Skip to main content

Admin Dashboard

Blocksi Filter - Jamf School iOS Configuration Guide

The following contains procedures for deploying Blocksi Filter (full URL + granular YouTube filtering solution) through Jamf School.

Jamf School delivers two components to each device:

  1. Blocksi Filter app - The filter itself.

  2. Blocksi configuration profile - Contains the Blocksi certificate, the VPN connection, and the content filter settings that turn on filtering for browsers on the device.

Prerequisites

Ensure the following prerequisites are in place before proceeding with deployment:

  • Administrator access to your Jamf School MDM portal.

  • Your Blocksi Super-Admin account email address.

  • Send your Organization ID and organization name to Blocksi Support to authorize your district's use of the Blocksi Filter app. Refer to the Getting Your Organization ID and Name section for more information.

  • Ensure that Custom Apps and the Volume Purchase Program (VPP) are fully enabled and configured. Refer to the Configuring Volume Purchasing section for more information.

  • Devices are supervised and managed by Jamf School. A device group exists that contains the target devices.

  • A filtering policy must be created and configured on the Blocksi Admin Dashboard.

  • The Blocksi Filter app is assigned to the location that your MDM uses in Apple School Manager or Apple Business Manager, and has synced into Jamf School.

  • Each device must have an owner assigned in Jamf School so that activity is attributed to the correct user. Devices without an owner receive a blanket filtering policy instead.

Getting Your Organization ID and Name
To get your organization ID and name:

  1. Sign in to your Apple School Manager account with your Administrator credentials.

  2. Click your account name in the lower left-hand corner, and then click Preferences from the pop-up menu.

  3. Go to Organization Information.

  4. Locate your Organization ID and Organization Name.

  5. Send this information to Blocksi. It is required to add your organization to the approved list of customers who can use Blocksi's filtering app.

Configuring Volume Purchasing
To download the service token:

  1. Sign in to your company's account at business.apple.com (Apple Business Manager) or school.apple.com (Apple School Manager).

  2. Click your account name in the top right corner, then click Settings from the drop-down menu.

  3. Click Payments and Billing.

  4. Under the Apps and Books tab, scroll to the Content Tokens section and click Download next to the correct server location token. The token is downloaded to the Downloads folder on your computer.

Adding a New Service Token
To add a new service token to Jamf School:

  1. In Jamf School, navigate to Organization > Settings and click the Content (Volume Purchasing) payload.

  2. Click Add Content Token, upload the token from your Downloads folder, then click Apply.

  3. Click Edit. If this is not your primary account, clear the Primary account checkbox.

  4. Choose a license assignment method.

  5. Select the Automatically invite user checkbox to invite users to Apple School Manager when they enroll in Jamf School, then click Apply.

Renewing the Service Token
To renew the service token:

  1. In Jamf School, navigate to Organization > Settings and click the Content (Volume Purchasing) payload.

  2. Click Replace on the token you want to renew.

  3. Upload the token file (.vpptoken) that you downloaded from Apple Business Manager or Apple School Manager, then click Apply.

Configuring the Blocksi Filter App in Jamf School

Volume-purchased apps are not added to Jamf School manually. After you assign Blocksi Filter to the location of your content token in Apple School Manager or Apple Business Manager, the app syncs into Jamf School and appears under Apps > Inventory.

To configure the Blocksi Filter app in Jamf School:

  1. In Jamf School, navigate to Apps > Inventory.

    Apps Pages

  2. Click Sync with Apple School Manager to sync the Blocksi Filter app into your inventory.

  3. Click the Blocksi Filter app. The Blocksi Filter page opens.

    Blocksi Filter Page

  4. Under Volume Purchasing, click Show advanced options, then configure the following:

    • Automatically distribute licenses to users in scope - Select the checkbox.

    • Automatically remove licenses from users out of scope - Select the checkbox.

  5. Under Options, select the Prevent users from removing the app (iOS 14 or later) checkbox.

    Configuring Blocksi Filter Volume Purchasing and Options

  6. At the bottom of the page, under This app will be distributed to the following device groups, click the plus button and select your target device group.

    Blocksi Filter Device Distribution

  7. Click Save.

Deploying the Blocksi Configuration Profile

The Blocksi configuration profile contains the Blocksi certificate, the VPN connection, and the content filter settings in a single file. Configure the file with your Organization ID before you upload it to Jamf School.

Download URLs

The relevant .mobileconfig file can be downloaded using the following link:

Configuring the Blocksi Configuration Profile
To configure the Blocksi configuration profile:

  1. Download the Blocksi_Filter_JamfSchool.mobileconfig file.

  2. Open the downloaded .mobileconfig file using any text or code editor.

  3. In the VendorConfig dict, configure the following keys:

    • organizationId - Replace admin@blocksi.net with your Blocksi Organization ID.

    • adminPassword - Leave the default value, or replace it with a password of your choice. This password protects access to the app details in the Blocksi Filter app.

    • userId - Leave the value set to %Email%. Jamf School replaces this variable with the email address of the device owner.

    • snAnalytics - Leave the value unchanged. This key reports the serial number of the device for analytics only, and is separate from the serialNumber key used for serial number-based filtering.

    • useDhcpDns - Leave the value set to <true/>. The filter uses the DNS servers provided by your network and falls back to public DNS servers if none are available.

    • customPerAppVpn - Leave the value set to <true/>. Jamf School does not support per-app VPN, so this value runs the filter as a device-wide VPN tunnel with a content filter.

    Leave every other value unchanged.

    Default VendorConfig

  4. Save the file.

Note

The profile reports the owner of the device to Blocksi so that activity is attributed correctly. This requires the device to have an owner assigned in Jamf School. Devices without an owner, such as shared devices, receive a blanket filtering policy instead.

(Optional) Configuring the Blocksi Configuration Profile for Serial Number-Based Filtering

By default, the profile identifies devices by their owner. Configure the profile as described in this section when you want the filter to identify devices by serial number instead, such as on shared devices without an owner.

To configure the Blocksi configuration profile for serial number-based filtering:

  1. Download the Blocksi_Filter_JamfSchool.mobileconfig file.

  2. Open the downloaded .mobileconfig file using any text or code editor.

  3. In the VendorConfig dict, configure the following keys:

    • organizationId - Replace admin@blocksi.net with your Blocksi Organization ID.

    • adminPassword - Leave the default value, or replace it with a password of your choice. This password protects access to the app details in the Blocksi Filter app.

    • userId - Replace the key name with serialNumber, and replace the %Email% value with %SerialNumber%, so that the two lines read as follows:

      <key>serialNumber</key>
<string>%SerialNumber%</string>

    • snAnalytics - Leave the value unchanged. This key reports the serial number of the device for analytics only, and is separate from the serialNumber key used for serial number-based filtering.

    • useDhcpDns - Leave the value set to <true/>. The filter uses the DNS servers provided by your network and falls back to public DNS servers if none are available.

    • customPerAppVpn - Leave the value set to <true/>. Jamf School does not support per-app VPN, so this value runs the filter as a device-wide VPN tunnel with a content filter.

    Leave every other value unchanged.

    Important

    Enter %SerialNumber% exactly as shown, including both percent signs and the capitalization. Each MDM uses a different variable name, and Jamf School does not resolve the variable if the name does not match.

    Serial Number-Based VendorConfig

  4. Save the file.

(Optional) Configuring the Blocksi Configuration Profile for Custom DNS Servers

By default, the filter resolves DNS through the DNS servers that DHCP provides on your network. If DHCP does not provide DNS servers, or they do not respond, the filter falls back to built-in public DNS servers. Configure the profile as described in this section when you want the filter to use specific DNS servers instead. You can combine this configuration with the other optional configurations by editing the relevant keys in the same profile.

To configure the Blocksi configuration profile for custom DNS servers:

  1. Download the Blocksi_Filter_JamfSchool.mobileconfig file.

  2. Open the downloaded .mobileconfig file using any text or code editor.

  3. In the VendorConfig dict, configure the following keys:

    • organizationId - Replace admin@blocksi.net with your Blocksi Organization ID.

    • adminPassword - Leave the default value, or replace it with a password of your choice. This password protects access to the app details in the Blocksi Filter app.

    • userId - Leave the value set to %Email%. Jamf School replaces this variable with the email address of the device owner.

    • snAnalytics - Leave the value unchanged. This key reports the serial number of the device for analytics only, and is separate from the serialNumber key used for serial number-based filtering.

    • useDhcpDns - Leave the value set to <true/>.

    • dnsServers - Add the dnsServers key after the useDhcpDns key and enter your DNS server addresses as an array, in priority order, as shown in the following example. These servers are used instead of the DHCP DNS servers.

      <key>dnsServers</key>
<array>
   <string>10.0.0.53:5353</string>
   <string>[2001:db8::1]:5353</string>
</array>

    • customPerAppVpn - Leave the value set to <true/>. Jamf School does not support per-app VPN, so this value runs the filter as a device-wide VPN tunnel with a content filter.

    Leave every other value unchanged.

    Note

    Each dnsServers entry is an IPv4 or IPv6 address and can include a port. Enclose IPv6 addresses in square brackets when you add a port, as shown in the example.

    Custom DNS Servers VendorConfig

  4. Save the file.

(Optional) Configuring the Blocksi Configuration Profile for Captive Portal Detection

Configure the profile as described in this section when your network uses the captive portal of the Blocksi Appliance. Captive portal detection works only with the Blocksi Appliance, not with captive portals from other providers. When captive portal detection is turned on, the filter detects the Blocksi Appliance captive portal on the network and hands off DNS resolution to the Blocksi DNS-over-HTTPS (DoH) service. You can combine this configuration with the other optional configurations by editing the relevant keys in the same profile.

To configure the Blocksi configuration profile for captive portal detection:

  1. Download the Blocksi_Filter_JamfSchool.mobileconfig file.

  2. Open the downloaded .mobileconfig file using any text or code editor.

  3. In the VendorConfig dict, configure the following keys:

    • organizationId - Replace admin@blocksi.net with your Blocksi Organization ID.

    • adminPassword - Leave the default value, or replace it with a password of your choice. This password protects access to the app details in the Blocksi Filter app.

    • userId - Leave the value set to %Email%. Jamf School replaces this variable with the email address of the device owner.

    • snAnalytics - Leave the value unchanged. This key reports the serial number of the device for analytics only, and is separate from the serialNumber key used for serial number-based filtering.

    • useDhcpDns - Leave the value set to <true/>. The filter uses the DNS servers provided by your network and falls back to public DNS servers if none are available.

    • customPerAppVpn - Leave the value set to <true/>. Jamf School does not support per-app VPN, so this value runs the filter as a device-wide VPN tunnel with a content filter.

    Leave every other value unchanged.

  4. Add the following lines after the customPerAppVpn key:

    <key>capPortalEnabled</key><true/>
<key>capPortalHost</key>
<string>capportal.blocksi.net</string>
<key>capPortalPort</key>
<integer>81</integer>
<key>capPortalDohUrl</key>
<string>https://capportal.blocksi.net/dns-query/normaldns</string>

    Enter the lines as shown. The capPortalDohUrl value is the recommended server URL for Blocksi Filter. Refer to theChoosing a Server URLsection.

    Captive Portal VendorConfig

  5. Save the file.

Uploading the Configuration Profile to Jamf School
To upload the Blocksi configuration profile to Jamf School:

  1. In Jamf School, navigate to Profiles > Overview.

  2. Click + Create Profile. In the Create Profile window, complete the following pages:

    • Platform - Select Upload custom profile, then click the Profile file (.mobileconfig) box and select the .mobileconfig file that you configured, then click Next. Refer to the Configuring the Blocksi Configuration Profile section.

      Create Profile Platform Tab

    • Details - Enter a name for the profile in the Profile name text box (e.g., Blocksi Filter Configuration Profile) and click Next. Entering a description is optional but recommended.

      Create Profile Details Tab

    • Time filter - Leave unchecked.

  3. Click Finish. The profile opens with the General payload selected.

    Blocksi Filter Configuration Profile General Payload

  4. Under This profile will be distributed to the following device groups, click the plus button and select the same device group as the Blocksi Filter app.

    Blocksi Filter Configuration Profile Distribution Section

  5. Click Save.

Note

On supervised devices, the certificate is trusted automatically, so it does not need to be enabled manually under Settings > General > About > Certificate Trust Settings.

Validating the Deployment

To validate the deployment, verify that the app and profile are installed on the target device and that filtering is working correctly.

To check whether the app and profile are installed:

  • Open Settings on the target device and navigate to General > VPN, DNS & Device Management. The Blocksi configuration profile should be listed.

    VPN, DNS & Device Management
To check whether filtering is working:

  1. Open Safari on the target device and navigate to a site that your policy allows. The site loads normally.

  2. Navigate to some sites that should be blocked by your policy.

  3. Verify that the Blocksi block page appears, with no certificate warning.

    Blocksi Access Denied Page

  4. Repeat both checks in another browser on the device, such as Google Chrome.

To check whether Jamf School reports the profile as installed:

  1. In Jamf School, navigate to Devices.

  2. Select the target device, then open its Profiles section. The Blocksi configuration profile should be listed as installed.

To check whether the VPN is connected:

  • Open Settings on the target device and navigate to VPN > Blocksi Filter. The VPN shows a status of Connected.

    VPN Settings
To check whether the content filter is running:

  • Open Settings on the target device and navigate to General > VPN & Device Management > Content Filter. The content filter shows Blocksi with a status of Running.

    Content Filter Running Status

Important

If the deployment does not behave as expected, refer to the Troubleshooting article.