Skip to main content

Admin Dashboard

Blocksi Filter - Jamf Pro iOS Configuration Guide

The following contains procedures for deploying Blocksi Filter (full URL + granular YouTube filtering solution) through Jamf Pro.

Jamf Pro delivers three components to each device:

  1. Blocksi Filter app - The filter itself.

  2. Blocksi certificate profile - Allows the filter to protect web traffic on the device.

  3. Per-app VPN profile - Turns on filtering for the built-in Safari browser and provides the connection that managed apps are attached to.

Prerequisites

Ensure the following prerequisites are in place before proceeding with deployment:

  • Administrator access to Jamf Pro 10.x or later.

  • Your Blocksi Super-Admin account email address.

  • Send your Organization ID and organization name to Blocksi Support to authorize your district's use of the Blocksi Filter app. Refer to the Getting Your Organization ID and Name section for more information.

  • Ensure that Custom Apps and the Volume Purchase Program (VPP) are fully enabled and configured. Refer to the Configuring Volume Purchasing section for more information.

  • Supervised iPads or iPhones running iOS 16 or later are enrolled in Jamf Pro through Apple School Manager or Apple Business Manager. A smart or static mobile device group exists that contains the target devices.

  • A filtering policy must be created and configured on the Blocksi Admin Dashboard.

  • The Blocksi Filter app is assigned to the location that your MDM uses in Apple School Manager or Apple Business Manager, and has synced into Jamf Pro.

Getting Your Organization ID and Name
To get your organization ID and name:

  1. Sign in to your Apple School Manager account with your Administrator credentials.

  2. Click your account name in the lower left-hand corner, and then click Preferences from the pop-up menu.

  3. Go to Organization Information.

  4. Locate your Organization ID and Organization Name.

  5. Send this information to Blocksi. It is required to add your organization to the approved list of customers who can use Blocksi's filtering app.

Configuring Volume Purchasing
To download the service token:

  1. Sign in to your company's account at business.apple.com (Apple Business Manager) or school.apple.com (Apple School Manager).

  2. Click your account name in the top right corner, then click Settings from the drop-down menu.

  3. Click Payments and Billing.

  4. Under the Apps and Books tab, scroll to the Content Tokens section and click Download next to the correct server location token. The token is downloaded to the Downloads folder on your computer.

Uploading the Service Token
To upload the service token:

  1. In Jamf Pro, navigate to Settings > Global > Volume purchasing. The Volume purchasing page opens.

    Volume Purchasing Page

  2. Click New and enter a name for the location in the Display Name text box.

    Upload New VPP Token

  3. Click Upload Service Token and select the .vpptoken file that you downloaded.

    Tip

    To register users who have Managed Apple IDs without prompting them, select Automatically register with volume purchasing if users have Managed Apple IDs.

  4. Click Save.

Configuring the Blocksi Filter App in Jamf Pro
To configure the Blocksi Filter app:

  1. In Jamf Pro, navigate to Devices > Content management > Mobile device apps. The Mobile device apps page opens.

    Mobile Device Apps Page

  2. Click + New, select App Store app or apps purchased in volume under Choose an App Type, then click Next.

    New Mobile Device App Page

  3. Enter blocksi in the Search box, select your country or region from the App Store Country or Region drop-down list, then click Next.

    Search or Upload Tab

  4. Click the Apps Purchased in Volume tab, locate Blocksi Filter in the row for your volume purchasing location, and click Add. The New Mobile Device App page opens on the General tab.

    Note

    If Blocksi Filter is listed more than once, select the row whose Location matches the location you created in the Uploading the Service Token section.

    Add App Tab

  5. Confirm the following:

    • Display Name - Blocksi Filter.

    • Bundle Identifier - com.blocksi.filter.

    • Enabled - Selected.

    • Free - Selected.

    New Mobile Device App Page

  6. Configure the following:

    • Distribution Method - Select Install Automatically/Prompt Users to Install.

    • Make app managed when possible - Select the checkbox, then select Convert unmanaged app to managed and Remove app when MDM profile is removed beneath it.

    • Allow users to remove app (iOS 14 or later) - Make sure the checkbox is cleared.

    New Mobile Device App Page

  7. Click the Scope tab, click + Add under Selected Deployment Targets, and select your target devices.

    Note

    Note which devices you scope here. The Blocksi certificate profile and the per-app VPN profile must be scoped to the same devices.

  8. Click the Managed distribution tab, select Assign Content Purchased in Volume, then select your volume purchasing location from the Location drop-down list.

    Managed Distribution Tab

  9. Click Save.

Uploading the Blocksi Certificate Profile

Download URLs

The relevant .mobileconfig file can be downloaded using the following link:

To upload the Blocksi certificate profile to Jamf Pro:

  1. In Jamf Pro, navigate to Devices > Content management > Configuration profiles. The Configuration profiles page opens.

    Configuration Profiles Page

  2. Click Upload and select the Blocksi_Filter_CA.mobileconfig file that you downloaded.

    Note

    The Display Name is filled in automatically as Blocksi Certificate. You can rename it if needed.

    Upload Mobile Device Configuration Profile
    New Mobile Device Configuration Profile Page

  3. Click the Scope tab and select the same devices you scoped for the Blocksi Filter app.

  4. Click Save.

Note

On supervised devices, the certificate is trusted automatically, so it does not need to be enabled manually under Settings > General > About > Certificate Trust Settings.

Configuring Content Filtering

The per-app VPN profile is the working filtering configuration. It turns on filtering for the built-in Safari browser and creates a VPN connection named Blocksi Filter that managed apps are attached to. Upload the file to Jamf Pro, then configure it with your Organization ID. For custom DNS servers or captive portal detection, you also edit the file before you upload it.

Configuring the Per-App VPN Profile

Download URLs

The relevant .mobileconfig file can be downloaded using the following link:

To configure the per-app VPN profile for user-based and blanket filtering:

  1. Download the Blocksi_Filter_JamfPro.mobileconfig file.

  2. In Jamf Pro, navigate to Devices > Content management > Configuration profiles. The Configuration profiles page opens.

    Configuration Profiles Page

  3. Click Upload and select the Blocksi_Filter_JamfPro.mobileconfig file that you downloaded. The New Mobile Device Configuration Profile page opens on the General tab.

    Note

    The Display Name is filled in automatically as Blocksi Web Filter (Jamf Pro custom). You can rename it if needed.

    Upload Mobile Device Configuration Profile
    New Mobile Device Configuration Profile Page

  4. Click VPN in the left sidebar. The VPN page opens.

    VPN Page

  5. Scroll down to the Custom Data section and configure the following keys:

    • organizationId - Replace admin@blocksi.net with your Blocksi Organization ID.

    • adminPassword - Leave the default value, or replace it with a password of your choice. This password protects access to the app details in the Blocksi Filter app.

    • userId - Leave the value set to $EMAIL. Jamf Pro replaces this variable with the email address of the assigned user.

    • snAnalytics - Leave the value unchanged. This key reports the serial number of the device for analytics only, and is separate from the serialNumber key used for serial number-based filtering.

    • useDhcpDns - Leave the value set to true. The filter uses the DNS servers provided by your network and falls back to public DNS servers if none are available.

    Leave every other value unchanged.

    Custom Data Section

  6. Click the Scope tab and select the same devices you scoped for the Blocksi Filter app.

  7. Click Save.

Note

The profile reports the assigned user of the device to Blocksi so that activity is attributed correctly. This requires the device to have a user assigned in Jamf Pro. Devices without an assigned user, such as shared devices, receive a blanket filtering policy instead.

(Optional) Configuring the Per-App VPN Profile for Serial Number-Based Filtering

By default, the profile identifies devices by their assigned user. Configure the profile as described in this section when you want the filter to identify devices by serial number instead, such as on shared devices without an assigned user.

To configure the per-app VPN profile for serial number-based filtering:

  1. Download the Blocksi_Filter_JamfPro.mobileconfig file.

  2. In Jamf Pro, navigate to Devices > Content management > Configuration profiles. The Configuration profiles page opens.

    Configuration Profiles Page

  3. Click Upload and select the Blocksi_Filter_JamfPro.mobileconfig file that you downloaded. The New Mobile Device Configuration Profile page opens on the General tab.

    Upload Mobile Device Configuration Profile
    New Mobile Device Configuration Profile Page

  4. Click VPN in the left sidebar. The VPN page opens.

    VPN Page

  5. Scroll down to the Custom Data section and configure the following keys:

    • organizationId - Replace admin@blocksi.net with your Blocksi Organization ID.

    • adminPassword - Leave the default value, or replace it with a password of your choice. This password protects access to the app details in the Blocksi Filter app.

    • userId - Replace the key name with serialNumber, and replace the $EMAIL value with $SERIALNUMBER.

    • snAnalytics - Leave the value unchanged. This key reports the serial number of the device for analytics only, and is separate from the serialNumber key used for serial number-based filtering.

    • useDhcpDns - Leave the value set to true. The filter uses the DNS servers provided by your network and falls back to public DNS servers if none are available.

    Leave every other value unchanged.

    Important

    Enter $SERIALNUMBER exactly as shown, including the dollar sign and in upper case. Each MDM uses a different variable name, and Jamf Pro does not resolve the variable if the name does not match.

    Serial Number-Based Custom Data Section

  6. Click the Scope tab and select the same devices you scoped for the Blocksi Filter app.

  7. Click Save.

(Optional) Configuring the Per-App VPN Profile for Custom DNS Servers

By default, the filter resolves DNS through the DNS servers that DHCP provides on your network. If DHCP does not provide DNS servers, or they do not respond, the filter falls back to built-in public DNS servers. Configure the profile as described in this section when you want the filter to use specific DNS servers instead. You can combine this configuration with the other optional configurations by editing the relevant keys in the same profile.

To configure the per-app VPN profile for custom DNS servers:

  1. Download the Blocksi_Filter_JamfPro.mobileconfig file.

  2. Open the downloaded .mobileconfig file using any text or code editor.

  3. Add the dnsServers key after the useDhcpDns key and enter your DNS server addresses as an array, in priority order, as shown in the following example. These servers are used instead of the DHCP DNS servers.

    <key>dnsServers</key>
<array>
   <string>10.0.0.53:5353</string>
   <string>[2001:db8::1]:5353</string>
</array>

    Note

    Each dnsServers entry is an IPv4 or IPv6 address and can include a port. Enclose IPv6 addresses in square brackets when you add a port, as shown in the example.

    Custom DNS Servers VendorConfig

  4. Save the file.

  5. In Jamf Pro, navigate to Devices > Content management > Configuration profiles. The Configuration profiles page opens.

    Configuration Profiles Page

  6. Click Upload and select the Blocksi_Filter_JamfPro.mobileconfig file that you edited. The New Mobile Device Configuration Profile page opens on the General tab.

    Upload Mobile Device Configuration Profile
    New Mobile Device Configuration Profile Page

  7. Click VPN in the left sidebar. The VPN page opens.

    VPN Page

  8. Scroll down to the Custom Data section and configure the following keys:

    • organizationId - Replace admin@blocksi.net with your Blocksi Organization ID.

    • adminPassword - Leave the default value, or replace it with a password of your choice. This password protects access to the app details in the Blocksi Filter app.

    • userId - Leave the value set to $EMAIL. Jamf Pro replaces this variable with the email address of the assigned user.

    • snAnalytics - Leave the value unchanged. This key reports the serial number of the device for analytics only, and is separate from the serialNumber key used for serial number-based filtering.

    • useDhcpDns - Leave the value set to true. The filter uses the DNS servers provided by your network and falls back to public DNS servers if none are available.

    • dnsServers - Make sure the value lists the DNS servers that you added to the file.

    Leave every other value unchanged.

    Custom DNS Servers Custom Data Section

  9. Click the Scope tab and select the same devices you scoped for the Blocksi Filter app.

  10. Click Save.

(Optional) Configuring the Per-App VPN Profile for Captive Portal Detection

Configure the profile as described in this section when your network uses the captive portal of the Blocksi Appliance. Captive portal detection works only with the Blocksi Appliance, not with captive portals from other providers. When captive portal detection is turned on, the filter detects the Blocksi Appliance captive portal on the network and hands off DNS resolution to the Blocksi DNS-over-HTTPS (DoH) service. You can combine this configuration with the other optional configurations by editing the relevant keys in the same profile.

To configure the per-app VPN profile for captive portal detection:

  1. Download the Blocksi_Filter_JamfPro.mobileconfig file.

  2. Open the downloaded .mobileconfig file using any text or code editor.

  3. Add the following lines after the useDhcpDns key:

    <key>capPortalEnabled</key><true/>
<key>capPortalHost</key>
<string>capportal.blocksi.net</string>
<key>capPortalPort</key>
<integer>81</integer>
<key>capPortalDohUrl</key>
<string>https://capportal.blocksi.net/dns-query/normaldns</string>

    Enter the lines as shown. The capPortalDohUrl value is the recommended server URL for Blocksi Filter. Refer to the Choosing a Server URL section.

    Captive Portal VendorConfig

  4. Save the file.

  5. In Jamf Pro, navigate to Devices > Content management > Configuration profiles. The Configuration profiles page opens.

    Configuration Profiles Page

  6. Click Upload and select the Blocksi_Filter_JamfPro.mobileconfig file that you edited. The New Mobile Device Configuration Profile page opens on the General tab.

    Upload Mobile Device Configuration Profile
    New Mobile Device Configuration Profile Page

  7. Click VPN in the left sidebar. The VPN page opens.

    VPN Page

  8. Scroll down to the Custom Data section and configure the following keys:

    • organizationId - Replace admin@blocksi.net with your Blocksi Organization ID.

    • adminPassword - Leave the default value, or replace it with a password of your choice. This password protects access to the app details in the Blocksi Filter app.

    • userId - Leave the value set to $EMAIL. Jamf Pro replaces this variable with the email address of the assigned user.

    • snAnalytics - Leave the value unchanged. This key reports the serial number of the device for analytics only, and is separate from the serialNumber key used for serial number-based filtering.

    • useDhcpDns - Leave the value set to true. The filter uses the DNS servers provided by your network and falls back to public DNS servers if none are available.

    Leave every other value unchanged.

    Captive Portal Custom Data Section

  9. Click the Scope tab and select the same devices you scoped for the Blocksi Filter app.

  10. Click Save.

Configuring Managed Apps for Filtering

Safari is covered by the per-app VPN profile and needs nothing further. Other browsers are filtered only if they are installed as managed apps through Jamf Pro and attached to the Blocksi Filter connection. Repeat the relevant procedure for each browser that you want filtered.

Important

The Blocksi Filter connection appears in the Per-App VPN drop-down list only after the per-app VPN profile has been uploaded and scoped to the same devices as the app.

Attaching the VPN to an Installed Managed App

If the browser is already deployed and managed by Jamf Pro, you do not need to add it again. Attach it to the Blocksi Filter connection instead.

To attach the Blocksi Filter connection to an already installed managed app:

  1. In Jamf Pro, navigate to Devices > Content management > Mobile device apps. The Mobile device apps page opens.

    Mobile Device Apps Page

  2. Click the browser, then click Edit in the bottom right corner.

    Managed Mobile Device App Page

  3. On the General tab, scroll down to the Per-App Networking section and select Blocksi Filter from the Per-App VPN drop-down list.

    Per-App Networking Section

  4. Click Save.

Adding a Managed App and Attaching the VPN

Before you begin, assign the browser to your volume purchasing location in Apple School Manager or Apple Business Manager.

To add a managed app and attach the Blocksi Filter connection:

  1. In Jamf Pro, navigate to Devices > Content management > Mobile device apps. The Mobile device apps page opens.

    Mobile Device Apps Page

  2. Click + New, select App Store app or apps purchased in volume under Choose an App Type, then click Next.

    New Mobile Device App Page

  3. Enter the name of the browser in the Search box, select your country or region from the App Store Country or Region drop-down list, then click Next.

    Search or Upload Tab

  4. Click the Apps Purchased in Volume tab, locate the browser in the row for your volume purchasing location, and click Add. The New Mobile Device App page opens on the General tab.

    Add App Tab

  5. Confirm the following:

    • Display Name - The name of the browser (e.g., Google Chrome).

    • Enabled - Selected.

    • Free - Selected.

    New Mobile Device App Page

  6. Configure the following:

    • Distribution Method - Select Install Automatically/Prompt Users to Install.

    • Make app managed when possible - Select the checkbox, then select Convert unmanaged app to managed and Remove app when MDM profile is removed beneath it.

    • Allow users to remove app (iOS 14 or later) - Make sure the checkbox is cleared.

    • Per-App VPN - Select Blocksi Filter.

    New Mobile Device App Page
    Per-App Networking Section

  7. Click the Scope tab, click + Add under Selected Deployment Targets, and select the same devices you scoped for the Blocksi Filter app.

  8. Click the Managed distribution tab, select Assign Content Purchased in Volume, then select your volume purchasing location from the Location drop-down list.

    Managed Distribution Tab

  9. Click Save.

Validating the Deployment

To validate the deployment, verify that the app and profiles are installed on the target device and that filtering is working correctly.

To check whether the app and profiles are installed:

  • Open Settings on the target device and navigate to General > VPN & Device Management. The Blocksi certificate profile and the per-app VPN profile should both be listed.

    VPN & Device Management
To check whether filtering is working:

  1. Open Safari on the target device and navigate to a site that your policy allows. The site loads normally.

  2. Navigate to some sites that should be blocked by your policy.

  3. Verify that the Blocksi block page appears, with no certificate warning.

  4. Repeat both checks in each managed browser that you attached to the Blocksi Filter connection.

    Blocksi Access Denied Page
To check whether Jamf Pro reports the profiles as installed:

  1. In Jamf Pro, click Search Inventory from the main menu and select the target device.

  2. Click the Configuration Profiles tab, then click the Apps tab. Both Blocksi profiles should be listed, and Blocksi Filter should show as Installed and Managed.

To check whether the VPN is connected:

  1. Open Safari on the target device so that the filter activates.

  2. Open Settings on the target device and navigate to VPN > Blocksi Filter. The VPN shows a status of Connected.

    VPN Settings
    Blocksi Filter Settings
To check whether the app reports the organization and user:

  1. Open Safari on the target device so that the filter activates.

  2. Open the Blocksi Filter app. The app should report your organization and the assigned user. Until the filter activates, the app may report that no organization is configured.

Important

If the deployment does not behave as expected, refer to the Troubleshooting article.