Sorry, I am not sure if there is an "always on" knob on the client. I don't know the details, but some versions of iOS have a feature called per-App VPN, that might get you close to what you want. Look for the text "OnDemandMatchAppEnabled" on this page https://developer.apple.com/library/ios/featuredarticles/iPh... .