Configure OpenVPN for iOS devices

OpenVPN is an open-source SSL VPN built on the market-proven OpenVPN protocol. It integrates advanced network security, remote access, and content filtering into a virtualized secure network. Hexnode UEM enables IT administrators to remotely deploy OpenVPN configurations to iOS devices, ensuring sensitive corporate data remains secure from interception.

1. Prerequisites

• Client Application: The OpenVPN Connect app must be installed on the iOS devices before deploying the VPN policy.
• Portal Access: Log in to the Hexnode UEM portal with administrative privileges.

2. Configuration Steps

To set up OpenVPN for iOS devices:

1. Navigate to the Policies tab.
2. Go to Policies > New Policy > Create a fully custom policy > iOS > Enterprise > Network > VPN and click Configure.
3. Set Connection Type to Open VPN.
4. Provide a Connection Name to be displayed on the device.
5. Server: Enter the IP address or Fully Qualified Domain Name (FQDN) of the VPN server.
6. Accounts: Enter the username. Wildcards like %name% or %email% can be used to automate data collection.

3. Authentication & Advanced Settings

Authentication Methods

• Password (Default): Enter the specific password to connect to the VPN server.
• Certificate: Select a credential certificate previously added under iOS > Security > Certificates.

VPN On Demand

If Certificate authentication is selected, the VPN On Demand option becomes available. This automates connectivity for specific domains.

• Action:
  • Connect: Automatically initiates a VPN connection when a network connection is attempted.
  • Disconnect: Disables the current VPN and future on-demand connections.
  • Ignore: Leaves current VPN status unchanged and stops new on-demand attempts.
• Network Type: Ethernet, Wi-Fi, Cellular, or None.

Proxy Settings

Optional configurations to mask the device’s IP address:

• Manual: Requires Server, Port, Authentication, and Password details.
• Automatic: Requires a proxy server URL.
• None (Default): Skips proxy setup.

4. Policy Implementation

1. Navigate to Policy Targets.
2. Click +Add Devices and select target devices, users, or groups.
3. Click Save to apply the policy.

5. FAQs

1. Is the OpenVPN Connect app required for the policy to work?

   Yes. The policy provides the configuration details, but the OpenVPN Connect client is necessary to establish the tunnel.

2. How can the VPN configuration be viewed on the device?

   On the iOS device, navigate to Settings > General > VPN to view the saved profile.

3. Can on-demand rules be restricted to specific Wi-Fi networks?

   Yes. By selecting Wi-Fi as the Network Type in VPN On Demand, specific SSIDs can be defined to trigger the connection action.

4. What happens if a device loses network connectivity?

   The VPN connection will typically be turned off automatically unless VPN On Demand rules are configured to re-establish the connection.

6. Troubleshooting

• VPN Profile Not Appearing: Verify that the policy is successfully associated with the device. Check the Action History in the portal for any command failures.
• Authentication Failures: Ensure that the OpenVPN Connect app is installed. If using certificates, confirm that the certificate is valid and correctly pushed to the device’s keychain.
• Connection Timeout: Check if the Server FQDN or IP address is reachable from the device’s current network. Verify that the necessary firewall ports are open for the OpenVPN protocol.