Introducing Vylos: A WireGuard Client Built for Managed Devices
Meet a WireGuard client designed for organizations that deploy VPN across managed Apple devices without asking users to configure tunnels themselves.
Vylos is a WireGuard VPN client for iOS, macOS, and visionOS built specifically for that scenario. IT administrators push tunnel configurations via MDM, restrict what users can change, and enforce device security policies — without requiring users to understand anything about networking.
Two Types of Tunnels
Vylos separates tunnels into two categories:
Managed Tunnels are delivered through standard Apple .mobileconfig profiles — either installed manually, distributed through a web portal, or pushed via MDM. They appear in a dedicated section at the top of the tunnel list.
Users can view their status and connection details but cannot edit, delete, or manually toggle them.
App Tunnels are created by the user through .conf or .vylos import, QR codes, or manual entry. These are standard WireGuard tunnels that users manage themselves.
Organizations can disable app tunnels when users should use only IT-approved configurations.
MDM Restriction Keys
Vylos supports three restriction keys through Managed App Configuration:
allowManualTunnels — When set to false, the "My Tunnels" section is hidden, the Add Tunnel button disappears, and all app tunnel VPN entries are suspended from Apple Settings. Tunnel data is preserved locally and automatically restored when the restriction is lifted.
Managed tunnels remain visible and functional.
allowSettings — When set to false, the Settings icon is hidden from the toolbar. If the screen is reached through another path, it displays a "Settings are managed by your organization" message.
All settings become inaccessible, including app protection and export functions.
blockJailbrokenDevices — When set to true, the app detects jailbroken iOS devices and replaces the entire UI with a full-screen block page. Vylos also disconnects every tunnel, disarms On-Demand, and rejects reconnect attempts while preserving tunnel data for recovery.
This key applies to iOS only and has no effect on macOS or visionOS.
These keys give IT administrators granular control over what Vylos can do on each device.
App Protection
Not everyone managing devices has an MDM solution. Parents supervising their children's devices, small business owners managing a handful of company phones, or anyone who needs to prevent unauthorized changes to VPN settings can use Vylos's built-in app lock.
Two protection methods are available:
- Local Authentication — Face ID, Touch ID, or device passcode
- Authenticator App (TOTP) — Time-based one-time password compatible with any standard authenticator app
When MDM configuration is present, app lock is automatically bypassed — device-level authentication is already handled by the MDM policy, so a second layer inside the app is unnecessary.
Import Options
Users (when allowed) can import tunnels through:
- File picker —
.conffiles,.ziparchives with multiple configs - QR code scanning — Standard WireGuard QR codes
- Manual entry — Full interface and peer configuration form
ZIP archives support batch import with per-file result reporting, so users know exactly which configs succeeded and which were skipped.
Getting Started
Vylos is available for iOS 15, macOS 12, and visionOS 1 or later. Device-wide tunnel profiles can be installed from standard .mobileconfig files without MDM.
For managed deployments, configure the restriction keys through your MDM solution's managed app configuration channel.
See the admin guide for MDM configuration details and the user guide for end-user documentation.