How to Block VPN Apps on iPhone, iPad and Android
A VPN app sends traffic past your web filter. To stop that on school and work devices you need three layers: lock the VPN settings, block the VPN apps by category, and filter what is left on the network.
Looking for a VPN that works at school? This page explains how schools block them. If a site you need for class is blocked, ask your school's IT team to review it.
Why there are thousands of VPN apps
Search either app store for "VPN" and the results never end. That is not an accident; it is how this market works, and it is why blocking VPN apps one at a time fails.
Cheap to build
Ready-made VPN code and white-label server networks let a small team ship a new VPN app in days, often from the same template as its last one.
Ad and subscription money
Free tiers funded by ads and paid upgrades make VPN apps profitable, so publishers keep adding more listings to capture more searches.
Many listings per publisher
One developer often runs several near-identical apps with slightly different names, each with its own bundle ID.
Constant churn
Apps are removed, renamed and relisted. A bundle ID you blocked last term may be gone, and two new ones may have arrived.
VPN inside other apps
Some browsers carry a built-in VPN or proxy, and some security suites bundle one. They do not look like VPN apps in a store search.
Regional apps
Apps built for users in one country or language rarely show up in English searches, but students find them through friends and videos.
Look-alike names: one search, many bundle IDs
A few real examples from our App Store data. Note the repeated names and the same developers behind several listings.
| App name as listed | Developer | iOS bundle ID |
|---|---|---|
| VPN - Super Unlimited Proxy | Mobile Jump Pte Ltd | mobi.mobilejump.freevpn |
| VPN - Fast VPN Proxy | Mobile Jump Pte Ltd | mobi.mobilejump.vpn |
| Free VPN by Free VPN .org™ | Free VPN LLC | org.freevpn.vpn |
| VPN US using Free VPN .org™ | VPN LLC US | org.freevpn.vpn.us |
| VPN Proxy Master - Super VPN | ALL Connected Co.,Ltd | co.allconnected.vpnmaster |
| VPN - Fast & Secure VPN Proxy | Minoti Inc | vpn.vpn.proxy |
| VMP VPN: Trusted Since 2019 | VPN VPN VPN Proxy Master Unlimited Inc | vpn.vpn.vpn |
Why a category list is the only practical way
You could keep your own spreadsheet of VPN bundle IDs. Here is what that costs compared with importing a maintained VPN / Proxy / Anonymizers category.
Manual list of VPN apps
- Someone searches both stores and copies IDs by hand
- New look-alikes get through until a student reports them
- Renamed apps are hard to spot in your list
- iOS and Android lists drift apart
- VPN browsers and bundled VPNs are easy to miss
- No record of why an app was added
VPN / Proxy / Anonymizers category
- One import covers the whole category
- New apps arrive in the monthly update
- Removed apps drop out, keeping lists tidy
- Matching files for iOS bundle IDs and Android packages
- Apps with a built-in VPN carry the category too
- CSV with name, developer and category for audits
Our app data covers 1.87 million iPhone and iPad apps, each categorized from its store listing, reviewed and validated, with Android packages for 670,000+ of them. Browse the current VPN and proxy apps list or see plans for the import files.
How to block VPN on supervised iPhone and iPad
Every step here needs supervised devices, which you get by enrolling through Apple School Manager or Apple Business Manager. Screen Time on its own cannot lock VPN settings.
- 1
Turn off VPN creation
Apple key allowVPNCreation set to false; in Intune it is Block VPN creation under General. From iOS 18, only apps your MDM manages can then add a VPN configuration.
On older versions the setting stopped people adding VPNs in Settings, but apps they installed could still add their own. That is one more reason to keep layer 2.
- 2
Block iCloud Private Relay
Apple key allowCloudPrivateRelay set to false, available from iOS 15. In Intune it is Block iCloud Private Relay under Cloud and Storage.
Private Relay is not a VPN app, but it hides Safari traffic from filters in a similar way.
- 3
Block VPN and proxy apps by bundle ID
Import the category list into your blocked apps setting: blockedAppBundleIDs in a Restrictions payload, Blocked App Bundle IDs in the Intune Settings catalog, or App Usage: Some apps not allowed in Jamf Pro.
From iOS 27 Apple points to the declarative App settings configuration and its Denied apps list; check how your MDM sends it.
- 4
Stop people installing profiles themselves
Apple key allowUIConfigurationProfileInstallation set to false. Some VPN and encrypted DNS services hand out a configuration profile from a website instead of an app.
- 5
Close other install paths
Where alternative app distribution is available, turn off allowMarketplaceAppInstallation and allowWebDistributionAppInstallation. On shared iPads you can remove the App Store entirely and push apps from the MDM.
- 6
Keep devices on your Wi-Fi
Intune's Require devices to use Wi-Fi networks set up via configuration profiles (iOS 14.5 and later) stops an iPad joining a phone's hotspot, where your network filter cannot see it.
Why both layer 1 and layer 2? Some apps in the VPN category are browsers or proxies that route traffic inside the app and never create a system VPN. The VPN creation lock does not touch them; the app blocklist does.
Using your own VPN or filter app? Configurations your MDM pushes and VPN apps it installs as managed apps keep working with VPN creation turned off. An always-on VPN on supervised devices goes further and sends all traffic through your tunnel.
Step by step console guides: Intune, Jamf and the wider school iPad restrictions checklist.
How to block VPN on Android Enterprise devices
Android gives you a cleaner option than iOS: a store that only shows approved apps. Combine it with the VPN settings below on fully managed and corporate-owned devices.
Approved apps only
In Intune, leave Allow access to all apps in Google Play store unset or blocked. In the Google Admin console, limit installs to the apps on your Web and mobile apps list. VPN apps never appear.
Open store with a blocklist
If you let users browse the whole store, approve the VPN apps in Managed Google Play and assign them with the Uninstall intent. Use the category file so you are not adding them one by one.
Stop users configuring VPNs
Android lets the MDM prevent users from setting up or changing VPNs. The label depends on the console, so search its device restrictions for VPN.
Always-on VPN with lockdown
If you run a VPN or filtering app, set it as the always-on VPN and enable Lockdown mode. Traffic then goes through your tunnel or not at all, and no other VPN can take over.
Block unknown sources
Many VPN apps also offer installer files on their websites. Keep Allow installation from unknown sources off so a downloaded file cannot be installed.
Personal work profiles
On personally owned devices you control the work profile only. A VPN on the personal side is outside your MDM, so rely on network rules and policy.
Details for each console: Google Admin and Android work profiles.
How to block VPN on Chromebooks and computers
Laptops add two paths that phones do not have: browser extensions and desktop VPN clients. Both are easy to close once you know where to look.
Chromebooks
- Block VPN Android apps: use allowlist mode for Google Play apps in Apps & extensions.
- Block all extensions by default and allow only the ones you need. VPN and proxy extensions are common.
- Filter VPN provider sites so extension and app downloads fail.
Windows
- Remove local admin rights. Most VPN clients need admin rights to install their network driver.
- Use App Control for Business or AppLocker rules for VPN clients that install per user.
- Control browser extensions through Edge and Chrome policies.
Macs
- Use standard user accounts for students and most staff.
- Use your MDM's app restriction feature for VPN clients and VPN browsers.
- Review which network and system extensions your MDM allows; check your console for current options.
How schools block VPNs on the network
Network rules cover every device on your Wi-Fi, managed or not. Each layer catches part of the traffic; the bars show roughly how much of the job each one does on its own.
Block the VPN / Proxy / Anonymizers category in your DNS or web filter. It stops VPN provider sites, installer downloads, sign-in pages and web proxy sites.
Next generation firewalls recognize VPN and proxy traffic by signature. On a FortiGate, for example, block the Proxy category and individual VPN signatures in the application control profile for student and guest policies.
Block the default ports of common VPN protocols on student networks: OpenVPN on UDP 1194, WireGuard commonly on UDP 51820, IPsec on UDP 500 and 4500. Leave staff VPN needs in mind.
On managed devices that trust your certificate, inspection lets the firewall identify more disguised VPN traffic. Personal devices will not trust it, so use it on school and work devices only.
Consumer routers rarely have application control. Point the router at a DNS filter with the VPN category blocked and add the port rules above.
Can schools block VPNs completely? On school-managed devices, close to it: layers 1 and 2 stop the apps before any traffic leaves. On personal phones using mobile data, the school controls nothing but its own Wi-Fi.
Why students still get through, and what closes each path
These are the routes admins see most often, described at the level you need to shut them. More on each in how students get around restrictions.
| Route | Why it works | What closes it |
|---|---|---|
| VPN app from the store | Blocklist missing the newest look-alike | Category list with monthly updates, VPN creation turned off |
| Browser with a built-in VPN | Looks like a browser, routes traffic in-app | VPN category covers these; block other browsers |
| Web proxy site | New proxy domains appear constantly | Filter category for VPN and proxy sites |
| Phone hotspot | The iPad leaves your filtered Wi-Fi | Wi-Fi networks from configuration profiles only |
| VPN browser extension | Extensions install without admin rights | Extension allowlist on Chromebooks and managed browsers |
| Downloaded profile | A website hands out a VPN or DNS profile | Block user installation of configuration profiles |
| Personal device | Not enrolled, may use mobile data | Wi-Fi filtering, application control, written policy |
Common VPN apps and their identifiers
A short selection of well-known VPN apps so you can test your block. These are hand-checked; the full category is on the VPN and proxy apps list.
| App | iOS bundle ID | App Store ID | Android package |
|---|---|---|---|
| NordVPN | com.nordvpn.NordVPN | 905953485 | com.nordvpn.android |
| ExpressVPN | com.expressvpn.iosvpn | 886492891 | com.expressvpn.vpn |
| Proton VPN | ch.protonmail.vpn | 1437005085 | ch.protonvpn.android |
| Turbo VPN | com.allconnected.turbovpn | 1365309175 | free.vpn.unblock.proxy.turbovpn |
| Psiphon | ca.psiphon.Psiphon | 1276263909 | com.psiphon3 |
| 1.1.1.1 (WARP) | com.cloudflare.1dot1dot1dot1 | 1423538627 | com.cloudflare.onedotonedotonedotone |
| Aloha Browser | com.alohabrowser.alohabrowser | 1105317682 | com.aloha.browser |
| Onion Browser | com.miketigas.OnionBrowser | 519296448 | iOS only |
| Tor Browser | Android only | Android only | org.torproject.torbrowser |
Roll out the VPN block without breaking lessons
VPN rules touch more than VPN apps. A short pilot finds the legitimate tools that also use a VPN connection before every device gets the policy.
Pilot group first
Apply all three layers to a handful of staff and student devices. Ask the pilot group to report anything that stops working.
Tools that use a VPN legitimately
Content filter agents, security apps and some MDM features create a VPN connection. Deploy them as managed apps or pushed profiles so the VPN creation lock leaves them alone.
Separate staff policy
Staff who connect to the district or company VPN need their client on the allowed list. Scope the VPN app blocklist to student groups or exclude that one client.
Announce the change
Tell students and staff that VPN apps will disappear and why. Fewer help desk tickets, and fewer attempts to find the next app.
How to test your VPN block
Test on one supervised iPad, one managed Android device and one Chromebook, signed in as a student, not as an admin.
- Settings shows no option to add a VPN configuration on the iPad.
- iCloud Private Relay is greyed out or missing.
- A VPN app installed before the policy is hidden and will not open.
- Installing a VPN app from the App Store fails or the app disappears.
- A VPN browser from the table above is blocked as well.
- Opening a profile download page cannot install a profile.
- On Android, VPN apps are missing from the managed Play store.
- A downloaded VPN installer file is refused on Android.
- On the Chromebook, a VPN extension cannot be added.
- On guest Wi-Fi, a personal phone's VPN app fails to connect or is flagged in firewall logs.
VPN blocking FAQ
Can schools block VPNs?
On school-managed devices, yes, quite thoroughly: lock the VPN settings, block VPN apps by category and filter the network. On personal phones using mobile data, the school can only control its own Wi-Fi.
How do schools block VPNs?
They combine device rules from the MDM, a blocklist of VPN and proxy apps, and network rules: a filter category for VPN and proxy sites, firewall application control and, where possible, inspection of encrypted traffic on managed devices.
How do I block VPN on an iPhone?
Supervise the iPhone, turn off VPN creation, block iCloud Private Relay and block VPN apps by bundle ID through your MDM. Screen Time alone cannot lock VPN settings.
Is there a VPN blocker for Android?
Android Enterprise is the blocker: limit Managed Google Play to approved apps, stop users configuring VPNs, block unknown sources and, if you have one, force your own always-on VPN with lockdown.
How do I block VPN on a computer?
Remove local admin rights, use app control rules for VPN clients, block VPN browser extensions and filter VPN provider sites on the network. Most VPN clients need admin rights to install their network driver.
How do I block VPN traffic on a router?
Use a DNS filter with a VPN and proxy category, block the default ports of common VPN protocols and, on business firewalls, turn on application control for proxy and VPN signatures. Many VPN apps fall back to port 443, so ports alone are not enough.
Will turning off VPN creation break our own VPN?
No. VPN configurations you push from the MDM and VPN apps your MDM installs as managed apps keep working. The restriction targets VPNs added by users and by apps they installed themselves.
Why not just block the ten most popular VPN apps?
Students and staff pick whatever works. There are thousands of VPN and proxy apps, many with near-identical names, and new ones appear every month. A category list catches them; a top ten list does not.
Block every VPN and proxy app in one import
The VPN / Proxy / Anonymizers blocklist arrives as iOS bundle IDs, Android packages and ready profiles for your MDM, refreshed monthly. Pair it with the AI, social and gaming lists most schools use.
NordVPN, ExpressVPN, Proton VPN, Turbo VPN, Psiphon, 1.1.1.1, WARP, Aloha Browser, Onion Browser, Tor Browser and the other app names shown are trademarks of their respective owners. FortiGate is a trademark of Fortinet, Inc.
Microsoft Intune, Edge, AppLocker and App Control for Business are trademarks of Microsoft Corporation. Apple, iPhone, iPad, iCloud, App Store and Apple School Manager are trademarks of Apple Inc.
Google, Android, Chrome, Chromebook and Google Play are trademarks of Google LLC. Jamf is a trademark of Jamf.
Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.