Omnissa Workspace ONE Tunnel for Windows Release Notes

Omnissa Workspace ONE Tunnel for Windows Release Notes describe the new features and enhancements in each release. This page contains a summary of the new capabilities, issues that have been resolved, and known issues that have been reported in each release over the last 12 months.

Workspace ONE Tunnel 26.03 - May 2026

New Features

ARM64 Support
Introducing a native ARM64 build for Windows, enabling support for ARM‑based devices alongside x86‑64 systems.

Updates to Default Behavior

The toggle Tunnel option is now enabled by default. Users have the option to Enable and Disable Tunnel on-demand. Use the ToggleTunnelFeature KVP to manage this setting.
ApplyDnsToTunnelInterfaceOnly is now set to True by default.

Introducing New KVPS to always exclude specified IPs, CIDRs, and FQDNs from Tunnel management
With TUN mode, Workspace ONE Tunnel routes traffic through the ws1tun virtual adapter. In environments where other XDR and SSE agents also intercept network traffic, administrators can now explicitly define IPs, CIDRs, and FQDNs that always bypass the Tunnel interface. This may be useful to bypass endpoints that are in use by other agents on the device and reduce risk of conflicts where multiple agents compete to inspect or route the same traffic.

KVP: BypassInterfaceRoutes
- Specifies network routes that should always bypass the Tunnel interface.
- Accepted Value: IP and CIDR - comma separated.
- By default, the Tunnel Interface is set to 0.0.0.0.
KVP: BypassInterfaceFqdns
- Specifies FQDNs that should always bypass the Tunnel interface.
  Note: This is independent of the ExcludeFQDN KVP.

Minimum Requirements

Windows 10 or later
.NET Framework 4.8.1
Workspace ONE UEM Console 2410+
Omnissa Unified Access Gateway 2406+ | Workspace ONE Tunnel Container 24.12+

Resolved Issues

PPAT-20857: DTR parsing now gracefully skips unrecognized entries and continues processing remaining rules.
PPAT-21353: Tunnel client did not parse additional records included in SRV DNS responses.
PPAT-21434: DNS cache is not flushed on connection reset.

Known Issues

Standalone enrollment mode does not support in-place upgrades from the previous version of Tunnel. Please unenroll and uninstall the previous client before re-enrolling with the new 25.08 or later client. Seamless in-place upgrade support is planned for a future release. Any unenrollment requires uninstalling the Tunnel client to restore network access.
App Integrity Checking is not supported in this version. Support is planned for a future release.

Workspace ONE Tunnel 25.11 - February 2026

New Features

Captive Portal support for TUN mode
Tunnel client now supports captive portal detection and login when operating in TUN mode. To enable this feature, add the following key-value pair (KVP) in the Custom Configuration section of the Windows Tunnel profile.

KVP: EnableCaptivePortalDetection
Value: True (Default: False)

Support for wildcards in application file path
Configuring Windows applications for Tunnel is now more flexible with support for wildcard character in the file path. This is useful in multiple scenarios:

Application includes multiple executables in the same folder:
Example: C:\Program Files\Omnissa\Omnissa Horizon View Client\*
One Application may have varied install locations across end-user devices:
Example: C:\*\Google\Chrome\Application\chrome.exe
Wildcard match in folder path:
Example: C:\Program Files*\*

Limit DNS configuration to only the TUN interface
To prevent DNS leakage and enforce VPN lockdown, Windows Tunnel by default assigns its DNS configuration across all network interfaces on the device. To remove this configuration and reset other interfaces to their default DNS configuration, add the following key-value pair (KVP) in the Custom Configuration section of the Windows Tunnel profile.

KVP: ApplyDnsToTunnelInterfaceOnly
Value: True (Default: False)

Minimum Requirements

Windows 10 or later
.NET Framework 4.8.1
Workspace ONE UEM Console 2402+
Omnissa Unified Access Gateway 2406+ | Workspace ONE Tunnel Container 24.12+

Resolved Issues

PPAT-20857: Pre-logon does not work without user profile.
PPAT-20932: nslookup does not work for IPv4-masked IPv6 address.
PPAT-20971: DNS does not reset on network change.
PPAT-20368: Support for Environmental Variables in file path.

Known Issues

Per-App Tunnel limitations

IPv6 support - Applications making use of IPv6 addresses will not function with Tunnel and will be automatically bypassed.

Standalone enrollment mode does not support in-place upgrade from the previous version of Tunnel. Ensure to unenroll and uninstall the previous client before re-enrolling with the new 25.08 client. Seamless in-place upgrade support is planned for a future release.

App Integrity Checking is not supported in this version. Support is planned for a future release.

Workspace ONE Tunnel 25.08.2 - November 2025

New Features

Improvements to Rapid DTR Sync
There is no longer a requirement to initiate a one-time in-app sync from the client to enable Rapid DTR. The Tunnel client will periodically check-in with Workspace ONE APIs and locally update the DTR with changes, if any.

Minimum Requirements

Windows 10 or later
.NET Framework 4.8.1
Workspace ONE UEM Console 2402+
Omnissa Unified Access Gateway 2406+ | Workspace ONE Tunnel Container 24.12+

Resolved Issues

PPAT-20266: Client does not report device name in Standalone enrollment mode.

Known Issues

Per-App Tunnel limitations

Bypass Rules / VPN Lockdown - All domains listed in DTR will have VPN lockdown applied to them across all apps, regardless of TUNNEL or BYPASS being the rule. You may make use of the ExcludeFQDN KVP to omit external domains.
Environmental Variables in File Path - For any application flagged for Tunnel, environmental variables in the file path are not supported. This may impact applications installed manually by the end user. Applications deployed through Workspace ONE typically do not include the environmental variables in the file path.
IPv6 support - Applications making use of IPv6 addresses will not function with Tunnel and will be automatically bypassed.

App Integrity Checking is not supported in this version. Support is planned for a future release.

Workspace ONE Tunnel 25.08 - September 2025

New Features

Workspace ONE Tunnel 25.08 includes major improvements to how Tunnel operates and interoperates with other security agents, providing better performance and stability. Review the following information to ensure a seamless upgrade experience.

Updates to default operating mode

Tunnel now defaults to TUN mode, leveraging a TUN interface in the Windows routing table. Most improvements to Tunnel require running in TUN mode.

Legacy Filter mode can still be configured using the VpnMode KVP set to Filter.
There are now separate Windows services for each mode: TUN and Filter.
- TUN mode uses the Workspace ONE Tunnel Service.
- Filter mode is moved out of existing Workspace ONE Tunnel Service. Runs as a separate Workspace ONE Tunnel (Filter) Service, which can be disabled if needed.

Rapid DTR Sync enabled by default

Tunnel client periodically syncs with Workspace ONE APIs to locally update the Device Traffic Rules (DTR), if any. DTR updates no longer require profile republish or certificate regeneration.

Tunnel profile push is only needed on enrollment or certificate renewal.
Tunnel checks for DTR changes with UEM during app launch and every four hours.
Rapid DTR functionality is now enabled by default for MDM enrolled devices starting with client version 25.08. A one-time in-app sync may be required by the user to enable this functionality for their client.

Connection availability

Tunnel automatically connects when users log in to their system and remains connected unless the user explicitly disables Tunnel.

The ability to disable the client is available using the Custom Configuration KVP ToggleTunnelFeature, accepting values false(default) and true.
The On Demand mode where the client connects based on detected traffic is going to be reintroduced for TUN mode in a future release.

Simplification to DTR and Split DNS

Introduced enhancements to how Tunnel handles DNS resolution. These updates are designed to reduce latency and provide more consistent access to your resources.

Windows NRPT is no longer used and Enhanced Domain Resolution is the default mode of operation. Split DNS will obey Device Traffic Rules.
Legacy KVPs PreferInternalDNS, PreferExternalDNS are replaced with the following KVPs:
- If a domain can be resolved both internally and externally, specify the Tunnel Gateway KVP use_internal_dns_for_domains with a list of internally-preferred domains.
  Example: *.acme1.com, *.acme2.com (comma separated)
- Configure the Tunnel Client’s Custom Configuration KVP ExcludeFQDN to resolve DNS using the device's default DNS for the specified FQDNs.
  Example: fqdn1.external.com, fqdn2.external.com (comma separated)

Logging improvements

Collecting logs from the Tunnel client now provides additional outputs for troubleshooting device configuration and the Tunnel client’s cached configuration. The default log file, including information about Tunnel configuration updates and traffic routing is ws1tunnel.log. Additional log files are generated to describe the DNS mapping and more.

Minimum Requirements

Windows 10 or later
.NET Framework 4.8.1
Workspace ONE UEM Console 2402 or later

Resolved Issues

We are always working to improve Workspace ONE Tunnel with every release. There are no major bug fixes to report.

Known Issues

Per-App Tunnel limitations

Bypass Rules / VPN Lockdown - All domains listed in DTR will have VPN lockdown applied to them across all apps, regardless of TUNNEL or BYPASS being the rule. You may make use of the ExcludeFQDN KVP to omit external domains.
Environmental Variables in File Path - For any application flagged for Tunnel, environmental variables in the file path are not supported. This may impact applications installed manually by the end user. Applications deployed through Workspace ONE typically do not include the environmental variables in the file path.
IPv6 support - Applications making use of IPv6 addresses will not function with Tunnel and will be automatically bypassed.

App Integrity Checking is not supported in this version. Support is planned for a future release.

Workspace ONE Tunnel 25.02

New Features

Reintroducing support for Rapid DTR functionality.

Rapid DTR is now enabled by default.
Tunnel configuration and DTR updates may now be delivered in real time to the Tunnel client. This has the benefit of decoupling and reducing certificate regeneration when you want to deliver Device Traffic Rules.
The Tunnel client will instead check in with UEM every 4 hours and on service start.

Technical Requirements for this feature:

Workspace ONE HUB version 24.10 or later
For UEM version 2410 and lower, enable the following Feature Flag:
RemoveWindowsTunnelProfileDependencyFeatureFlag

Minimum Requirements

Windows 10 or later
.NET Framework 4.8.1
Workspace ONE UEM Console 2306 or later

Resolved Issues

PPAT-18822: Unable to access applications over loopback address.
PPAT-19054: Tunnel icon not available in system tray.
PPAT-19131: Improvements to memory management to address intermittent memory spikes.

Known Issues

In the event a user has exited Tunnel from the system tray, the user may not be prompted for MFA, if enabled. To re-enable, the Tunnel service will need to be restarted, either manually or via system reboot. Note that exiting Tunnel from the system tray only impacts MFA scenarios, and Tunnel will still be active and running in the background.

Workspace ONE Tunnel 24.11

New Features

This Windows client 24.11 release introduces an update to our modern Window Tunnel client, available through the Customer Connect portal.

Branding Update: The app now features a new logo and splash screens as part of our Omnissa rebranding.

Minimum Requirements

Windows 10 or later
.NET Framework 4.8.1
Workspace ONE UEM Console 2306 or later

Resolved Issues

There are no major issue resolutions to report in this release.

Known Issues

This new client version (v24.11) does not support Rapid DTR functionality. An upcoming version of the newly branded Windows Tunnel client will include this support.

Workspace ONE Tunnel 24.08

New Features

Improved Device Traffic Rules Delivery and Simplified Certificate Lifecycle

We’ve made a few updates regarding quality and performance improvements. Tunnel configuration and DTR updates may now be delivered in real time to the Tunnel client. This has the benefit of decoupling and reducing certificate regeneration when you want to deliver Device Traffic Rules. The Tunnel client will instead check in with UEM every 4 hours and on service start.

Add the following key under Custom Configuration in the VPN profile.
- Key: EnableRapidDtr, Value: True
Enable Feature Flag: RemoveWindowsTunnelProfileDependencyFeatureFlag
- This FF is only required for UEM versions < 2402
- After FF is enabled, please add version and publish the existing profile. All subsequent Tunnel configuration changes will not require a profile save or publish.

This feature will be enabled by default in a future version of UEM and the Windows Tunnel client.

Minimum Requirements

Windows 10 or later
Workspace ONE UEM Console 2302 or later
.NET Framework 4.8.1

Resolved Issues

PPAT-16111: Unable to connect to server due to SSL Trust error
- Customers should remove the UseNativeDataPlane KVP (or set KVP to true) and may now revert the disablement of specific signature algorithms following this KB article
PPAT-15502: Java-based applications are not properly captured
PPAT-17435: App Integrity Checking not working for some Windows system applications
PPAT-17718: Protected applications like lsaas and svchost are not properly captured due to system permissions

Known Issues

In the event a user has exited Tunnel from the system tray, the user may not be prompted for MFA, if enabled. To re-enable, the Tunnel service will need to be restarted, either manually or via system reboot. Note that exiting Tunnel from the system tray only impacts MFA scenarios, and Tunnel will still be active and running in the background.

Workspace ONE Tunnel 24.05

New Features

Application Security - App Integrity Check
- See this KB document for more information.
TLS 1.3 Support
- Tunnel Gateway already supports TLS 1.3 starting UAG 2309

Minimum Requirements

Windows 10 or later
Workspace ONE UEM 2212 or later

Resolved Issues

We are always working to improve Workspace ONE Tunnel. There are no major bug fixes to report for this release.

Known Issues

We haven’t identified any notable known issues in this release. If you’re facing any problems, feel free to reach out to our support team.

Workspace ONE Tunnel 24.01

New Features

General Availability: Performance optimizations for client-server communication, improved network throughput, and reduced memory footprint.

Minimum Requirements

Windows 10 or later
Workspace ONE UEM 2209 or later

Resolved Issues

We are always working to improve Workspace ONE Tunnel. There are no major bug fixes to report for this release.

Known Issues

We haven’t identified any notable known issues in this release. If you’re facing any problems, feel free to reach out to our support team.

Support Contact Information

To receive support, either submit a ticket through the Customer Connect portal or call your local support line. See Omnissa Support Phone Numbers (6000004) and Omnissa Customer Connect FAQs.

Download Instructions

You can download the new client from Customer Connect portal.

此页面对您有帮助吗?