Re: Betternet VPN
So I figured out how it was getting past the firewall. There was a policy that was implemented, not by me of course, that opened up the WiFi Calling service to and from the whole network. It was set as the first policy and all the student policies are much lower on the list and lower on the page. I didn't see it until I started moving my test policy up towards the top.
So for future reference to anyone else having this issue: WiFi Calling service will/can allow VPNs to bypass any other restrictions you have set.