Per-App VPN Architecture: Routing managed app traffic through secure tunnels

Traditional perimeter-based security relies on device-wide Virtual Private Networks (VPNs). In this legacy “All-or-Nothing” model, once a user authenticates, their entire device—including personal applications, social media, and background OS traffic—is routed through the corporate gateway. This approach not only consumes massive amounts of internal bandwidth but also severely violates the principle of Least Privilege and introduces significant user privacy risks.

This playbook serves as the architectural source of truth for configuring, managing, and troubleshooting Per-App VPN routing logic within a Hexnode UEM environment. It defines the application state logic, proxy routing behaviors, OS-level enforcement mechanisms, and the privacy governance required to maintain a strict Zero-Trust posture.

1. The Architectural Concept

In a Zero-Trust Network Access (ZTNA) model, granting device-wide VPN access violates the principle of least privilege. Hexnode UEM implements a Per-App VPN (Zero-Trust App Proxy) to create ephemeral, app-specific micro-tunnels.

Crucially, Hexnode acts as the Orchestrator. It deploys cryptographic payloads and routing rules to the endpoint OS, which then delegates network interception to a verified VPN client (e.g., Cisco AnyConnect, Palo Alto GlobalProtect, OpenVPN).

Traditional VPNs tunnel the whole device’s web traffic through a single network. Hexnode’s Per-App VPN policy associates specific Managed Apps with a designated VPN profile.

• Managed Apps: Applications distributed and installed via the Hexnode UEM Portal (e.g., VPP apps on iOS/iPadOS, or Enterprise Apps). On Android Enterprise deployments, this specifically targets apps deployed to the Work Profile. Traffic from these explicitly targeted apps is intercepted and tunneled securely.
• Unmanaged Apps: Apps downloaded manually by the user from public stores. Unmanaged apps cannot access the Per-App VPN profile deployed via the MDM payload, isolating personal data from the corporate network.

2. Policy Configuration Matrix

Verified routing types and supported protocols configured under Policies > VPN in the Hexnode portal.

3. Advanced Logic: VPN On-Demand Rules

• On Apple platforms (iOS, iPadOS, macOS), On-Demand rules allow conditional VPN activation. The OS evaluates rules sequentially when a managed app initiates network traffic.
• EvaluateConnection: The OS evaluates connection parameters (e.g., DNS resolution) before deciding whether to initiate the VPN.
• ConnectIfNeeded: The VPN activates only if specified conditions (e.g., domain match or external network) are met.
• Disconnect: The traffic is forced to bypass the VPN entirely, even if the app is managed.
• Ignore: The OS drops/blocks the network request entirely.

4. Architectural Definitions

Standardized definitions aligning with the Hexnode UEM interface.

• Policy.Per_App_VPN: The specific configuration profile created in the Hexnode portal used to associate a VPN connection with specific App Groups or individual apps.
• Target.Device_Group: The grouping mechanism within Hexnode used to deploy the Per-App VPN policy to a specific set of enrolled devices.
• Trigger.VPN_On_Demand: An automated rule set configured in the MDM payload (e.g., Connect, Disconnect, EvaluateConnection) that triggers the VPN connection when an app attempts to reach a specific internal domain.

5. Failure Modes & Remediation

Optimized troubleshooting logic utilizing Hexnode administrative actions.

6. Governance: The Privacy Handshake

To maintain privacy in BYOD enrollments (such as Apple User Enrollment), Hexnode’s architecture operates on strict cryptographic separation. The Per-App VPN framework inherently limits VPN access to the Managed App List. The Hexnode administrator cannot route, intercept, or monitor traffic from apps existing outside the managed workspace, ensuring total separation of personal web traffic and corporate data transmission.