Configure Always-On VPN on macOS 13

Configuring an Always-On VPN connection on macOS 13 (Ventura) ensures that all network traffic is securely tunneled through your organization's network without allowing the user to disable the connection. On macOS, true Always-On VPN functionality cannot be enabled through the standard consumer user interface; it requires an Apple Mobile Device Management (MDM) solution or a custom configuration profile deployed to a managed Mac. This guide details the prerequisites, configuration steps, and deployment process required to enforce an Always-On VPN on macOS 13.

Prerequisites

Before starting, ensure you have the following:

  • A Mac running macOS 13 (Ventura) enrolled in an MDM solution (e.g., Jamf Pro, Microsoft Intune, Kandji) or access to Apple Configurator.
  • An IKEv2 VPN infrastructure supporting certificate-based or machine-level authentication.
  • Root or administrative privileges to deploy configuration profiles.

Step 1: Create an IKEv2 VPN Payload

Always-On VPN relies on an IKEv2 configuration profile configured for machine authentication.

  1. Open your MDM console or a profile creation utility such as Apple Configurator.
  2. Create a new macOS Configuration Profile.
  3. Select the VPN payload and configure the basic connection parameters:
    • Connection Type: IKEv2
    • Server Address: The fully qualified domain name (FQDN) or IP address of your VPN gateway.
    • Remote Identifier: The identity of the remote server.
    • Local Identifier: The client machine identifier.
    • Authentication Method: Certificate (recommended for Always-On) or Shared Secret.

Step 2: Configure "On Demand" Rules

To ensure the VPN behaves as "Always-On," you must define "Connect On Demand" rules within the VPN payload. These rules force macOS to initiate and maintain the VPN tunnel automatically.

  1. Locate the On Demand section in the VPN payload settings.
  2. Enable Connect On Demand.
  3. Add a dictionary rule with the following parameters:
    • Action: Connect
    • Interface Type: Any (applies to Wi-Fi, Ethernet, and cellular connections).
  4. (Optional) Define domain-specific rules or fallback exceptions if internal corporate domains require immediate routing.

Step 3: Enforce Device-Level Restrictions

To prevent users from manually disconnecting the VPN:

  1. Ensure the profile scope is set to the Device Channel rather than the User Channel.
  2. In the VPN payload, ensure the setting for user disconnect permissions is disabled, or use the MDM's restriction payload to lock network settings.
  3. If using an MDM that supports Apple’s native Content Filter or System Extensions, configure the VPN as a device-wide system extension tunnel.

Step 4: Deploy the Profile to macOS 13

Deploy the completed .mobileconfig file to your target macOS 13 machine:

  1. Via MDM: Assign the profile to your macOS 13 device group. The MDM will push the profile silently in the background.
  2. Manually (Testing only):
    • Double-click the .mobileconfig file.
    • Open System Settings > Privacy & Security > Profiles.
    • Locate the downloaded profile and click Install.
    • Enter the local administrator credentials to confirm.

Step 5: Verify Connection on macOS 13

  1. Open System Settings on the Mac.
  2. Navigate to VPN in the left sidebar.
  3. Check the status of your deployed VPN connection. It should display Connected automatically.
  4. Attempt to disconnect from the network or switch network interfaces (e.g., toggling from Ethernet to Wi-Fi); the VPN should automatically re-establish the tunnel immediately upon acquiring a new IP address.