwaysOn VPN dictionary. Standard commercial apps cannot do this automatically.
    1. In Apple Configurator, go to File > New Profile.
    2. Select VPN from the left-hand column and click Configure.
    3. Change the Connection Type to Always-on.
    4. Select your protocol: IKEv2 is natively supported and highly secure.
    5. Enter your VPN provider’s server addresses, remote identifiers, and account credentials. Enterprise networks typically use Client Certificates (SCEP) here for cryptographic identity validation, rather than simple passwords.
    6. Under the Always-on settings, ensure Allow captive portal bypass is unchecked if you want to block public Wi-Fi login screens from leaking data before authentication.
    7. Save the profile (it will export as a .mobileconfig file).

Step 3: Deploy and Lock the Device
    1. Drag and drop the saved .mobileconfig profile onto your connected, supervised iPhone within Apple Configurator.
    2. The device will install the profile at the root level.

Once installed, the VPN connection becomes un-deletable and un-toggleable by the user. The iOS kernel will automatically block all inbound and outbound network interfaces the split-second the VPN tunnel drops, ensuring zero data leaks.
Security Comparison for Enterprise Lockdown

Security Attribute Standard Commercial App Supervised + Always-On VPN
Kill-Switch Enforcement App-level (Fails if app crashes/RAM clears) Kernel-level (Hard-blocks all IP packets)
User Bypass Prevention None (User can toggle it off in Settings) Absolute (UI toggle is disabled/greyed out)
Boot-Up Security Loads after user unlocks the phone Loads immediately at system boot
Captive Portal Leakage Exposes traffic to public Wi-Fi login screens Blocked completely (unless explicitly allowed)

A dedicated corporate VPN server (like Cisco, Palo Alto, or StrongSWAN) already provides the certificates/IKEv2 credentials.

Anuj holds professional certifications in Google Cloud, AWS as well as certifications in Docker and App Performance Tools such as New Relic. He specializes in Cloud Security, Data Encryption and Container Technologies.

Initial Consultation

Anuj Varma – who has written posts on Anuj Varma, Hands-On Technology Architect, Clean Air Activist.

 Twitter Linkedin