Terminology
Define the WireGuard, Apple platform, and MDM terms used throughout the Vylos documentation.
Allowed IPs
Allowed IPs set which IP ranges route through a WireGuard peer, configured with the AllowedIPs field. Vylos shows this value in the Peer section of a tunnel's detail view.
App-Created Tunnel
An app-created tunnel is a WireGuard tunnel you add yourself through import, QR code, or manual entry. It appears in the My Tunnels section and stays fully editable, unlike a managed tunnel.
App Group
An App Group is a shared storage container that lets Vylos and its background VPN component exchange tunnel state and notification preferences. The Quick Look extension deliberately has no access to that container, keeping file previews isolated from your live tunnel list.
AppLayerVPN
AppLayerVPN is Apple's managed per-app VPN configuration profile, identified by com.apple.vpn.managed.applayer. It is the operating-system layer that selects traffic from assigned applications.
Vylos supports its packet-tunnel provider mode: MDM associates target applications through a shared VPNUUID, Apple sends matching IP packets to Vylos, and Vylos carries those packets through WireGuard. The separate app-proxy provider mode is not supported.
App Routing
App routing describes which applications Apple allows to use a managed tunnel. Vylos shows Per-App plus the signing identifiers and match domains that the operating system reports for an AppLayerVPN tunnel.
A conventional device-wide tunnel shows Device-wide and All Apps because Apple does not expose a reliable per-process consumer list for it.
App Lock
App lock protects Vylos with Face ID, Touch ID, a device passcode, or a 6-digit TOTP code from an authenticator app. Its authentication step is bypassed when Managed App Configuration is present, but organization restrictions continue to apply.
Clash Detection
Clash detection warns you when two or more enabled tunnels have overlapping on-demand rules, such as both activating on the same Wi-Fi network. Vylos surfaces a banner on the Home screen listing each conflicting pair so you can adjust the rules.
Configuration Profile
A configuration profile is an Apple .mobileconfig payload that delivers device settings or a VPN tunnel. It can be installed by an MDM service or installed directly on a device when MDM is unavailable.
Vylos uses com.apple.vpn.managed for device-wide managed tunnels and com.apple.vpn.managed.applayer for per-app managed WireGuard tunnels. These profiles are separate from Managed App Configuration.
Continuity Camera
Continuity Camera lets a Mac use a paired iPhone's camera as an input source. Vylos does not use it for tunnel QR import; QR import is available on iOS only.
Flap Storm
A flap storm is a rapid cycle of connect and disconnect events caused by an unstable network. Vylos ignores connectivity losses shorter than 15 seconds and limits disconnect alerts to one every 15 minutes across all disconnect reasons.
Handshake
A handshake is the cryptographic exchange WireGuard peers complete to establish a secure connection. Vylos shows the time since the most recent handshake in a tunnel's Status section, such as "2 minutes ago."
Interface
The interface is the [Interface] section of a WireGuard configuration, holding the local device's private key, address, DNS servers, and listen port. Vylos displays these fields in the Interface section of an app tunnel's detail view.
Jailbreak Detection
Jailbreak detection uses layered integrity checks to look for signs of jailbreak tooling, sandbox compromise, and runtime tampering on iOS. When the blockJailbrokenDevices MDM key is enabled, a positive detection blocks app access, disconnects all Vylos tunnels, disarms On-Demand, and prevents reconnect attempts until the managed block is resolved.
Keychain-Backed Storage
Keychain-backed storage keeps a tunnel's sensitive configuration in the device Keychain instead of embedding private keys directly in the operating system's VPN record.
Kill Switch
A kill switch blocks most ordinary network traffic from bypassing an armed On-Demand tunnel. User-created tunnels store the choice as Routing.KillSwitch in a .vylos file, while managed tunnels use Apple's VPN.IncludeAllNetworks profile field. WireGuard AllowedIPs still determines which destinations can travel through a peer, so a partial route set becomes a strict allowlist instead of a full tunnel.
Apple still permits traffic required for network control and certain device services, so the term does not mean that literally every system packet enters the VPN.
Managed App Configuration
Managed App Configuration is an MDM-delivered dictionary that can set Vylos restriction keys, override supported preferences, and provide organization contact information. Its presence bypasses app-lock authentication, but every supplied restriction remains enforced.
Managed Tunnel
A managed tunnel is a WireGuard tunnel installed through either a device-wide com.apple.vpn.managed profile or a per-app com.apple.vpn.managed.applayer profile. The profile may arrive through MDM or direct .mobileconfig installation.
It appears read-only in the Managed Tunnels section and follows the lifecycle of the installed profile.
Match Domains
Match domains are the domains whose DNS queries route through a tunnel's DNS servers instead of the default network. Adding corp.example.com as a match domain routes lookups for server.corp.example.com through the tunnel.
MDM
MDM (Mobile Device Management) is the class of enterprise systems, such as Jamf, Kandji, Intune, Workspace ONE, and Mosyle, that IT administrators use to configure and secure fleets of devices. Vylos integrates with any MDM that supports Managed App Configuration and configuration profiles.
Network Extension
A network extension is the background system process that runs the actual WireGuard tunnel, separate from Vylos's main app process. Vylos communicates with it to send provider messages, collect bandwidth snapshots, and write the WireGuard diagnostic log.
On-Demand Rules
Vylos On-Demand rules connect a tunnel automatically when your device joins a matching cellular, Wi-Fi, or Ethernet network. Each rule lives in an [OnDemandRule] section of a .vylos settings file, and the tunnel activates if any one rule matches.
AppLayerVPN activation is separate: Apple evaluates OnDemandMatchAppEnabled and starts the managed tunnel when an assigned app makes network traffic.
Optic ID
Optic ID is Apple Vision Pro's eye-based biometric authentication system. Vylos labels its system-authentication method Passcode on visionOS, while Apple's prompt can use Optic ID with the device passcode as a fallback.
Ornament
An ornament is a visionOS UI element that floats outside a window's main content, anchored to one of its edges. Vylos uses ornaments for active-tunnel status, quick actions, and contextual tunnel controls.
Peer
A peer is a [Peer] section of a WireGuard configuration, describing one remote endpoint by its public key, allowed IPs, and address. A tunnel can define multiple peers, and Vylos lists each one in the tunnel's detail view.
Per-App VPN
Per-app VPN is the user-facing name for Apple's AppLayerVPN routing model. An MDM service assigns selected managed apps to a tunnel by VPNUUID; those apps use the WireGuard tunnel while unassigned apps stay outside it.
The operating system owns the selection and activation rules, while Vylos carries the selected traffic through WireGuard and presents the resulting managed tunnel as read-only.
Persistent Keepalive
Persistent keepalive sends a periodic packet to a peer so NAT and firewall mappings stay open between real traffic. Vylos displays the configured interval, such as "Every 25 seconds," in the Peer section of a tunnel's detail view.
Quick Look
Quick Look is Apple's system framework for previewing a file's contents without opening its owning app. Vylos ships a Quick Look extension that previews .conf, .vylos, and .zip tunnel files in Finder and the Files app.
Restriction Keys
Restriction keys are the three settings, allowManualTunnels, allowSettings, and blockJailbrokenDevices, that an MDM administrator sets through Managed App Configuration. Vylos accepts boolean, numeric, or string values and applies one consistent true/false rule.
Rx and Tx
Rx and Tx are the received and transmitted byte counts Vylos tracks for each tunnel. Live counters appear in tunnel status, while bandwidth views show totals for the selected time range.
Search Domains
Search domains are fallback domains Vylos appends to a bare hostname query when the first lookup fails. Adding example.com as a search domain retries a failed query for intranet as intranet.example.com.
Siri Shortcuts
Siri Shortcuts let you connect, disconnect, toggle, or edit a named user-created tunnel through voice commands or the Shortcuts app. Managed tunnels do not appear as shortcut targets.
Managed App Configuration can bypass the app lock only for actions otherwise permitted by managed policy. Setting allowManualTunnels=false removes user-created tunnel targets and blocks stale saved shortcuts.
Split DNS
Split DNS routes DNS queries for specific domains through the VPN tunnel while every other query stays on your default network. You configure it per-tunnel with match domains and search domains under the [SplitDNS] section of the .vylos settings file.
Spotlight
Spotlight is Apple's system-wide search index, and Vylos publishes your app-created tunnel names to it so a matching search opens the tunnel directly. The index clears automatically while app lock is engaged, so tunnel names don't leak on a locked device.
System Entry
A system entry is the operating system's VPN configuration record that appears in the device's Settings app. Every tunnel Vylos manages, whether app-created or managed, has a corresponding system entry.
TOTP
TOTP (time-based one-time password) is a 6-digit code that an authenticator app, such as Google Authenticator or Authy, generates and rotates every 30 seconds. Vylos accepts codes from the current period plus one period on either side to tolerate small clock differences.
VPNUUID
VPNUUID is the identifier that links an AppLayerVPN profile to its MDM-managed application assignments. The VPN payload and every assigned app must use the same value.
Replacing or removing the VPN profile does not itself clear an application's assignment. The MDM service must also update that managed application's attributes.
.vylos Format
The .vylos format is a ZIP archive that pairs an untouched WireGuard .conf file with an optional settings.conf file for Split DNS, On-Demand Rules, and kill-switch behavior. It extends a standard WireGuard configuration without modifying it, so the same .conf still works with any other WireGuard client.
See Vylos File Format for the complete schema.