List of VPN and Proxy Apps to Block
VPN apps are the first thing students and staff install when a filter gets in their way. This page lists the VPN apps, free proxy apps, Tor browsers and DNS apps you will meet most, with the IDs your MDM needs.
What apps use a VPN? Six kinds to know
"VPN app" covers more than the big paid brands. Anything that tunnels or proxies traffic off the device can carry a student past your web filter, so a useful blocklist covers all six kinds below.
Branded VPN services
Paid subscription VPNs with free tiers or introductory offers. Polished apps, many servers, easy country switching.
Most searched by nameFree "unlimited proxy" apps
Ad funded VPN apps with near identical names and icons. New ones appear constantly, which is why typed lists fall behind.
Fastest growing groupBrowsers with a VPN
Web browsers with a built-in VPN or proxy switch. The app looks like an ordinary browser in the device inventory.
Often missedTor and onion browsers
Browsers that route traffic over the Tor network. Several unofficial Tor browsers exist on the App Store under similar names.
Usually 17+DNS and tunnel tools
DNS changers, encrypted DNS apps and connection bonding tools. They change where lookups go, which can sidestep DNS filtering.
Looks like a utilityProtocol clients
Generic clients for proxy and VPN protocols. They need a server address, which students swap in chats and forums.
Power usersList of VPN apps for iPhone, iPad and Android
These are the branded VPN apps people search for by name. Bundle IDs and Android packages are the identifiers your MDM matches on; the display name can change, the ID does not.
The tables show well-known examples only. The full VPN / Proxy / Anonymizers category in our blocklists is much longer and is updated monthly. Where no Android package is shown, use the Android package name lookup.
| App | Developer | iOS bundle ID | Android package | Age |
|---|---|---|---|---|
| NordVPN | Nordvpn S.A. | com.nordvpn.NordVPN | com.nordvpn.android | 4+ |
| ExpressVPN | Express VPN | com.expressvpn.iosvpn | com.expressvpn.vpn | 4+ |
| Surfshark VPN | SURFSHARK LTD | com.surfshark.vpnclient.ios | com.surfshark.vpnclient.android | 4+ |
| Proton VPN | Proton AG | ch.protonmail.vpn | ch.protonvpn.android | 4+ |
| Private Internet Access | Private Internet Access, Inc. | com.privateinternetaccess.ios.PIA-VPN | com.privateinternetaccess.android | 4+ |
| TunnelBear | TunnelBear, LLC | com.tunnelbear.ios.TunnelBear | com.tunnelbear.android | 4+ |
| Windscribe | Windscribe Limited | com.windscribe | com.windscribe.vpn | 4+ |
| Hotspot Shield | AnchorFree Inc. | com.anchorfree.hss | hotspotshield.android.vpn | 4+ |
| Psiphon | Psiphon Inc | ca.psiphon.Psiphon | com.psiphon3 | 4+ |
| CyberGhost | CyberGhost SRL | com.cyberghostsrl.cyberghostvpn | check lookup | 4+ |
| IPVanish | IPVanish, Inc. | com.ipvanish.ios.IPVanish | check lookup | 4+ |
| VyprVPN | Golden Frog | com.goldenfrog.vyprvpn.mobile | check lookup | 4+ |
| PureVPN | PureVPN | com.purevpn.ios.PureVPN | check lookup | 4+ |
| hide.me VPN | eVenture | com.eventur.Hide.me | check lookup | 4+ |
| Hola VPN | Hola VPN Ltd | org.hola.hola2 | check lookup | 16+ |
| Betternet VPN | Betternet LLC | com.betternet | check lookup | 4+ |
| HMA Hotspot VPN | Privax | com.privax.hmaprovpn | check lookup | 13+ |
| VPN Unlimited | KeepSolid Inc. | com.simplexsolutionsinc.vpnguard | check lookup | 4+ |
| Urban VPN | Urban Cyber Security INC | com.ios.urban-vpn-cyber-security | check lookup | 18+ |
| Browsec VPN | Browsec Inc | com.browsec.vpnclient | check lookup | 4+ |
| Touch VPN | TouchVPN | com.northghost.touchvpnios | check lookup | 4+ |
Free VPN list: unlimited proxy apps
This is the group that keeps IT teams busy. The apps are free to download, show ads, and arrive in waves under names built from the same few words.
Because names repeat, never block by name. Two apps called "VPN Proxy Master" can come from different developers with different bundle IDs, and blocking one leaves the other working.
| App | Developer | iOS bundle ID | Android package | Age |
|---|---|---|---|---|
| VPN Super Unlimited Proxy | Mobile Jump Pte Ltd | mobi.mobilejump.freevpn | com.free.vpn.super.hotspot.open | 4+ |
| Turbo VPN | INNOVATIVE CONNECTING PTE.LIMITED | com.allconnected.turbovpn | free.vpn.unblock.proxy.turbovpn | 16+ |
| VPN 360 | Pango GmbH | co.infinitysoft.vpn360 | co.infinitysoft.vpn360 | 4+ |
| VPN cat | Secure Network | com.vpn.cat | com.vpn.cat | 16+ |
| PlatoVPN | MogoTech Inc. | com.platovpn.vpn | com.platovpn.vpn | 4+ |
| JumpJumpVPN | SOON BODYWERKZ AUTO PTE. LTD. | app.jumpjumpvpn.jumpjumpvpn | app.jumpjumpvpn.jumpjumpvpn | 4+ |
| VPN Vault | Appsverse Inc. | com.appsverse.avvpn | com.appsverse.avvpn | 4+ |
| iSharkVPN | freevpn Ltd. | com.ishark.freevpn | com.ishark.freevpn | 4+ |
| The Free VPN | The Free VPN | com.thefreevpn | com.thefreevpn | 4+ |
| X-VPN | LIGHTNINGLINK NETWORKS PTE. LTD. | com.xvpn | check lookup | 4+ |
| Free VPN by Free VPN .org | Free VPN LLC | org.freevpn.vpn | check lookup | 4+ |
| VPN Proxy Master | ALL Connected Co.,Ltd | co.allconnected.vpnmaster | check lookup | 4+ |
| VMP VPN | VPN VPN VPN Proxy Master Unlimited Inc | vpn.vpn.vpn | check lookup | 4+ |
| VPN Potato | FREE VPN POTATO PTE. LTD. | com.potatovpn | check lookup | 4+ |
| VPNIFY | Neonetworks solution ltd | com.free.vpn.hotspot.secure.vpnify | check lookup | 4+ |
| Planet Free VPN | FREE VPN PLANET S R L | com.atrix.rusvpn | check lookup | 4+ |
| SkyVPN | Telos Protocol | com.skyvpn.app | check lookup | 4+ |
| UFO VPN | Dreamfii HK Limited | ufovpn.unblock.proxy.vpn | check lookup | 9+ |
| Dash Free VPN | ActMobile Inc | com.actmobile.dashvpn | check lookup | 16+ |
| LetsVPN (快连VPN) | LGN Global Tech Inc. | world.letsgo.booster.ios.general | check lookup | 4+ |
Proxy browsers, Tor browsers and cloud browsers
A browser with a VPN switch is a VPN app wearing a different coat. Cloud browsers load pages on remote servers, so your filter only sees traffic to the browser's own service.
| App | Developer | iOS bundle ID | Android package | Age |
|---|---|---|---|---|
| Aloha Browser | Aloha Mobile | com.alohabrowser.alohabrowser | com.aloha.browser | 16+ |
| Opera Browser with VPN | Opera Norway AS | com.opera.OperaTouch | com.opera.browser | 16+ |
| Puffin Cloud Browser | CloudMosa, Inc. | com.cloudmosa.PuffinFree | com.cloudmosa.puffinFree | 18+ |
| Onion Browser | Mike Tigas | com.miketigas.OnionBrowser | iOS only | 16+ |
| Tor Browser | The Tor Project | not on the App Store | org.torproject.torbrowser | n/a |
| Onion Browser: Private VPN | Falling Rain Software, Limited | com.pentaloop.torbrowser | com.pentaloop.torbrowser | 16+ |
| TOR Browser: OrNET Onion | Stronger Apps | ch.b-eng.tor | check lookup | 16+ |
| TOR Browser: VPN+Onion | Brick Dust Technologies LLC | com.roundcherryapps.vpnTor | check lookup | 16+ |
| Darkweb Browser for TOR sites | Pinata Technologies | com.techlogix.private.browser | check lookup | 16+ |
| UPX Private Browser | Prox Solut LLC | net.upxb.proxy | check lookup | 16+ |
Many schools allow only one managed browser and block the rest. Our guide to blocking other browsers on school devices covers that approach, which also closes the proxy browser gap.
DNS, tunnel and protocol apps
These apps rarely say "VPN" on the icon, yet each one can move traffic or lookups away from your network controls. Decide on each one; some have legitimate business uses.
| App | Developer | iOS bundle ID | Android package | Age |
|---|---|---|---|---|
| 1.1.1.1 with WARP | Cloudflare | com.cloudflare.1dot1dot1dot1 | com.cloudflare.onedotonedotonedotone | 16+ |
| DNS & IP Changer | Ali Burak Goncu | com.burakgon.dnschanger | com.burakgon.dnschanger | 4+ |
| V2Box (V2ray client) | techlaim | hossin.asaadi.V2Box | check lookup | 4+ |
| Happ Proxy Utility | Flyfrog LLC | su.ffg.happ | check lookup | 4+ |
| Speedify | Connectify, Inc. | com.connectify.Speedify | check lookup | 4+ |
| OpenVPN Connect | OpenVPN Inc. | net.openvpn.connect.app | check lookup | 4+ |
OpenVPN Connect is also a common client for company remote access, so our data places it under Remote Access Tools. Block it on student devices, and keep it on staff devices if your own VPN depends on it.
VPN apps security risk list
For schools the main problem is filter bypass. For businesses it is data leaving through a service nobody approved. Either way, these are the risks to write into your policy.
Filter and CIPA bypass
All traffic leaves the device encrypted to the VPN server, so on-network filtering only sees one connection. That undermines the controls schools rely on for CIPA compliance.
Unknown operators see the traffic
Whoever runs the VPN server can see where the device connects. With free apps you often cannot tell who that operator is.
Ads and tracking inside the app
Free VPN apps still pay for servers. Check the App Store privacy label and the Google Play Data safety section to see what each one says it collects.
Configuration profiles from the web
Some services hand out VPN profiles to install manually, with no app at all. Only a restriction on profile installation stops that route on iPhone and iPad.
Location spoofing
A VPN makes the device appear to be in another region. That breaks geofenced licences and helps reach apps or services not offered locally.
Gaps in your audit trail
When traffic goes through a third party tunnel, your firewall and security logs lose detail. Incidents become harder to investigate.
Clones replace blocked apps in minutes
Blocking one app by hand moves users to the next clone. Only a category list that keeps growing stays ahead of that.
Personal hotspot plus VPN
On a phone with mobile data, the VPN works off your network entirely. Device level blocking is the only control that travels with the device.
If you are mapping every route students use, our page on how students get around restrictions lists the others an admin needs to close.
Two layers: block the apps and lock the VPN setting
An app blocklist stops the installs you know about. A VPN restriction stops whatever slips through. Use both on every managed device you can.
iPhone and iPad (supervised)
- Block the VPN category by bundle ID with the Restrictions payload key blockedAppBundleIDs, or your MDM's restricted apps list.
- Set allowVPNCreation to false. On iOS 18 and later only managed apps can then create VPN configurations.
- Set allowUIConfigurationProfileInstallation to false so users cannot install VPN profiles from a website.
- Set allowCloudPrivateRelay to false if iCloud Private Relay should be off.
- Apple marks blockedAppBundleIDs as deprecated in iOS 27 in favour of a declarative app settings configuration. Check which method your MDM uses today.
Android Enterprise
- On fully managed devices, allow only approved apps from Managed Google Play. VPN apps never reach the device.
- Where users can browse the store, block the VPN category by package name.
- Turn off installs from unknown sources so APK files cannot add a VPN.
- Use the device restriction that stops users configuring VPNs. Names differ by console, so check the current admin console.
- If you run your own VPN, set it as always-on with lockdown so other tunnels cannot take over.
Our blocklists ship as bundle ID lists, Android package lists, CSV files and Apple configuration profiles with a restrictions payload. See how .mobileconfig app blocking works before you deploy a profile.
How to block VPN apps in Intune, Jamf, Mosyle, Iru and Meraki
Every MDM has a place for a list of restricted apps. The steps differ, the list is the same. Pick your platform for the full walkthrough.
Microsoft Intune
iOS device restriction profiles accept a restricted apps list, and Android Enterprise uses managed app approval. Import our list instead of typing it.
Block apps in IntuneJamf Pro and Jamf School
Restrictions in a configuration profile take a list of bundle IDs on supervised devices. One profile per category keeps changes simple.
Block apps in JamfMosyle
Popular in schools for iPad fleets. App blocking uses bundle IDs, so a VPN category file drops straight into the restriction.
Block apps in MosyleIru (formerly Kandji)
Kandji was renamed Iru in late 2025. App restrictions still work from bundle IDs; menu names may have changed with the rebrand.
Block apps in Iru (Kandji)Meraki Systems Manager
Systems Manager blocks apps on the device itself. VPN rules on your Meraki firewall are a separate network job and do not replace the app block.
Block apps in MerakiGoogle Admin console
For Chromebooks and Android, the Admin console controls which apps users may install. Block VPN apps there and in Managed Google Play.
Block apps in Google AdminProxy apps on Windows, in Azure and in Microsoft 365
People searching for a "list of proxy apps" often mean something different from a phone VPN. Here is how the terms differ, so you change the right setting.
This usually means Microsoft Entra application proxy, which publishes your own internal web apps to remote users. It is not a consumer VPN and it is not something to block.
Desktop VPN and proxy clients on Windows laptops are blocked with application control policies, not with a phone app list. This page covers iOS, iPadOS and Android.
Some business apps run their own tunnel for remote access. List those on your allowed side first, then block the VPN category around them.
Not sure whether to allow a short list or block a long one? Our comparison of app allowlists and blocklists walks through when each works better.
Why a typed VPN list goes stale
A list you build by hand is accurate on the day you finish it. This is what happens next, and where a category list changes the outcome.
A developer releases another "unlimited proxy" app with a fresh bundle ID and a familiar icon.
Students share the name in group chats. A few devices install it before anyone in IT hears about it.
The restriction you typed last term does not contain the new ID, so the app opens and connects.
The app is categorized from its store listing, reviewed and added to the VPN / Proxy / Anonymizers list in the next monthly file.
Import or sync the updated list and the clone stops launching on every device in scope, with nobody typing IDs.
Which VPN apps to keep allowed
Blocking the whole category is right for students. Staff and business devices usually need a short exception list first.
Keep allowed
- The VPN client your organization uses for remote access
- Tunnels your MDM or security tools install and manage
- Remote support tools your help desk relies on
- Apps a teacher or department has had approved in writing
Block by default
- Consumer VPN services and their free tiers
- Free proxy and "unlimited" VPN apps
- Tor, onion and cloud browsers
- DNS changers on student devices
Before you add an exception, confirm the exact ID with the iOS bundle ID lookup. If you also need a ready answer for parents, our page on blocking VPN apps explains the reasons in plain terms.
VPN app list: frequently asked questions
What apps use a VPN on a phone or tablet?
Branded VPN services, free unlimited proxy apps, browsers with a built-in VPN or Tor routing, cloud browsers, DNS changers, protocol clients and some security suites all create a VPN or proxy connection on the device.
Is blocking VPN apps enough to stop students using a VPN?
No. Block the apps by bundle ID or package name and also lock the VPN settings: on supervised iPhones and iPads turn off VPN creation and manual profile installation, and on Android Enterprise devices allow only approved apps and stop users configuring VPNs.
Is the 1.1.1.1 app a VPN?
Yes, in practice. The 1.1.1.1 app changes DNS and its WARP mode routes traffic through an encrypted tunnel, so it sits in the VPN and proxy category of our blocklists.
Where is the list of VPN apps for Android?
The tables on this page show Android package names where we have a verified match. The blocklist files contain a separate Android list of package names for the whole VPN and proxy category, ready for Android Enterprise and Managed Google Play.
Which VPN apps should stay allowed?
Keep the VPN client your organization uses for remote access, and any tunnel your MDM or security tools need. Put those bundle IDs and packages on an exception list before you deploy the category block.
How often does the VPN app list change?
New VPN and proxy apps appear all the time, many of them clones with near identical names. Our category lists are updated monthly, adding new apps and dropping removed ones.
Get the full VPN and proxy blocklist
Every app in the category as iOS bundle IDs, Android packages, CSV and a ready .mobileconfig, refreshed monthly for your MDM.
NordVPN, ExpressVPN, Surfshark, Proton VPN, Tor, Cloudflare, OpenVPN and the other app names shown are trademarks of their respective owners. Microsoft Intune and Microsoft Entra are trademarks of Microsoft Corporation. Jamf is a trademark of Jamf Software, LLC.
Mosyle, Iru, Kandji, Cisco Meraki, Google, Android and Apple are trademarks of their respective owners. Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.