iPhone

How to Enforce a VPN on an iPhone

Prevent bypass of VPNs that filter content on an iPhone by enforcing VPN profiles and preventing a user from overriding them.

Tech Lockdown Team

Updated October 24, 2024

Effective content filtering apps on iOS will often use the VPN feature on an iPhone to route the internet traffic through a DNS filter, allowing you to restrict access to certain websites. However, you'll need to ensure that this VPN is always turned on, especially since it's easy to accidentally disable. In this article, we'll look at several recommended ways to enforce a VPN for iPhones, so that content filtering is always enabled.

There are a two areas to consider when enforcing a VPN on an iPhone:

Protect the filtered VPN app from being uninstalled.
Prevent the filtered VPN connection from being toggled off using iOS settings.

This can be achieved in several ways, but there are a few unique approaches that most people don't know about:

Combining the Apple Shortcuts feature with an app blocker to enforce a VPN.
Using Supervised Mode to reliably prevent anyone (including the device's owner) from changing VPN settings. Supervised mode lets you install Config Files, which can be used to protect content filtering VPN settings on an iPhone.

Prevent Modifying VPN Profiles on Your iPhone Completely with Supervised Mode

Once you install a content filtering VPN, it will prompt you to add a VPN configuration, which can be viewed in the VPN & Device Management section of iOS settings. There are several reliable strategies for preventing a user from overriding this VPN connection.

Apple's Alternative to Screen Time , supervised mode, unlocks the ability to protect a specific VPN connection on an iPhone, completely preventing it from being overridden by conflicting VPN apps or manual changes in the VPN & Device Management section of iOS settings.

Get started by following our step-by-step guidance on enabling Supervised mode on iOS . You'll also get access to the Supervised Config Presets detailed in this section, which can easily be installed by scanning a QR code.

Prevent Adding Conflicting VPN Connections

The first Config Preset you can add to your Supervised iPhone prevents a user from adding new VPN configurations.

Normally, a user could go into the VPN & Device Management section of iOS settings and add a new VPN, which can be swapped to in place of the Content Filter VPN (completely bypassing it).

More commonly, a user might download a conflicting VPN app from the App Store, which will install and switch to a new VPN connection.

In either case, the content filtering VPN is completely bypassed. Luckily, there's an effective workaround:

The most reliable workaround for this is to install the Prevent VPN Creation config preset that we provide.

If you've followed our instructions for enabling supervised mode on iOS and installed our provided Prevent VPN Creation config preset, the option to manually add a new VPN connection in iOS settings will be removed:

Furthermore, if you've updated your iPhone's iOS to version 18 or above, this restriction also disables apps from adding VPN configurations.

If your iPhone doesn't support iOS 18+ versions, you can alternatively disable the App Store or block iPhone VPN apps to prevent conflicting VPN apps from being added to the iOS device.

Prevent Deleting a Content Filtering VPN Connection

Once you've prevented conflicting VPNs from being added and switched to, you also need to ensure that the content filtering VPN connection cannot be deleted in the VPN & Device Management section of iOS settings.

There's normally an option to delete a VPN connection, but you can use our Supervised Config Preset to protect a specific content filtering VPN connection so that it cannot be deleted or turned off.

Prevent Uninstalling a Content Filtering VPN App

Most Content Filtering VPN connections are installed via an App that you download from the App Store. If this app is uninstalled from the device, the VPN connection is deleted as well. As a result, it's critical that the underlying VPN app is not removed.

You can use our config preset to prevent deleting apps on a supervised iPhone.

All apps that you install will be protected and won't have an uninstall option.

Protect VPN Connections on iPhone

Use Device Supervision to prevent filtered VPN Configurations from being deleted.

Use Shortcut Automations on your iPhone to Re-enable a Content Filtering VPN

If your Content Filtering VPN is manually toggled off in iOS settings, either by a user switching it off or a conflicting VPN app overriding it, Apple Shortcuts/Automations can ensure that it's automatically re-enabled.

If you used the Supervised approach detailed previously, Apple Shortcuts aren't necessary, but can be configured for extra peace of mind.

Apple Shortcuts/automations can be used to re-enable a specific VPN automatically. It can also be used to block iPhone's settings app .

One strategy to enforce a VPN involves using shortcut Automations to auto-connect to your Content Filtering VPN based on certain triggers:

When the settings app is closed (handling cases where a user manually turns of the VPN via settings)
When a web browser is opened (always ensuring the proper VPN connection is being used when browsing)

Use Automations to Re-Enable a VPN when the Settings app is Closed

If you have connected your iPhone to a DNS Content Policy , chances are that this filter is made possible with the help of a VPN. Forcing this VPN profile to be enabled every time the Settings app is closed can prevent attempts to disable your Policy.

In order to do this, open the Shortcuts app.

Tap on the Automations tab and Create Personal Automation:

You will now be prompted to choose when this automation runs.

Select App so that you can trigger this automation with a specific app:

You can then choose the Settings app. Tap Choose:

Find or search for the Settings app:

Once you've selected Settings, tap Done near the top.

Next, select Is Closed (you might also want to unselect the Is Open option):

This triggers the automation when the settings app is closed.

Now we need to define the automation to run when the settings app is closed.

Tap Next near the top.

You might see a menu with a list of options that you can choose. If prompted, select New Blank Automation (don't worry if you don't see this option, some iPhones have slightly different menus).

You should see a screen that looks like this:

Now we can add an Action that Sets the VPN. Using the search bar, type in VPN.

Select a Device VPN (this will be based on VPNs that are available on your iPhone currently).

You might need to check on your iPhone's setting app to find the name of the correct VPN configuration (if you have multiple installed).

Tap on the grayed-out VPN option in the action you've added. You'll need to choose the content filtering VPN configuration.

Tap next when you've selected the filtered VPN.

On the Edit Automation screen, deselect Ask Before Running.

This ensures that this automation quickly runs after the trigger happens and doesn't require you to approve it each time.

Select Done then edit the automation from Is Opened to Is Closed

You're all set! This automation will ensure that the chosen VPN configuration is toggled on automatically if the settings app is closed.

There are more ways more ways to further customize how a content filtering VPN is enforced by adding more Automations.

Force a Content Filtering VPN to Be Enabled When a Browser is Opened

If you want to ensure that a VPN is enabled when opening a web browser, it's pretty easy to use an automation to do this as well. This helps you ensure that the correct Content Filtering VPN connection is being used, and not a conflicting VPN added by an app or manually in iOS settings.

In the previous example, you created an Automation that would trigger if the Settings app is closed. You can create a new Automation with a couple of differences:

When creating the Automation, have it trigger when an app is opened instead of closed.
Instead of choosing the Settings app as the trigger, choose your installed web browsers (you can add more than one entry to the list).
Similar to the previous section, you add a new action that enables your content filtering VPN.
Make sure that you have "Run Immediately" enabled, and the Automation shouldn't prompt you each time you open a web browser.

Create a DNS Content Policy

Enforce content filtering rules on all your devices.