Download the "Apple Mobile Config" (
.mobileconfig) file for each user on the desired device, or download and send it to them over AirDrop or other secure means. Apple Configuration Profiles are all-in-one configuration files for iOS and macOS devices.
On iOS, after downloading the profile or recieving it via AirDrop, users will be prompted to to open the Settings app, tap the "Profile Downloaded" item, and enter their passcode to install the VPN profile.
Connect to your VPN by opening Settings and tapping the VPN toggle. To remove or configure your VPN profile, open Settings, tap General, then scroll down and tap VPN. If using WireGuard you can also enable the VPN from the WireGuard app.
If you enabled "Connect On Demand" the VPN will connect automatically whenever it is able. Most Apple users will want "Connect On Demand", but while it is enabled then simply turning off the VPN will not cause it to stay disabled; it will just "Connect On Demand" again. To completely turn off the VPN you'll need to disable "Connect On Demand".
On iOS, you can turn off "Connect On Demand" in Settings by clicking the next to the entry for your TunnelHero VPN and toggling off "Connect On Demand."
If you're behind a restrictive firewall or require the additional security of the WireGuard protocol, you'll need to first install the WireGuard app from the iOS store.
Once installed, WireGuard VPN profiles can be managed much like native IPsec profiles through the default Settings app, or through the WireGuard app.