# Configure OpenVPN for iOS devices

OpenVPN is an open-source SSL VPN built on the market-proven OpenVPN protocol. It integrates advanced network security, remote access, and content filtering into a virtualized secure network. Hexnode UEM enables IT administrators to remotely deploy OpenVPN configurations to iOS devices, ensuring sensitive corporate data remains secure from interception.

1. Prerequisites
----------------

- **Client Application:** The **OpenVPN Connect** app must be installed on the iOS devices before deploying the VPN policy.
- **Portal Access:** Log in to the Hexnode UEM portal with administrative privileges.

2. Configuration Steps
----------------------

To set up OpenVPN for iOS devices:

1. Navigate to the **Policies** tab.
2. Go to **Policies > New Policy > Create a fully custom policy > iOS > Enterprise > Network > VPN** and click **Configure**.
3. Set **Connection Type** to **Open VPN**.
4. Provide a **Connection Name** to be displayed on the device.
5. **Server:** Enter the IP address or Fully Qualified Domain Name (FQDN) of the VPN server.
6. **Accounts:** Enter the username. Wildcards like %name% or %email% can be used to automate data collection.

3. Authentication & Advanced Settings
-----------------------------------------

### Authentication Methods

- **Password (Default):** Enter the specific password to connect to the VPN server.
- **Certificate:** Select a credential certificate previously added under **iOS > Security > Certificates**.

[![OpenVPN Settings for iOS devices in Hexnode portal](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2022/05/iOS-VPN-hexnode.jpeg)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2022/05/iOS-VPN-hexnode.jpeg)### VPN On Demand

If **Certificate** authentication is selected, the **VPN On Demand** option becomes available. This automates connectivity for specific domains.

- **Action:**
    - *Connect:* Automatically initiates a VPN connection when a network connection is attempted.
    - *Disconnect:* Disables the current VPN and future on-demand connections.
    - *Ignore:* Leaves current VPN status unchanged and stops new on-demand attempts.
- **Network Type:** Ethernet, Wi-Fi, Cellular, or None.

[![VPN On Demand using OpenVPN for iOS devices](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2022/05/VPN-On-demand-ios.png "VPN On Demand using OpenVPN for iOS devices with mdm")](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2022/05/VPN-On-demand-ios.png)### Proxy Settings

Optional configurations to mask the device’s IP address:

- **Manual:** Requires Server, Port, Authentication, and Password details.
- **Automatic:** Requires a proxy server URL.
- **None (Default):** Skips proxy setup.

4. Policy Implementation
------------------------

1. Navigate to **Policy Targets**.
2. Click **+Add Devices** and select target devices, users, or groups.
3. Click **Save** to apply the policy.

5. FAQs
-------

1. **Is the OpenVPN Connect app required for the policy to work?**Yes. The policy provides the configuration details, but the OpenVPN Connect client is necessary to establish the tunnel.
2. **How can the VPN configuration be viewed on the device?**On the iOS device, navigate to **Settings > General > VPN** to view the saved profile.
3. **Can on-demand rules be restricted to specific Wi-Fi networks?**Yes. By selecting **Wi-Fi** as the Network Type in VPN On Demand, specific SSIDs can be defined to trigger the connection action.
4. **What happens if a device loses network connectivity?**The VPN connection will typically be turned off automatically unless VPN On Demand rules are configured to re-establish the connection.

6. Troubleshooting
------------------

- **VPN Profile Not Appearing:** Verify that the policy is successfully associated with the device. Check the **Action History** in the portal for any command failures.
- **Authentication Failures:** Ensure that the **OpenVPN Connect** app is installed. If using certificates, confirm that the certificate is valid and correctly pushed to the device’s keychain.
- **Connection Timeout:** Check if the **Server** FQDN or IP address is reachable from the device’s current network. Verify that the necessary firewall ports are open for the OpenVPN protocol.