VPN vs proxy for managed iOS and macOS devices in restricted networksSolved

Hello @ame-lie ,

For managed Apple devices, VPN and proxy behave quite differently.

VPN works at the system network level. It creates an encrypted tunnel for network traffic from the device. This makes it more suitable for environments where traffic inspection or network restrictions may affect connectivity.

For your use case, where a specific app is having trouble reaching internal servers, Per-App VPN on iOS is usually the better option. It allows only the selected managed app’s traffic to go through the VPN tunnel instead of routing all device traffic through it.

On macOS, you can deploy a system-level VPN configuration through Hexnode UEM so the device can connect using the configured VPN protocol.

Proxy, on the other hand, generally works at the application or web traffic level. It forwards traffic through a proxy server, but it does not encrypt the entire device traffic the way a VPN tunnel does. In stricter network environments, proxy traffic may be easier to inspect or block.

Hexnode UEM can deploy VPN configurations to supported iOS and macOS devices using the OS-native VPN capabilities.

Regards,
Simon Scott
Hexnode UEM

So if we push a VPN configuration from Hexnode, does the device need a third-party VPN client installed first? Or can iOS/macOS connect by itself?

iOS and macOS include native VPN clients, so a separate third-party app is not required for supported native VPN protocols.

Through Hexnode, you can push VPN profiles that use protocols such as IKEv2, L2TP, Cisco IPSec, etc.

The device can then connect using the built-in VPN client, as long as the VPN server and authentication settings are configured correctly in the policy.

However, if your organization uses a vendor-specific VPN protocol that depends on a dedicated app or extension, then that VPN app may still be required. For native protocols, no additional app like a commercial VPN client is needed.