Skip to main content

How can we help you?

Search

help Knowledge Base
forum Community
checklist Release Notes
event Events

iOS Roaming Client deployment guide

Minetta Gould
  • Updated

    In this article

Network administrators with admin permissions or higher use this article to install the iOS Roaming Client on managed iPhone and iPad devices through a mobile device management (MDM) provider. Manual installation via Apple Configurator 2 is not supported.

The iOS Roaming Client operates a VPN that forwards DNS queries to DNSFilter without routing other traffic through DNSFilter servers. This feature is available on Enterprise accounts. The agent checks in every 5 minutes to detect available updates and identify offline agents.

Assign local domains before installing the iOS Roaming Client to avoid internal resource connection interruptions.

Install the iOS Roaming Client

MDM platforms vary in how they manage and deploy apps. Consult the MDM provider's documentation for platform-specific steps.

The iOS agent applies MDM settings first. If a setting in the DNSFilter dashboard conflicts with the MDM configuration, the MDM setting applies.

  1. From the DNSFilter dashboard, navigate to Deployments and select Roaming Clients
  2. Select Install Roaming Client
  3. Select the Site
  4. Select iOS
  5. Copy the Site Key
  6. Enable Auto Registration if applicable
  7. Download the .mobileconfig file
  8. Edit the KEYHERE field in the file to include the Site Key

  9. Add any MDM-specific information such as permissions, groups, or licensing

    To pass additional configuration to the agent via MDM, add any of the following optional keys to the ProviderConfiguration block in the .mobileconfig file:

    <key>ProviderConfiguration</key>
  <dict>
    <key>site_key</key>
    <string>YOUR SITE KEY HERE</string>
    <key>host_name</key>
    <string>Test {{serial_number}}</string>
    <key>userName</key>
    <string>{{icloud_username}}</string>
    <key>dashboard_tags</key>
    <string>Tag1, Tag2, Tag3</string>
  </dict>
    Key Description
    site_key Required. The Site Key from the DNSFilter dashboard
    host_name Sets the Client Name as it appears in the DNSFilter dashboard. Accepts MDM device variables such as {{serial_number}}
    userName Populates the Last Logged in User field in the DNSFilter dashboard. Only transmitted if the end user grants iCloud account access on the device. If permission is not granted, the field remains unpopulated
    dashboard_tags Applies one or more tags to the agent in the DNSFilter dashboard. Separate multiple tags with commas

    Device-specific variable syntax such as {{serial_number}} and {{icloud_username}} differs across MDM providers. Verify the correct variable syntax in the MDM provider's documentation before deploying. See examples for Microsoft Intune and Addigy.

  10. Create an MDM profile and upload the file
  11. Download the DNSFilter Roaming Client from the App Store
  12. Push the app to devices

Once the app is pushed, devices register in the DNSFilter dashboard and the filtering policy associated with the Site applies.

DNS over TLS (DoT) default behavior

DoT is enabled by default on iOS devices and may cause DNS conflicts in some environments. To disable DoT, add the following key to the .mobileconfig file before deploying:

<key>dns_over_tls_enabled</key>
     <false/>

Additional MDM-specific deployment guides are available in the DNSFilter Help Center, including examples for Jamf Pro and Intune.

Related content

Comments

4 comments

Date Votes
  • Lokken Wong

    Thank you for providing an alternative solution. 
    I have been waiting for a long time to get this resolved!

    0
  • Minetta Gould Community Team DNSFilter Staff

    So glad this update helps you out, Lokken Wong ! The team was definitely excited to get this fix into everyone's hands, so they appreciate the feedback. 

    0
  • Avery Knox

    I have some questions about this article.  The Avoid filtering interruptions by encrypting DNS (DoT) article says:

    With iOS agent version 1.0.8 and higher, DoT is enabled by default, no longer requiring the end-user to configure manually.

    But at the beginning of this article, it mentions disabling DoT, almost as it needs to be done in preparation for installation. To me, that shouldn't be at the top, or perhaps the article should discuss why we would ever want to disable DoT.

    0
  • Minetta Gould Community Team DNSFilter Staff

    Thanks for the feedback! The option to disable DoT is available because some IT admins prefer the option for compatibility with internal DNS setups, easier troubleshooting, or better visibility into DNS traffic for security tools. It’s all about giving admins flexibility based on their network needs. 

    We make recommendations and set defaults, but want to make sure our customers are aware of default updates and changes, hence the callout at the top of the process steps like you see here: DoT wasn't enabled by default until recently. 

    Hope this helps! 

    0

Please sign in to leave a comment.