Overview
The Android VPN App Policy sets an app as the always-on VPN on managed Android devices. The VPN starts automatically, and users can't turn it off or switch to another VPN.
Most organizations use it with the Swif Mobile Security app. The Swif app includes a built-in VPN that blocks access to domains on your blocklist. You can also set any other VPN app already installed on the device.
Important: Swif's VPN filters domains. It doesn't encrypt traffic or connect to your network. The Swif app's VPN only checks which domains the device looks up and blocks domains on your blocklist. It doesn't route traffic to your company network or encrypt browsing. To give devices access to internal resources, set your company's VPN app instead.
Supported platforms and requirements
Item | Details |
Platform | Android 9 or later |
Device ownership | Company-owned devices |
VPN app | Must already be installed on the device. The Swif Mobile Security app is deployed automatically when a device enrolls in Swif. |
Android allows only one always-on VPN at a time. If you set a third-party VPN app, the Swif app's domain blocking doesn't run on that device.
Settings reference
Always-On VPN Package
Setting | What it does | Default | Required |
Package Name | The package name of the VPN app to make always-on. The app must be installed on the device. | — | Yes |
Lockdown Enabled | When on, the device blocks all network traffic whenever the VPN isn't connected. | Off | No |
To use Swif's domain blocking, enter the Swif Mobile Security app's package name: com.swif.mobile.
About lockdown
Lockdown off: if the VPN stops or can't start, the device keeps using the network without it. For the Swif app, that means domains aren't blocked until the VPN reconnects.
Lockdown on: if the VPN isn't connected, the device has no network access at all. This keeps blocking in place, but a VPN problem cuts the device off until the VPN reconnects.
Turn on lockdown only after you've tested the VPN app on your devices.
How the Swif app's VPN blocks domains
When the Swif app is the always-on VPN, domain lookups on the device go through it:
The user opens a site or an app connects to a server.
The device looks up the domain, such as
example.com, through the Swif VPN.The Swif app asks the Swif service whether that domain is on the device's blocklist.
If it's blocked, the app replies that the domain doesn't exist, so the site or service doesn't load.
If it's not blocked, the lookup goes to the device's normal DNS, and the site loads as usual.
What to know about domain blocking
It blocks whole domains, not specific pages. Blocking
example.comblocks the whole site. You can't block one page, such asexample.com/videos, while allowing the rest.If the Swif app can't reach the Swif service, sites are allowed. For example, if the service is temporarily unavailable, lookups go to normal DNS, and nothing is blocked until the app can reach Swif again.
Blocked sites look like they don't exist. Users see a browser error, such as "site can't be reached", instead of a Swif block page.
The blocklist is managed in Swif. [Add where admins manage the domain blocklist, with a link.]
Before you start
Decide which VPN app to use: the Swif app for domain blocking, or your company's VPN app for network access.
Make sure the VPN app is installed on the devices. For a third-party VPN, deploy it first. See Deploying Android Apps with Swif.
Find the app's package name. For third-party apps, it's in the app's Google Play URL, after
id=. For example,https://play.google.com/store/apps/details?id=com.example.vpnhas the package namecom.example.vpn.Decide on lockdown. Test the VPN on a few devices with lockdown off first.
Create the policy
In Swif, go to Device Management > Policies, then select Create new policy > Configure a Policy.
Select Android VPN App Policy.
Enter a clear name, such as
Android – Swif Domain Blocking.Under Always-On VPN Package, enter the Package Name.
Set Lockdown Enabled.
Save the policy.
Assign it to a device group of Android devices.
Test on a few devices before a wider rollout.
Example configurations
Example 1: Block domains with the Swif app
Setting | Value |
Package Name |
|
Lockdown Enabled | Off |
The Swif app becomes the always-on VPN and blocks the domains on your blocklist. If the VPN stops, devices stay online.
Example 2: Strict domain blocking
Setting | Value |
Package Name |
|
Lockdown Enabled | On |
Devices can't use the network unless the Swif VPN is connected, so blocking can't be avoided by stopping the VPN. Use this only after testing.
Example 3: Company VPN for remote access
Setting | Value |
Package Name |
|
Lockdown Enabled | On |
All traffic goes through your company VPN, and devices have no network access when it's disconnected. The Swif app's domain blocking doesn't run, because Android allows only one always-on VPN.
Verify the policy
On the device, open Settings > Network & internet > VPN (the path varies by manufacturer). The VPN app should be listed as always-on.
Confirm that the VPN icon (a key) appears in the status bar.
For the Swif app, open a domain on your blocklist in a browser. It shouldn't load.
Open a domain that isn't on the blocklist. It should load normally.
If Lockdown Enabled is on, confirm that the user can't turn off the VPN.
In Swif, open the device and confirm that the policy shows as applied.
Troubleshooting
The VPN doesn't start
Check that the app with that Package Name is installed on the device.
Check that the package name is exact.
Check that the device runs Android 9 or later.
A blocked domain still loads
Check that the domain is on the device's blocklist.
Check that the Swif app is the always-on VPN, not a third-party VPN.
Check that the device can reach the Swif service. If it can't, sites are allowed.
Try again after a few minutes. The device or browser may have saved the earlier lookup.
Only part of a site is blocked, or a specific page isn't blocked
Blocking works on whole domains. A site that loads content from other domains may still partly load, and individual pages can't be blocked separately.
The device has no internet
Lockdown Enabled is on, and the VPN isn't connected. Check that the VPN app is running, or turn off lockdown.
Users can't use their own VPN app
This is expected. Android allows only one always-on VPN, and the policy sets which app it is.
Related resources
Swif