Company-issued devices and corporate proxies

If your laptop, desktop, or phone came from your employer, school, or another organization, it is probably managed by an IT department. Managed devices carry security and policy controls that can interfere with VPNs in ways you cannot see from the outside.

Caution

If your device is managed by your employer, installing or using a VPN outside approved software may breach your organization’s acceptable use policy. Check with your IT department before going further.

Signs your device is managed

• Apps arrive already installed, pushed through something like Microsoft Intune, Jamf, or Workspace ONE, or your browser settings show a “managed by your organization” notice.
• Some system settings are greyed out, often with a tooltip saying the setting is managed by your organization.
• You had to enrol the device with a corporate account before you could use it.
• There is a certificate from your company in the system trust store.

How managed devices interfere with VPNs

1. Corporate proxy and TLS inspection

Many organizations route outbound traffic through a proxy that decrypts HTTPS, inspects it, and re-encrypts it with the company’s own certificate. This is usually called TLS interception or SSL inspection.

Your browser accepts it without complaint, because the company certificate was installed in the trust store precisely so that it would. A VPN generally will not, since verifying that it is talking to the genuine server, and not to something in the middle, is a core part of what it does. When interception is in play, the connection fails rather than silently continuing through the inspecting proxy, which is the correct outcome even though it is inconvenient.

How to check, on Windows or macOS:

1. Open your browser and visit https://workingvpn.com/.
2. Click the padlock in the address bar and view the certificate.
3. Look at the issuer. If it names your company rather than a public certificate authority, TLS inspection is switched on.

Where inspection is in force, the browser extension is the more likely of the two to work, though a sufficiently strict proxy will stop that as well. Standalone desktop apps are unlikely to connect at all.

2. Device profiles that restrict network configuration

Mobile device management profiles can:

• Force all traffic through a specific corporate VPN
• Prevent other VPN clients from being installed
• Block particular domains or address ranges
• Require particular DNS servers

Any of these can block WorkingVPN with no visible explanation, and none of them can be turned off from your side. Only IT can change them.

3. Endpoint detection and response agents

Security agents such as CrowdStrike, SentinelOne, Cortex XDR, and Microsoft Defender for Endpoint can:

• Treat VPN clients as unwanted software and quarantine them
• Stop a process from creating a network tunnel
• Notify IT when they see VPN activity that was not sanctioned

If your device runs one of these and the VPN stopped working from one day to the next, check whether the app is still installed at all.

What you can check yourself

These are all read-only checks, safe to run on a managed device:

1. Look at the certificate, as described above. It tells you whether TLS inspection is on.
2. Compare the extension against the app. If the browser extension works and the desktop app does not, something on the device is blocking the app specifically. If neither works, suspect TLS inspection or an outbound firewall.
3. Change the network, keep the device. Tether from your phone or try another network. If WorkingVPN then works, the corporate network was the obstacle rather than the device.
4. Change the device, keep the network. Try WorkingVPN on a personal phone on the same corporate network. If it works there, the device is the obstacle rather than the network.

Together, checks 3 and 4 isolate the cause. That is worth doing before contacting anyone, because it turns “the VPN doesn’t work” into a specific question.

What to tell IT

If the device is the obstacle and you need WorkingVPN for a legitimate reason, ask your IT team rather than working around them. Tell them:

• What you are trying to do and why
• Which device is affected
• What the checks above showed

Getting around IT controls on a managed device is usually a policy violation in itself, and often raises an automated alert. It is rarely worth it.

If you can’t use WorkingVPN on your work device

Use a personal device for personal browsing. Keeping work and personal traffic apart is better practice regardless.