A method comprising: determining, by a processor of a mobile device, that a mobile application executing on the mobile device requests to communicate with a private network; intercepting, by a processor, one or more system calls to communicate with the private network issued by the mobile application executing on the mobile device; determining, by the processor, that the one or more system calls comprise at least one domain name system, DNS, query addressed to a system level DNS process; responsive to determining that the one or more system calls are addressed to a domain socket path, replacing the domain socket path in the one or more system calls with a sandbox path that corresponds to the mobile application, the domain socket path being a path to the system level DNS process; generating, by the processor, a communication link to a virtual private network, VPN, server at the sandbox path through which to transmit communications from the mobile application to the private network; instructing, by the processor, the VPN server to transmit one or more messages from the mobile application to an access gateway (360, 516) for forwarding to the private network; identifying, by the processor, a destination network address of at least one message associated with the one or more system calls; transmitting, by the processor, the at least one message to the VPN server that is communicatively coupled to a local domain socket for DNS resolution; instructing, by the processor, an application specific DNS process at the VPN server to transmit the one or more messages to the access gateway for forwarding to the private network; and wherein replacing the domain socket path in the one or more system calls with the sandbox path further comprises: generating, by the processor, the sandbox path at the local domain socket through which to transmit communications from the mobile application to the private network; and generating, by the processor and for the mobile application, the VPN server that is communicatively coupled to the local domain socket. determining, by a processor of a mobile device, that a mobile application executing on the mobile device requests to communicate with a private network; intercepting, by a processor, one or more system calls to communicate with the private network issued by the mobile application executing on the mobile device; determining, by the processor, that the one or more system calls comprise at least one domain name system, DNS, query addressed to a system level DNS process; responsive to determining that the one or more system calls are addressed to a domain socket path, replacing the domain socket path in the one or more system calls with a sandbox path that corresponds to the mobile application, the domain socket path being a path to the system level DNS process; generating, by the processor, a communication link to a virtual private network, VPN, server at the sandbox path through which to transmit communications from the mobile application to the private network; instructing, by the processor, the VPN server to transmit one or more messages from the mobile application to an access gateway (360, 516) for forwarding to the private network; identifying, by the processor, a destination network address of at least one message associated with the one or more system calls; transmitting, by the processor, the at least one message to the VPN server that is communicatively coupled to a local domain socket for DNS resolution; instructing, by the processor, an application specific DNS process at the VPN server to transmit the one or more messages to the access gateway for forwarding to the private network; and wherein replacing the domain socket path in the one or more system calls with the sandbox path further comprises: generating, by the processor, the sandbox path at the local domain socket through which to transmit communications from the mobile application to the private network; and generating, by the processor and for the mobile application, the VPN server that is communicatively coupled to the local domain socket. generating, by the processor, the sandbox path at the local domain socket through which to transmit communications from the mobile application to the private network; and generating, by the processor and for the mobile application, the VPN server that is communicatively coupled to the local domain socket.