White-Label VPN for Campuses

eduroam is how a lot of campuses let a visiting researcher join Wi-Fi without a guest form. Local 802.1X is the same idea with a campus-only SSID. You authenticate. The controller lets you on. That is layer two and a RADIUS conversation. It is not a tunnel to an exit node. It does not change the IP the journal publisher sees. It does not encrypt your path across a coffee shop in another city.

A VPN wraps packets and sends them to an endpoint you chose. After that hop, the destination sees the VPN exit, not the dorm NAT. That is useful when a student is on a hotel SSID, on cellular, or on a conference network that is hostile in the boring way (captive portals, broken IPv6, nosy middleboxes). It is not useful as a replacement for joining the campus SSID. If you cannot join Wi-Fi, you cannot start the tunnel unless you already have another path.

I keep seeing procurement language that says deploy campus VPN / eduroam as if the slash meant equals. It does not. Train the help desk on two sentences. Sentence one: eduroam or the campus SSID gets you on the air. Sentence two: the branded VPN app is optional, for when you want a campus-named tunnel off-net or a stable egress for a publisher allowlist. If you merge those sentences, every failed RADIUS ticket becomes a VPN ticket. You do not have the staff for that in week one.

NordVPN's consumer homepage will still tell a traveler to hide on public Wi-Fi. Do not paste that onto a student portal. You are the network in a lot of those sentences. Insulting the house SSID in the house voice is how legal kills the project. Pitch a quieter path off-campus, a staff tool for travel, a way to present a known egress to a vendor. Do not pitch we hide you from ITS.

ITS usually owns the network and the identity provider. Student affairs sometimes owns the 'digital campus' story and the app store listing in the student-life bundle. The library owns publisher contracts. Legal owns student-data language. Procurement owns the PDF. If you sell to student affairs only, ITS will veto the client defaults. If you sell to ITS only, student affairs will ship a poster that promises anonymity. Get them in the same room in meeting two.

The From Enterprise Inquiry to a White-Label VPN article is the packet shape: controller, store accounts, support hours, dedicated IP. Use it. A campus that emails we're interested will get a polite stall. A campus that names the IdP, the store publisher, and who revokes graduates will get a real conversation. I would rather lose a fuzzy RFP than win a fuzzy RFP.

Budget is rarely the consumer $2.83/month number. Sometimes the university pays as a site license. Sometimes students opt in. Sometimes a college inside the university pays for staff travel only. Write who pays. If who pays is TBD, the bursar will guess, and guesses become refund theater in October.

White-label is the right shape when the home screen should match the ID card. The White-Label VPN and Explained is the model: your brand, platform underneath. This page assumes you picked that model because a reseller icon on a residence-hall flyer teaches students to shop the university. Most campuses will not accept that.

Two audiences, two defaults, same binary if you must. Staff: travel, hotel portals, maybe a publisher allowlist, maybe always-on on university-owned laptops. Students: optional, lighter, no fail-closed on move-in SSIDs, term-scoped accounts. If you ship one default to both, staff will complain the tunnel is timid and students will complain they cannot complete eduroam. You will be right that it is the same protocol. You will still be wrong as an operator.

Store listings are homework. Apple entitlements and Play VPN declarations are their own articles. A campus that already has a student app will want to stuff the tunnel into that binary. Stuffing often dies in review. A small branded VPN app plus a deep link from the campus app is usually faster. Confirm the store plan before you promise one icon to the board. I have watched a September launch slip because someone assumed Network Extension was a checkbox in week three.

A freshman shows up with a phone, a laptop, a tablet, maybe a second phone, maybe a console. Klox consumer is five devices. That number is a household SKU, not a dorm census. If you copy it onto a campus amenity without saying so, you will spend move-in weekend on cap tickets. Confirm device caps with sales. If the campus SKU is five, print five. If it is seats that ITS assigns, print that. Caps discovered at 1am are tickets with an audience in the hallway.

University-owned endpoints are easier: image the client, pin the profile, revoke with the asset tag. BYOD is a consent and a mess. You will not MDM every personal phone. Do not pretend. Offer the branded app, a short how-to, and a device list the student can see. If a roommate's laptop is still in the slot after a breakup, the student needs a self-serve kick, not a 48-hour ITS ticket.

IPv6 on residence hall Wi-Fi will leak around a sloppy client. We have a consumer leak article. Do not promise the campus build is leak-proof because a blog said so. Test the real SSID. Test dual-stack. If ITS disabled IPv6, say that in the FAQ so you do not debug a ghost.

Dorm desk owns: cannot join Wi-Fi, forgot eduroam password, captive portal on a conference SSID they brought home in their head. ITS owns: identity, revoke, campus SSIDs, whether the VPN is in scope for a given role. Vendor / platform owns: handshake failures, client defects, node-side incidents. Shared: 'the LMS is slow' and 'the journal blocked me.' Shared is a fight unless you timebox it.

The student should not see three teams. They see the campus name. Escalation is back-office. If you SMS a platform name, you taught them to shop the university. White-label means the campus owns the relationship. If that scares ITS, they wanted a consumer QR to someone else's app. That is reseller energy. Most campuses will not put that on a residence-hall poster.

Write the split in the SOW. Cap categories. Review tickets per 1,000 enrolled, not per 1,000 consumer subs. The VPN Support Load: Tickets Per 1,000 Users article is consumer ticket math. Do not clone it. Campus mix is identity, device caps, hotel-portal fights on spring break, and a thin tail of real handshakes. If handshake is the bulk, your SSID or your client default is sick. Fix the house network before you buy more nodes.

After-hours is the honest line. If ITS is not on a night rotation, the script is: Wi-Fi first, then disable the tunnel, then a callback at 8am. Lying about a 24/7 engineering desk you do not have will be discovered once during midterms and remembered in the faculty Slack forever.

I will say this as clearly as I can. Putting a campus name on a tunnel does not make the university FERPA-compliant. It does not make a student health app HIPAA-compliant. It does not replace access control on the SIS. A VPN can encrypt a path and mask an IP behind an exit. Counsel still owns record-handling, BAAs, and what you print in an RFP.

The failure mode is a slide that says encrypted therefore FERPA. A journalist, an auditor, or a faculty member who actually reads will ask who the controller is, where student emails live, and what the admin panel shows. If you cannot answer, you do not have a compliance story. You have a tunnel. Sell the tunnel. Send the questionnaire to counsel and to the platform for the parts only the platform can verify.

Health-adjacent campuses will want a HIPAA sentence. Do not write one from this blog. A counseling-center laptop on a cafe SSID may benefit from a tunnel. That is a path control. It is not a designation. Inventing HIPAA coverage is how you get a worse year than the one where you said we encrypt the path and stopped talking.

Full tunnel is simpler to explain and harder to live with on a campus SSID. Printing, casting, internal-only services, and some lab tools expect to see the campus network. A full tunnel can send that traffic out the exit and back, or drop it. Students will call that the VPN broke Wi-Fi. Staff will call it the VPN broke the copier. Both are your problem if you defaulted full tunnel without a map.

Split tunnel is the adult default for a lot of campus builds: LMS, email, and chosen SaaS through the tunnel, or the reverse — only off-net traffic through the tunnel. There is no universal right list. There is a list ITS wrote and tested. If you do not have that list, you do not have a split. You have a hope.

Kill-switch copy on a campus client needs the same humility as a hotel amenity. Fail-closed plus a captive portal on a conference Wi-Fi is a ticket. The kill-switch naming article is the branded-app version. This page is the campus version: defaults that survive move-in and a faculty trip.

I like credentials that die when the campus ID dies. Graduation. Withdrawal. Staff termination. A tunnel that outlives the person is a hole with a crest on it. Bind seats to the IdP. Revoke on the same event that kills email. If that event is flaky, time-box the session to the term and accept that early leavers need an ITS reset. Pick the failure you can staff.

Permanent consumer-style emails for a one-semester guest lecturer become a privacy pile. Prefer campus ID. If the store requires an Apple ID, that is the store, not your SIS. Do not harvest a Gmail to 'simplify' and then build a marketing list. That is how legal has a bad quarter.

Guests are not students. Conference attendees on campus Wi-Fi do not need your branded VPN unless you have a reason and an expiry. Reasons I believe: a known publisher egress for a workshop that lasts three days. Reasons I do not believe: everyone should have a tunnel. Everyone is how you never revoke.

Some journals and some library vendors still allow by IP. A shared VPN exit that twenty campuses use will get blocked, or it will never be listed. A dedicated IP, if your package includes it, is a sales tool: here is the egress we will register. It is not anonymity. It is the opposite. Say that out loud so a privacy working group does not hear dedicated and think invisible.

The White-Label VPN and Dedicated Ip Sla article is the general channel version. Here the buyer is the library plus ITS. Who requests the allowlist change. Who notices when the vendor rotates their ACL and the dedicated IP still works but the content does not. Who pays if you need a second IP because one publisher is allergic to the first. Write it.

I will not print an SLA percentage. I will not invent a city. Assignment details are confirm-with-sales. If a publisher wants a /32 in a specific country, that is a packet, not a blog claim.

RFPs will ask for SOC 2, ISO numbers, HIPAA, FERPA 'certification,' penetration-test dates, and a 99.something. I will not put those stamps on this page for Klox. You should not invent them for a campus brand either. Answer what you can verify. Forward what only the platform can verify. Guessing is a three-year lie with letterhead.

The questionnaire should separate: campus as controller for student accounts; platform as operator of nodes; store publishers; subprocessors for email and cards if you take cards. If students never pay, say that. If they pay, the Billing a White-Label VPN: Cards, Tax, and Failed Payments article is the general wound. Campus bursar versus in-app cards is a choice that changes refunds. The consumer 7-day money-back is the wrong policy on a tuition-funded seat. Confirm reversals in the package.

Start with one college, one staff travel group, or one library allowlist. Prove tickets per 1,000. Then expand. Heroic all-campus rollouts in August are how you get a Slack channel named vpn-fire while the residential network is already on fire.

Do not promise anonymity. Cameras, ID cards, and the SIS still exist. Do not promise FERPA or HIPAA. Do not promise the VPN makes campus Wi-Fi fast. Do not promise every journal. Do not promise a kill switch that never breaks a hotel portal. Do not promise five devices if the campus SKU is different. Confirm with sales.

Do not promise WireGuard will pass every network. Offer OpenVPN in the app as fallback. Test both on residence hall Wi-Fi, on cellular, and on a hotel SSID a faculty member actually uses. Do not promise 24/7 engineering if the night path is a callback. The portal, the store listing, and the desk card should match. Misalignment is a ticket category. Name it before launch.

If this still sounds like your campus, bring a real package: who pays, IdP, store publisher, student versus staff defaults, credential life, desk languages, night path. White-label is the platform conversation. Contact is the meeting. Enterprise VPN is the inquiry shape when procurement is in the room. Consumer download is for people who already have a Klox account, not for a freshman with a move-in checklist.