What's new 
Can Hexnode manage devices that use a private bidirectional APN with a static IP and a dedicated VPN tunnel while the devices are locked in Kiosk Mode? The use case is secure, isolated connectivity for managed smartphones, 4G/5G devices, and IoT-style deployments. I need the APN and VPN settings to stay enforced so users cannot change them from the device, and ideally all traffic should go through the VPN tunnel. Does this work with Single-App, Multi-App, or Web Kiosk? Also, is there a specific Hexnode plan requirement for this setup?
21 Views
Replies (1)
Marked SolutionPending Review
Hexnode Expert
1 hour ago
Oct 22, 2026
Marked SolutionPending Review
Yes, this setup is supported. Hexnode can remotely deploy and enforce private APN and VPN configurations on managed devices that are placed in Kiosk Mode, including Single-App, Multi-App, and Web Kiosk deployments.
A few important points:
- Private APN settings can be pushed to supported Android Enterprise and iOS devices through policy.
- Once the APN policy is associated, users cannot freely modify the managed APN settings. On supported Android Enterprise devices, the APN settings are added to the device and the relevant fields are greyed out.
- VPN configurations can also be deployed through Hexnode policies.
- If Always-On VPN is configured, device traffic can be continuously routed through the secure VPN tunnel.
- Kiosk Mode prevents users from accessing apps, settings, or device functions that are not allowed by the admin, which helps keep the network configuration locked down.
One clarification: Hexnode manages and enforces the APN and VPN profiles. The private APN, static IP assignment, and dedicated VPN infrastructure itself must be provided by the carrier, network provider, or VPN service used by the organization.
Regards,
Mary Romero
Save