What is the difference between Personal VPN vs VPN Configuration profiles?

Question

I noticed that the VPN menu in the iPhone settings menu has two different kinds of VPN connections and I am troubled by it. There are two different types of VPN connections shown, Personal VPN profiles and a type for VPN Configuration profiles. After searching for a while, I haven't been able to find out the difference between the two.

---

( iPhone 5, iOS 8.3 )

---

Do the two different types have different types of encryption? Different types of connections?

Should one be preferred over the other?

Any clarification would be appreciated. Thank you.

---

EDIT: After reinstalling the profile, I realized the Personal VPN configuration isn't signed like the regular VPN configuration.

EDIT #2: Often times when I use the normal VPN configuration connection, it gets detected by the wifi I am connected to as a proxy and I receive warning messages because of it. If this is relevant I hope it helped.

Answer 1

In short, no. Both are instances of VPN configurations profiles.

By default, the “VPN Configurations” pane should be the only one that exists if you are installing a VPN configuration profile under the natively supported protocols (PPTP, L2TP/IPSEC).

The “Personal VPN” option appears only after installing certain software, such as Unlimited Free VPN by Betternet, which requires that you deploy the configuration profile in the form of a “preference pane profile” rather than deploying it either from the web, say, or through manual configuration. Additionally, the authentication involves a certificate exchange:

Details:

Apparently, it’s an implementation of the Network Extended Framework API:

The Network Extension framework (NetworkExtension.framework) provides support for configuring and controlling Virtual Private Network (VPN) tunnels. Use this framework to create VPN configurations. You can then start VPN tunnels manually or supply on-demand rules to start the VPN tunnel in response to specific events.

I’m not a developer, but having read the documentation and browsed around a few Stack Overflow discussions on it, it’s basically a plug-in that allows the user to manage an otherwise unsupported VPN protocol (IKEv2), and to do so within the native iOS VPN preference pane.

Do the two different types have different types of encryption?

At face value, no. If we are comparing the protocols, yes. The encryption depends on the protocol you are using and the VPN provider. With the exception of PPTP, the de-facto standard is 256-bit AES for transfer. IKEv2 supports and implements this.

Different types of connections?

In this sense, yes.

Sidenote: I use a third party application that supports OpenVPN to connect to my VPN provider (iPhone 6, running iOS 8.3) - as advised by them. The configuration profile appears as expected, under the default "VPN Configurations" pane.

My personal opinion would be to avoid all free VPN services unless you are rolling out your own. I use Private Internet Access, both on OS X and iOS, and highly recommend it.

Answer 2

The Personal VPN section contains VPN profiles added by applications that use the NetworkExtension.framework. These are traditional IPSEC VPNs that can use IKEv1 or IKEv2 for key exchange.

Supported authentication methods are PSK (Pre-Shared Key) in the case of IKEv1, or X.509 certificates for both IKEv1 and IKEv2. The security is equal to (or greater than, in the case of PPTP) what you find in the VPN configurations in the "VPN Configuration" section.

IPSEC VPNs should not be confused with SSL VPNs. NetworkExtensions.framework VPNs are IPSEC VPNs. Most commercial VPN products should support both IPSEC and SSL VPNs.

In the Open Source world, OpenVPN is an SSL VPN, whereas the SWAN software family (Strongswan, Libreswan, etc) supports IPSEC VPNs.

There are advantages and disadvantages to each type of VPN that are not in scope for a discussion like this. You can check Wikipedia for more details if you are interested.

Answer 3

To break it down for you more simply: think proxy vs actual VPN. Notice when IPSec and IKev2 is used and when it isn’t,

Answer 4

Personal VPN (Section: “PERSONAL VPN”)

These apps utilize iOS built-in VPN tunneling protocol implementations (IPSec, IKEv2, etc..).

Developers of this type of apps, setup server-side infrastructure for particular VPN protocol, and design iOS app to provide a configuration required for connecting to the infrastructure. This configuration is then picked up by iOS and the system takes responsibility on connecting and managing VPN connectivity.

Non-Personal VPN (Section: “VPN CONFIGURATIONS”)

These apps provide their own (custom) VPN tunnel implementation. It can be either an implementation of well-known VPN protocol (e.g. OpenVPN), or a custom implementation of custom VPN protocol.

Developers of this type of apps, create a special application extension. The system launches the extension. After that, the extension picks up the configuration from Network Extension preferences, and takes responsibility on connecting and managing VPN connectivity.

These apps’ configurations fall into VPN CONFIGURATIONS section of VPN Settings panel.

Because these apps have their own application extension to tunnel user’s traffic, some cool features can be implemented here. For instance, an app can filter content, prevent malware resources to be loaded, or support a Kill Switch.

Non-Personal VPN is also called Enterprise VPN. Perhaps, this implies that only BTB segment needs these features. However, we, as users also want this! Fortunatelly, a lot of VPN apps available on the App Store provide Enterprise VPN functionlaity these days.