A white-label iOS VPN is not a logo on a toggle. Apple treats it as a Network Extension product. If you ship WireGuard or OpenVPN inside the app, you are in Packet Tunnel Provider territory. That is a different animal from Personal VPN, which rides Apple's built-in IKEv2 path. Mix those two up and you will spend a month arguing with a binary that cannot bring a tunnel up on a phone.
I write this as the person who has watched partners polish TestFlight screenshots while the capability request was still sitting in a drafts folder. The App Store does not grade your enthusiasm. It grades whether the team is enrolled as an organization, whether the extension is entitled, and whether Guideline 5.4's data screen exists before anyone pays. Crypto is the easy part. Paperwork is the product.
KloxVPN's consumer plan is WireGuard, OpenVPN, OpenConnect, and Shadowsocks, five devices, from $2.83/month on yearly, 7-day money-back. Your branded iOS client still has to pass Apple as your app, on your developer team. You inherit none of our listing history. Reseller skips this queue because users install Klox. If you want your icon on the home screen, this checklist is yours.
Read Apple's Packet Tunnel Provider page and Review Guideline 5.4 on the same afternoon. Then request the Network Extension capability before anyone talks about TestFlight. A simulator that 'connects' is not evidence. A physical iPhone with a green VPN badge is evidence.
This is not a clone of the rejection-pattern catalog. That piece is what happens after you submit a messy packet. This piece is the entitlement path that should exist before you even press Submit. If you skip it, the rejection article becomes your week.
I will not invent entitlement string names I am not sure of. The Network Extension entitlement Apple documents in public materials is commonly `com.apple.developer.networking.networkextension`. If Apple's live capability list in the developer portal shows a more specific checkbox for packet-tunnel, tick what matches the binary you actually ship. Guessing strings in a plist is how you get a build that installs and then does nothing.
Package details — which iOS binary you get, whose Apple account holds the app, what we can fill in review notes — confirm with sales. Do not treat a blog post as a statement of work.
Related reading: AI Traffic Analysis Is Why a VPN Network Still Matters and VPN After Changing Default Browser: Extensions, DoH, Leftover Proxy. White-Label VPN and Eleventy (CMS installs) and White-Label VPN and Eleventy on a branded site. What is a VPN? and Reseller program.
Looking for a reliable VPN?
KloxVPN — from $2.83/month. Apps for every device.
This is a paperwork problem, not a crypto problem
Founders want to talk WireGuard handshake times. Apple wants to know why your process is allowed to see device traffic. A VPN can observe packets. Stores know the category is full of junk: ad injectors, fake cleaners, tunnels used as always-on hooks for something else. You inherit that reputation even if your brand is clean.
Cloudflare's explainer is a decent primer for a non-engineer on what a VPN even is. Wikipedia's VPN page is the other tab for vocabulary. Neither writes your entitlement request. You still have to name the hop: encrypt device traffic to operator nodes. If you cannot say that in one sentence without lifestyle adjectives, you are not ready to ask Apple for a capability.
TLS on the control plane still lives in the RFC 8446 world. That does not get you the extension. The extension is a separate trust decision.
- 1Skim the seating / order diagram.
- 2Do the numbered steps once on your real network.
- 3Use the FAQ if a sentence was too long.
- 4Follow one related article — not ten tabs.
How to read this page
| Path | What it is | Typical protocols | When a white-label brand uses it |
|---|---|---|---|
| Personal VPN | System VPN via NEVPNManager | IKEv2 / IPsec (Apple-provided) | Rare for a branded WireGuard/OpenVPN app |
| Packet Tunnel Provider | Custom tunnel in your extension | WireGuard, OpenVPN, other custom stacks | Default for a real branded client |
| No extension | A website with a connect button | None on-device | Not an iOS VPN product |
If the entitlement is missing, TestFlight is a costume party. The tunnel never comes up on a real phone.
— KloxVPN operator notes
App Store Review Guidelines (VPN Apps, 5.4)
Cloudflare Learning: What is a VPN?
What the reviewer is actually afraid of
They have seen tunnels used to inject ads, to steal sessions, to pretend to be a VPN while shipping a content filter nobody asked for. Your job is to look like a VPN: connect, encrypt, disconnect, account, support URL. If the binary also wants contacts, photos, or Bluetooth, you will answer for each one. A white-label Klox partner build should not grow random permissions because a contractor added a chat SDK.
Why 'it works in Xcode' is not a sentence
Unsigned or loosely signed debug builds on a personal team can lie to you. The production path is: organization team, Network Extension capability granted, provisioning profile that includes it, device that is not a simulator. If any layer is missing, the toggle fails closed. That is correct behavior. It is also how launch calendars die.
Who owns this packet
The partner who wants the brand on the icon owns the Apple Developer Program membership, the capability request, and the review notes. We can help with test steps. We cannot be your legal entity. If your agency holds the team, they hold your update path. Put the team on the company. Two people with access. Hardware keys where you can.
Personal VPN versus Packet Tunnel Provider
Apple documents two families that get confused in sales calls. Personal VPN, driven through NEVPNManager, uses protocols the system already knows how to speak. Packet Tunnel Provider is an app extension that implements a custom tunnel. Apple's Packet Tunnel Provider page is the source for the second path. Read it. Do not quote a 2018 Stack Overflow answer.
A branded client that speaks WireGuard, OpenVPN, OpenConnect, and Shadowsocks is almost always the second path. Personal VPN will not magically speak WireGuard because you wished it would. If someone on your team says 'we'll just use IKEv2 to skip the entitlement,' they are proposing a different product. Say that out loud before you print boxes.
Personal VPN is not a shortcut to a branded protocol
IKEv2 can be a fine protocol. It is not the protocol Klox ships as the default consumer story. Our consumer apps are WireGuard, OpenVPN, OpenConnect, and Shadowsocks. A white-label iOS build that matches that story needs a custom tunnel provider. If your deal is IKEv2-only, that is a different SKU. Confirm with sales. Do not assume.
What the extension process actually does
The packet-tunnel process receives packets from the system, encrypts them toward your VPN server, and writes the other direction back. It runs in a tighter sandbox than your UI app. It can die independently. Users see a VPN icon in the status bar when the configuration is active. If that icon never appears, you do not have a VPN app. You have a settings screen.
On-demand rules are extra honesty, not extra magic
If the tunnel can start without a tap, say so in the app before you install the profile. Surprise tunnels feel like malware even when they are a feature. Reviewers have seen the malware version. Guideline 5.4 already asks you to declare data use on a screen before purchase or use. On-demand is the same spirit: no surprises.
The entitlement you actually request
In the developer portal you enable Network Extension capabilities for the App ID, then regenerate profiles. The entitlement that shows up in public Apple documentation for this family is commonly `com.apple.developer.networking.networkextension`. I am not going to invent additional reverse-DNS strings for packet-tunnel-provider, app-proxy, or dns-proxy unless I am staring at Apple's current capability UI. If your binary only needs packet tunnel, do not tick every networking box 'just in case.' Extra capabilities are extra questions.
Apple grants this to the team, not to your optimism. A personal account plus a DBA on the listing is the wrong shape for Guideline 5.4, which currently says VPN services may only be offered by developers enrolled as an organization.
Do not copy a plist from a GitHub sample
Samples rot. They include entitlements for hotspots, DNS proxies, or relay providers you do not ship. Your entitlements file should match the extension types in the binary. If the sample has `dns-proxy` and you do not ship a DNS proxy, delete it. Reviewers can see the mismatch. So can a future engineer who thinks you promised a feature.
App ID, extension ID, and the bundle that is not the UI
The Packet Tunnel Provider is a separate target with a separate bundle ID. Both need the right capabilities. People entitle the UI app and forget the extension. The UI launches. The tunnel never starts. Then someone files a ticket that 'iOS is broken.' iOS is not broken. Your profile is.
Provisioning is a versioned artifact
When Apple approves the capability, you still have to download new profiles, install them on the build machine, and archive again. CI that caches last month's profile will ship a binary that looks new and is not. Put a human on 'did we regenerate profiles after the grant.' That human is not optional.
Guideline 5.4 in operator English
The public Review Guidelines include a VPN Apps section, currently numbered 5.4. Read the live page. Policies move. As of the text Apple publishes, apps offering VPN services must use the NEVPNManager API, may only be offered by organization-enrolled developers, must declare what user data is collected and how it is used on an app screen before purchase or use, must not sell or disclose that data to third parties, must say so in the privacy policy, must not violate local laws, and must put license information in App Review Notes if a territory requires a VPN license. Parental control, content blocking, and security apps from approved providers may also use NEVPNManager. Non-compliance can mean removal from the store and from alternative distribution, and possible removal from the Developer Program.
That is a contract. It is not a vibe. Your onboarding screen is part of the binary, not a blog post.
The on-screen declaration is not the privacy nutrition label
Nutrition labels live in App Store Connect. 5.4 wants a screen in the app before the user buys or uses the service. Those two can agree. They often do not. Write one source of truth: data types, purposes, no third-party sale. Put it in the app. Put it in the policy URL. Put it in the form. If they diverge, you invented a lie.
Organization enrollment is not a suggestion
DUNS, legal name, matching website. Start this on day one of a 14-day fantasy calendar. Personal teams are for hobbies. A white-label brand that takes cards is not a hobby. If your company is still 'forming,' you are not in the App Store yet. You are in a lawyer's inbox.
Licenses in territories that require them
If you ship in a country that licenses VPN operators, App Review Notes is where Apple currently asks for that information. I will not pretend to know your license number. Counsel and sales should. Empty notes plus a restricted storefront is how you get a legal rejection that looks like a technical one.
Organization account, team ID, and the agency trap
The team ID is ownership. If the contractor created the Apple account with their email, you do not have a brand. You have a hostage. Transfer later is pain. Do the entity matching before you schedule a launch tweet.
Two-factor on the account holder. A second Admin who is not the founder on a plane. Recovery keys in a company vault, not in a WhatsApp chat. I have watched a brand freeze because the only person who could click 'submit' was at a wedding.
Certificates are not souvenirs
Distribution certs expire. People leave. If the signing identity lives on one MacBook, that MacBook is now production infrastructure. Use a proper signing setup. Document which cert is for the extension. When you rotate, TestFlight a build before you tell ads to spend.
Name matching across site, app, and merchant
The seller on the card, the name in App Store Connect, and the privacy policy company should be the same story. Mystery descriptors create chargebacks. Mystery developers create review questions. This is the same ownership stack as who owns the VPN customer. The store is one layer of that stack.
Request the capability before TestFlight
TestFlight still needs a signed binary that can run the extension on a device. If the capability is pending, external testers will install an app whose connect button is theater. Internal testers on a development profile might see a tunnel. Then production TestFlight fails. People call that a 'TestFlight bug.' It is an entitlement bug you scheduled for the week of launch.
I treat the capability request as day-zero work, same as DUNS. The 14-day launch checklist already puts store identity on the critical path. This article is the iOS-specific reason that path exists.
What to write in the capability request
Plain language. The app establishes a VPN tunnel so the user's internet traffic is encrypted in transit to servers operated for this service. You are not 'optimizing the web experience.' You are not 'personalizing content.' Adware language is how you get read as adware. If you have split tunnel, say the user can exclude apps. If you do not, do not imply you do.
Timing you cannot purchase
Apple's queue is not a paid SLA. Anyone who sells you a guaranteed grant date is selling a story. Submit complete. Follow up like an adult. Do not spam. Do not start paid iOS ads against a TestFlight that cannot connect.
Physical device, always
Record a two-minute video: install, grant VPN permission, connect, show Settings confirming a VPN configuration, browse one page, disconnect. That video is for review later and for your own QA now. Simulators skip the scary permission sheet users actually see. Users who skip that sheet do not have a tunnel. Your support inbox will teach you this if you skip the video.
Review notes, demo account, and the packet that is not theater
When you finally submit, the entitlement letter and the review notes should use the same words. Demo account that works without a credit-card dance. Credentials in App Review Information and again in notes. A reviewer who cannot log in will not care that your WireGuard is fast.
I want a folder before anyone hits Submit: legal name, DUNS, organization enrollment, capability grant screenshot, privacy and terms URLs that load, nutrition form from an SDK inventory, demo account, the two-minute video, notes under 400 words. If an item is missing, you are not late because of Apple. You are late because the folder is empty.
VPN configuration description users see
iOS shows system UI around the VPN configuration. Write the hop, not a 2017 slogan. 'This configuration routes device traffic through a VPN operated by [Brand] so it is encrypted between your device and the VPN server.' Users who are already nervous read this on a system screen. Reviewers do too.
Permissions you do not need
A VPN needs network. It does not automatically need local network, contacts, photos, motion, or tracking. If a library added a permission you cannot explain, remove the library. Each extra prompt is a 5.4-adjacent question even when the guideline text is about VPN APIs specifically.
TestFlight groups are not a launch
External testers still need the entitled build. Do not promise a journalist a TestFlight build for Friday if the capability is 'in progress.' Give them a desktop client or wait. Overpromising TestFlight is how you get a public tweet about a dead toggle.
White-label iOS versus first-party Klox
Klox consumer iOS already lives on the store. Your branded app is a new listing with a new team. You inherit the technical stack inside the binary. You inherit none of the review history. Notes should not say 'this is a reskin of a famous VPN' as a personality. They should say what the app does, who operates the service, and how to test it.
Reseller partners do not submit a branded client. Users install Klox. If your plan depends on a store icon with your mascot, you are in white-label, and this checklist is homework. See /ios-vpn for how we talk about the first-party iPhone client. Your listing will not copy that URL. It will copy the honesty.
Who writes the data screen
The partner approves every sentence that names data practices. We can describe what the client technically does. We cannot invent your processors. If counsel has not read the screen, do not ship the screen.
Shared backends, true sentences
You do not need a packet-capture essay in the listing. You do need terms that do not claim you rack every node if you do not. Review notes can be plain: the app connects to VPN infrastructure operated with our platform partner. If counsel wants different words, use theirs, as long as they are true.
Updates reopen the circus
A new permission, a new SDK, a new in-app purchase: re-read 5.4 and the nutrition form. TLS library CVEs on the control plane will force updates on someone else's calendar. That is ops. Budget it. Do not remotely disable the tunnel for everyone as a 'feature flag' joke.
macOS, MDM, and the 'we'll skip iOS' trap
Tired founders say they will skip the App Store and 'just do Android and a website.' Households are mixed. The person who pays often has an iPhone. If your brand is missing there, they will install a competitor before they sideload your IPA. Ads send people to store listings. An empty listing is a donation.
macOS notarization and system extensions have their own clicks. Enterprise MDM is a different store. Do not mix an MDM path into a consumer listing to dodge 5.4. Reviewers have seen the dodge. Use /contact for that shape.
Network Extension on Mac is not a free copy-paste
A packet tunnel on macOS still needs signing, notarization, and a user who will click through system prompts. Document the clicks. Record a video. If 'Mac support' is a README only your engineer can follow, that engineer is now your only Mac support agent.
Competitor listings are not your entitlement
NordVPN and others already live on iOS. That does not transfer to your team. Their screenshots are not your screenshots. Their entitlement grant is not yours. Look at their product if you want to see how a mature listing talks. Then write yours from the binary you ship.
Operator checklist you can print
Print this. Put a name next to each line. If a line is blank, you are not in TestFlight.
Organization Apple Developer enrollment matching the legal entity. DUNS done. App ID and extension App ID created. Network Extension capability requested with a purpose sentence a tired Apple employee can follow. Grant received. Profiles regenerated. Entitlements file matches packet-tunnel only. Physical iPhone connect video. On-screen 5.4 data declaration before paywall. Privacy policy URL loads and names the same company. Demo account. Review notes under 400 words. Support URL not behind a login. No extra permissions. No lifestyle slogans in the system VPN description.
When that folder is full, talk to us about white-label with the Apple work already started. When it is empty, a launch date is fiction.
Day-zero versus day-twelve
Start the capability request when you start the logo. Not when ads are booked. The 14-day checklist already warned you. This is the iOS reason people ignore that warning and then blame Apple.
What I will not put on this list
A guaranteed date. An invented second entitlement string. A promise that Personal VPN will stand in for WireGuard. An SLA percentage. A city count. SOC 2. If a vendor deck includes those as if they were Apple policy, throw the deck out.
If you do not want this homework
Resell Klox. Users install our iOS app. You skip Network Extension. That is a valid motion. It is a different ownership story. Pick it on purpose, not as a tantrum after a rejection.
A week-one calendar that is not fiction
Day 1: start organization enrollment if it is not done. Draft the purpose sentence. Day 2: create App IDs for UI and extension. Submit the capability request. Day 3: privacy screen copy and policy URL. Day 4: wait, and build against a development profile that already includes the entitlement if you have a sandbox grant. Day 5: physical device video. Day 6: demo account and notes. Day 7: only then talk about TestFlight external testers. If enrollment is still pending on day 7, you do not have a week-one iOS launch. You have a website and a desktop build. Ship those. Do not lie to ads.
Key Takeaways
A white-label iOS VPN lives or dies on Network Extension paperwork. Personal VPN is Apple's built-in path. Packet Tunnel Provider is the path for a branded WireGuard, OpenVPN, OpenConnect, and Shadowsocks client. Request the commonly documented Network Extension entitlement before TestFlight. Enroll as an organization. Put Guideline 5.4's data screen in the app before anyone pays. Record a phone, not a simulator.
You own the Apple team. Klox does not lend you our listing history. Reseller skips the queue because the icon says Klox. If you want the mascot on the home screen, print the checklist, put names on the lines, and confirm package specifics with sales. Then ship a binary that matches the notes.
The tunnel is crypto. The store is trust. Apple will not confuse the two even if your launch email does.
Related Resources
Ship iOS as a real Network Extension product
White-label puts your brand on the Klox network and on your store accounts. We can help with test steps. You still own the entitlement request and the 5.4 screen.
Talk to us about white-labelFrequently Asked Questions
KloxVPN Team
Experts in VPN infrastructure, network security, and online privacy. The KloxVPN team has been building and operating VPN services since 2019, providing consumer and white-label VPN solutions to thousands of users worldwide.